Slashdot Mirror
Linux Kernel Bugs
Armin Herbert writes: "According to this mail from Rafal Wojtczuk and a german article on Heise Online, there's a new severe bug in all Linux Kernels, from 2.2.0 up to 2.4.10, which allows users to become root on your system.
Kernel 2.4.12 fixes this problem, and RedHat, Caldera and other distributors already supply patches for their Kernels. See Bugtraq for more information." Important notes for anyone running a multi-user system. Update: 10/19 16:12 GMT by J : If I'm reading Nergal's writeup correctly, 2.4.10 is still vulnerable to the local DoS, but not to the local root exploit. Separate issues. And as
pheared points out,
there is one unverified report of a custom 2.4.12 being vulnerable as well; please try the exploit on your system and let us know what you find. This is a big one, you can expect the kiddies have already added this to their rootkits. Update your systems now!
This means there is at least a year's moritorium on stupid "Microsoft-is-insecure" jokes. :)
Sometimes it's best to just let stupid people be stupid.
not to use Microsoft software ... oh, but wait
signature not found
Warning !
This is not true !
Don't upgrade to Linux 2.4.12.
Linux 2.4.12 is a satanic linux version which will control your mind and your computer.
You can easily see this on the version number,
for 2.4.12 means 2+4 . 2*6 = 6 6 6 - THE NUMBER OF THE BEAST.
DON'T UPGRADE.
If you scan the kernel sources you will see other satanic messages like "Inode" an anagram for DEOIN the 32. commander of baalzebubs forces, "semaphore" an anagram for SHAPOMER the 6. servant of azmoziel and "kernel threads" an anagram for "LAD SHENK RETER".
The MacOS according to bugtraq has never had a single exploit over a network.
Running Webstar on MAc OS 9.2 or older, any versions, is the safest most secure platform.
Instead of a backdoor every month or two like competing OS's, it has never had a discoverred exploit, or been hacked.
It is because the mac has no command line, no paths, no concept of root (all code is root, except micro kernel), no way to exec code from data files based on file name or file suffix, no way to corrupt stack easily (call chain different than intel), no way to creat buffer overruns from strings because most ac people and the ROMS, and OS, use length delimited pascal style strings instead of null terminated.
There are many more secure things dealing with CGI, alias paths, etc.
But in summary, the US ARmy uses MAc web servers and most experts agree, that the most secure server, if price is not an issue, is a mac from a local store and Webstar.
Hey, why doesn't someone use this exploit to insert a virus on that guy who was offering a $10K reward to anyone who could do this to his Linux box. A recent /. story but I don't have it handy. Come on, we know who that was...