Re: No need for 2.4.23 (re compromise)

2003-12-06 Thread Andreas Goesele
Mark C [EMAIL PROTECTED] writes: same here from the debian sources, but with a few added patches, there is no need to download a new kernel, just get the source you have for the currently running kernel, apply this patch: -- cut - --- 1.31/mm/mmap.c

No need for 2.4.23 (re compromise)

2003-12-05 Thread Christian Schnobrich
Hello, I'm quite behind on reading this list, so maybe someone else has already pointed this out, and anyway it's coming rather late. Still: If your only concern is the brk() vulnerability, you don't need to get kernel sources from wherever and roll your own. I've seen this several times now,

Re: No need for 2.4.23 (re compromise)

2003-12-05 Thread Vincent Lefevre
On 2003-12-05 12:19:13 +0100, Christian Schnobrich wrote: If your only concern is the brk() vulnerability, you don't need to get kernel sources from wherever and roll your own. I've seen this several times now, and not yet a single message to the contrary. No, Debian didn't leave Joe User

Re: No need for 2.4.23 (re compromise)

2003-12-05 Thread Bill Moseley
On Fri, Dec 05, 2003 at 08:39:44PM +0900, Vincent Lefevre wrote: No, Debian didn't leave Joe User out in the rain to get his own kernel source. All you need is apt-getable. Even a kernel package if you don't want to compile just now. But this means downgrading to 2.4.18. Right. I asked

Re: No need for 2.4.23 (re compromise)

2003-12-05 Thread Vincent Lefevre
On 2003-12-05 07:47:47 -0800, Bill Moseley wrote: [...] kernel-source-2.4.20 - Linux kernel source for version 2.4.20 with Debian patches I'm using that last one, 2.4.20. But I don't think it has been fixed, as there is no version from the security updates: greux:~ apt-show-versions

Re: No need for 2.4.23 (re compromise)

2003-12-05 Thread Bill Moseley
On Fri, Dec 05, 2003 at 05:20:28PM +0100, Vincent Lefevre wrote: On 2003-12-05 07:47:47 -0800, Bill Moseley wrote: [...] kernel-source-2.4.20 - Linux kernel source for version 2.4.20 with Debian patches I'm using that last one, 2.4.20. But I don't think it has been fixed, as there is

Re: No need for 2.4.23 (re compromise)

2003-12-05 Thread Vincent Lefevre
On 2003-12-05 09:14:01 -0800, Bill Moseley wrote: my notes for the machine show I used wget ftp://ftp.kernel.org/pub/linux/kernel/v2.4/linux-2.4.20.tar.bz2 so much for taking good notes. I must have had some problem with the kernel.org version and just copied the package from a Sid

Re: No need for 2.4.23 (re compromise)

2003-12-05 Thread Tom
On Fri, Dec 05, 2003 at 07:03:08PM +0100, Vincent Lefevre wrote: BTW, is it possible to use the make-kpkg method with kernels from kernel.org or is make-kpkg reserved for kernel-source-* packages? Yes, thank goodness. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of

Re: No need for 2.4.23 (re compromise)

2003-12-05 Thread Mark C
On Fri, 2003-12-05 at 15:47, Bill Moseley wrote: I'm using that last one, 2.4.20. same here from the debian sources, but with a few added patches, there is no need to download a new kernel, just get the source you have for the currently running kernel, apply this patch: --

Re: No need for 2.4.23 (re compromise)

2003-12-05 Thread Bill Moseley
On Sat, Dec 06, 2003 at 01:07:31AM +, Mark C wrote: On Fri, 2003-12-05 at 15:47, Bill Moseley wrote: I'm using that last one, 2.4.20. same here from the debian sources, but with a few added patches, there is no need to download a new kernel, just get the source you have for