Slashdot Mirror
Linux Kernel Bugs
Armin Herbert writes: "According to this mail from Rafal Wojtczuk and a german article on Heise Online, there's a new severe bug in all Linux Kernels, from 2.2.0 up to 2.4.10, which allows users to become root on your system.
Kernel 2.4.12 fixes this problem, and RedHat, Caldera and other distributors already supply patches for their Kernels. See Bugtraq for more information." Important notes for anyone running a multi-user system. Update: 10/19 16:12 GMT by J : If I'm reading Nergal's writeup correctly, 2.4.10 is still vulnerable to the local DoS, but not to the local root exploit. Separate issues. And as
pheared points out,
there is one unverified report of a custom 2.4.12 being vulnerable as well; please try the exploit on your system and let us know what you find. This is a big one, you can expect the kiddies have already added this to their rootkits. Update your systems now!
This happens all the time? When will people realize that Linux is inferior and unsecure. Everyone knows that open-source peer-review is a lousy tool for security-audits. No, why doesn't everyone run Microsoft products? They're completly secure and doesn't have any problems at all. Because that's the power of closed source.
Hope the irony isn't lost on you...
And here i am trying to remember my password for root..
I am working on a project to port IIS over to this effected kernel
If you have stupid and malicious users, ulimit is your friend. And process accounting. And a baseball bat.
Szo
Red Leader Standing By!
In a recent article on CNet:
This week, Linus Torvalds, manager for Linux's security response center, published an essay on the company's site decrying the information and example code released by some companies and independent security consultants as "information anarchy."
"It's high time the security community stopped providing the blueprints for building these weapons," Linus wrote in the essay. "And it's high time that computer users insisted that the security community live up to its obligation to protect them."
"The state of affairs today allows even relative novices to build highly destructive (malicious software)," he wrote in the essay. "It's simply indefensible for the security community to continue arming cyber criminals. We can at least raise the bar."
"(We) don't purport to have the answer to the problem," he said in a Wednesday interview. "But we believe that these practices are harmful."
Things you think are in the Constitution, but are not.
And a baseball bat.
Shh! Not so loud! My boss still thinks that a LART is a sophisticated piece of network analysis hardware. I never told him that the bills we get for replacing broken LARTs come from the Louisville Slugger Company.
That's "Mr. Soulless Automaton" to you, Bub.
(sarcasm, you fool)