MSI :: State of Security

Insight from the Information Security Experts

Linux Local Kernel Exploit

Posted on February 11, 2008 by Adam Hostetler

Two proof of concept kernel exploits have been released into the wild that exploit a newly discovered vulnerability. Kernel versions 2.6.17 to 2.6.24.1 are affected. The vulnerability is found within the vmsplice function call. This exploit effectively gives local root access on a wide range of Linux distributions.
Kernel version 2.6.24.2 fixes the issue. It’s recommended to disable all shell access until your kernel is updated, either by building from sources, or waiting for your Linux distribution to release an update.

Ubuntu updates

Posted on February 5, 2008 by wstoner

Updates for the Ubuntu kernel and for the apache2 server have been released. The kernel update fixes multiple vulnerabilities whihc could result in the corruption of the file system, Denial of Service conditions, bypassing certain security restrictions and the disclosure of sensitive information. Versions 6.10, 7.04 and 7.10 are vulnerable. The apache2 update addresses Cross Site Scripting and Denial of Service vulnerabilities on versions 6.06, 6.10, 7.04 and 7.10.