In case you didn't catch this. (Granted, the idea of Bering is they
aren't supposed to get in so they could use it.)
-------
Serious Linux Security Flaw Found
Tue Dec 2, 9:00 AM ET
/Robert McMillan, IDG News Service/
A serious vulnerability in the Linux 2.4 kernel has been discovered. The
flaw allows users on a Linux machine to gain unlimited access
privileges, according to a security advisory posted by developers of the
noncommercial Debian Linux distribution.
The bug affects versions of the Linux kernel prior to 2.4.23, and was
the method used during a recent attack on Debian's servers, according to
the advisory. In that attack four Linux servers that hosted Debian's bug
tracking system, mailing lists, and various Web pages were compromised.
The vulnerability can only be exploited by someone who has already been
given a user account on the Linux machine, and does not affect users of
every Linux system, said Linux creator Linus Torvalds in an e-mail
interview.
"It's a local-only compromise that you can't trigger from the outside,"
he said. "To most people, it would thus become serious only after you
had some account hacked into--the bug then allows elevation of
privileges."
Patching the Problem
The bug does not only affect Debian users, however. Any Linux user
running a version of the kernel prior to 2.4.23 should contact their
distribution provider to see whether a patch for the exploit has been
made available, Torvalds said.
The problem was discovered by Linux kernel developer Andrew Morton in
September, and was fixed in the 2.4.23 version of the kernel. Linux
distributors had been working to coordinate a release of a fix for the
problem, said Dave Wreski, chief executive officer with Guardian
Digital, the vendor of a secure Linux distribution.
"What all the hoopla is about is that Debian somehow let this patch
that's been available for a month or two slip and got bitten by it,"
said Wreski.
As of Monday, patches that corrected the kernel bug had been issued for
a number of Linux distributions, including Red Hat, Debian, and Mandrake
Linux.
Paul Rogers ([EMAIL PROTECTED])
http://www.xprt.net/~pgrogers/
http://www.angelfire.com/or/paulrogers/
Rogers' Second Law: "Everything you do communicates."
(I do not personally endorse any additions after this line. TANSTAAFL
:-)
________________________________________________________________
The best thing to hit the internet in years - Juno SpeedBand!
Surf the web up to FIVE TIMES FASTER!
Only $14.95/ month - visit www.juno.com to sign up today!
-------------------------------------------------------
This SF.net email is sponsored by OSDN's Audience Survey.
Help shape OSDN's sites and tell us what you think. Take this
five minute survey and you could win a $250 Gift Certificate.
http://www.wrgsurveys.com/2003/osdntech03.php?site=8
------------------------------------------------------------------------
leaf-user mailing list: [EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/leaf-user
SR FAQ: http://leaf-project.org/pub/doc/docmanager/docid_1891.html
