Linux Local kernel vulnerability



SANS has a story on another local kernel vulnerability for linux. I’ve got to say that I typically haven’t looked as much at “local” vulnerabilities on this site as I have talked about remote vulnerabilities. Usually local vulnerabilities are flaws that allow a user that’s already logged into a system to escalate their user rights to control the system. So, IF you allow logins for various users, you definitely need to pay attention to local vulnerabilities.


This is essentially the same type of flaw that was used in the Debian development server compromise from what I can gather. A developer had a weak password and that was either broken or guessed (or discovered) by someone…. that “someone” logged in and found that there were some interesting possibilities to get greater access to the machine.

This vulnerability seems to be in the current kernel release, although SELinux seems to block the exploit – soooooo…. Linuxi that employ SELinux should be less at risk.

Related Posts

Blog Traffic Exchange Related Posts
  • Cross browser javascript vulnerability It sounds like this vulnerability would take a great deal of user interaction, but cio-today is reporting on a browser vulnerability that affects pretty much every javascript enabled browser. According to Symantec .... "This issue is triggered by utilizing JavaScript 'OnKeyDown' events to capture and duplicate keystrokes from users," and......
  • System patching 0-days and ancient-day vulnerabilities There's a good article at Michael Sutton's Blog which points out something that really makes sense and I think many people are aware of, but with all the buzz that a new previously undisclosed vulnerability has, we forget. The point is this, there are plenty of machines online vulnerable to......
  • Debian development server compromise Sans also brings this story about the Debian development server being compromised. Investigation is ongoing. The machine was gluck.debian.org and hosted CVS among other things (ddtp, lintian, people, popcon, planet, ports, release). It has been taken offline currently for a reinstall, other systems have been locked down until they can......
Blog Traffic Exchange Related Websites
  • Most Popular and Useful Security Apps for a Smart Phone The following is a post from staff writer Crystal at Budgeting in the Fun Stuff, where she writes about finding the balance between paying your bills, saving for your future, and budgeting in the fun stuff along the way. Buying a smart phone is a major investment because you spend......
  • iPhone Jailbreaking: Security Concern or Not? Charlie Miller of Tipb.com stated, “Turns out that if you jailbreak your iPhone you remove most of the Apple’s security protections — 80% to be exact — and are vulnerable to attacks.” That statement seems to resonate across the cell phone app community when discussing the adverse effects of......
  • Shopping at a Perfume Outlet Your local mall probably has at least one perfume outlet. You can find these stores sometimes in strip malls, kiosks and even online. But is it a good idea to shop at a perfume outlet, or are you getting an inferior product for the smaller price tag? A perfume outlet......
www.pdf24.org    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site