the kde packages done by debian were affected by the kde exploit this way: they were not setuid root, but setgid shadow. so it could be possible to read /etc/shadow, but not get root rights. andreas