Slashdot Mirror

← Back to Stories (view on slashdot.org)

Kernel Exploit Cause Of Debian Compromise

Posted by simoniker on from the slightly-disturbing dept.

mbanck writes "The cause of the recent Debian Project server compromise has been published by the Debian security team: 'Forensics revealed a burneye encrypted exploit. Robert van der Meulen managed to decrypt the binary which revealed a kernel exploit. Study of the exploit by the RedHat and SuSE kernel and security teams quickly revealed that the exploit used an integer overflow in the brk system call. Using this bug it is possible for a userland program to trick the kernel into giving access to the full kernel address space'. This issue has been fixed in 2.4.23. Thus, the Linux kernel compromise was not Debian specific."

5 of 673 comments (clear)

  1. Re:Shows the dangers of C by Anonymous Coward · · Score: 0, Redundant

    You moron. Should have been done in Java.

  2. Re:Shows the dangers of C by Cro+Magnon · · Score: 2, Redundant
    If the kernel was coded in visual basic, this wouldn't be happening.


    Get real! Everyone knows kernels should be coded in COBOL!
    --
    Slow down, cowboy! It has been 4 hours since you last posted. You must wait another few hours.
  3. Re:Shows the dangers of C by Anonymous Coward · · Score: 0, Redundant

    If this was coded in visual basic we'd have a lot more to be worried about

  4. Re:My my my, yet another Linux bug. by Anonymous Coward · · Score: 0, Redundant

    5 to 1?
    tastes pretty damn good so far.
    BTW has the shatter explotit been fixed yet?
    Nope. Will it ever be?
    Nope.
    Fanboy

  5. It's Linux's fault not Debian(!?) by ece · · Score: 0, Redundant

    It's ok because it's the kernel that's been exploited; not Debian. wtf? what's Debian without the Linux kernel? and what's Debian without GNU software? This is like saying that it's apache that was exploited and not Debian so it's ok. That attitude, loose it. An admin is supposed to patch his shit and not blame it on the developer.