[svlug] SECURITY: Kernel upgrade for < 2.4.23 or < 2.6.0-test6 -- local user memory access flaw

[Karsten M. Self]

Following was posted to debian-security-announce, and appears to be
related to the Debian Project server compromises.

While it doesn't appear that this provides root access directly,
analysis of memory may lead to same.

If you're not running the Universal Operating System, consult your own
distro security sources for information.

    - ------------------------------------------------------------------------
    Debian Security Advisory DSA-403-1                   security at debian.org
    http://www.debian.org/security/                         Wichert Akkerman
    December  1, 2003
    - ------------------------------------------------------------------------


    Package        : kernel-image-2.4.18-1-alpha, kernel-image-2.4.18-1-i386,
    kernel-source-2.4.18
    Vulnerability  : userland can access full kernel memory
    Problem type   : local
    Debian-specific: no
    CVE Id(s)      : CAN-2003-0961

    Recently multiple servers of the Debian project were compromised using a
    Debian developers account and an unknown root exploit. Forensics
    revealed a burneye encrypted exploit. Robert van der Meulen managed to
    decrypt the binary which revealed a kernel exploit. Study of the exploit
    by the RedHat and SuSE kernel and security teams quickly revealed that
    the exploit used an integer overflow in the brk system call. Using
    this bug it is possible for a userland program to trick the kernel into
    giving access to the full kernel address space. This problem was found
    in September by Andrew Morton, but unfortunately that was too late for
    the 2.4.22 kernel release.

    This bug has been fixed in kernel version 2.4.23 for the 2.4 tree and
    2.6.0-test6 kernel tree. For Debian it has been fixed in version
    2.4.18-12 of the kernel source packages, version 2.4.18-14 of the i386
    kernel images and version 2.4.18-11 of the alpha kernel images.

See:

http://lists.debian.org/debian-security-announce/debian-security-announce-2003/msg00212.html


Peace.

-- 
Karsten M. Self <kmself at ix.netcom.com>        http://kmself.home.netcom.com/
 What Part of "Gestalt" don't you understand?
    Go through his clothes and look for loose change.
    - Princess Bride
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://lists.svlug.org/archives/svlug/attachments/20031201/829f7487/attachment.bin