Slashdot Mirror

← Back to Stories (view on slashdot.org)

Linux Kernel Bugs

Posted by michael on from the patching-time dept.

Armin Herbert writes: "According to this mail from Rafal Wojtczuk and a german article on Heise Online, there's a new severe bug in all Linux Kernels, from 2.2.0 up to 2.4.10, which allows users to become root on your system. Kernel 2.4.12 fixes this problem, and RedHat, Caldera and other distributors already supply patches for their Kernels. See Bugtraq for more information." Important notes for anyone running a multi-user system. Update: 10/19 16:12 GMT by J : If I'm reading Nergal's writeup correctly, 2.4.10 is still vulnerable to the local DoS, but not to the local root exploit. Separate issues. And as pheared points out, there is one unverified report of a custom 2.4.12 being vulnerable as well; please try the exploit on your system and let us know what you find. This is a big one, you can expect the kiddies have already added this to their rootkits. Update your systems now!

2 of 307 comments (clear)

  1. Re:This is so typical by DocSnyder · · Score: 0, Redundant

    If the bug had occured on a closed source system, the vendor would have tried to keep it secret as long as possible. Bugs can and will happen no matter if the software is open source or not, and this one can't be too trivial, otherwise it would have been discovered earlier. With closed source software, it probably wouldn't have been discovered it at all.

  2. Re:"Only" a local root exploit by Nailer · · Score: 1, Redundant

    If you want to compare to Windows: up till Windows XP it wasn't even possible to be logged in as multiple users at the same time, so the equivalent of a local root exploit was not really possible.

    NT has has the ability to run su type programs for a very long time (since the NT4 resource kit).

    There's been multiuser (albeit remote) version of NT since Citrix released their NT 3.51 Terminal Server.