Slashdot Mirror

← Back to Stories (view on slashdot.org)

Kernel Exploit Cause Of Debian Compromise

Posted by simoniker on from the slightly-disturbing dept.

mbanck writes "The cause of the recent Debian Project server compromise has been published by the Debian security team: 'Forensics revealed a burneye encrypted exploit. Robert van der Meulen managed to decrypt the binary which revealed a kernel exploit. Study of the exploit by the RedHat and SuSE kernel and security teams quickly revealed that the exploit used an integer overflow in the brk system call. Using this bug it is possible for a userland program to trick the kernel into giving access to the full kernel address space'. This issue has been fixed in 2.4.23. Thus, the Linux kernel compromise was not Debian specific."

4 of 673 comments (clear)

  1. This smells like the work of... by Anonymous Coward · · Score: 0, Flamebait
    This exploit required a measure of sophistication to pull it off. But why would such an attacker target debian? He must have had a motive; something to gain. And who wins if debian were to suffer a setback?

    (A: Microsoft)

  2. My my my, yet another Linux bug. by Anonymous Coward · · Score: 0, Flamebait

    And they call Windows unsecure. How does crow taste, Slashdot?

  3. Re:Wow, a Clippy joke by /ASCII · · Score: 0, Flamebait

    Yeah, all these lame BSOD jokes really show how few of the slashdot readers actually base their comments on any modern Microsoft OS. If they did, they would know that the default system crash behaviour for the last three years has been automatical reboot.

    --
    Try out fish, the friendly interactive shell.
  4. Re:Amateurs ;-) by nathanh · · Score: 0, Flamebait
    I hope this isn't a Linux box. Boasting about uptime is OK, aslong as no kernel holes have been discovered during that period. If I were you I would shut the f*ck up and cross my fingers. Alternativley build a new kernel with all the fixes (ptrace, brk, any others??) and reboot.

    If I was you I'd try harder to not act like a presumptuous arrogant shit, telling people how to run their own servers as if you're the fountain of all knowledge. Those are both local exploits. They don't affect me in the slightest.