Linux Security Hole

/. ^ | 03/17/03 | Alan Cox

[Salo]

Vulnerability: CAN-2003-0127

The Linux 2.2 and Linux 2.4 kernels have a flaw in ptrace. This hole allows local users to obtain full privileges. Remote exploitation of this hole is not possible. Linux 2.5 is not believed to be vulnerable.

Linux 2.2.25 has been released to correct Linux 2.2. It contains no other changes. The bug fixes that would have been in 2.2.5pre1 will now appear in 2.2.26pre1. The patch will apply directly to most older 2.2 releases.

[Salo]

Hope this isn't a repost. Looks like more patching.

[Salo]

Pinging the Penguin Pinger.

[Incorrigible]

Bump

[Salo]

Now you can have your fun.

[justlurking]

A problem, but not as big a deal as the IIS hole yesterday because it isn't remotely exploitable. You have to be logged in to the system. The thread on Slashdot also offers some easy work-arounds until you can get them patched.

Also unlike the IIS patch, this one is not known to have been exploited (yet). Alan Cox apparently noticed it while working on something else.

[Bush2000]

Who cares. Ongoing security is a fact of life. All software needs to be patched. You'd think (based on Slashdot) that this was a MS-only phenomenon...

[dandelion]

It shouldn't really be a problem if ptrace is not remotely exploitable; but if the system is accessed remotely FIRST, then a hack could be done as a local user through ptrace, no?

I'm still learning the ropes here, so I haven't got the low down on this one. Just thinking that if I were hacking, I'd hack into an open port and THEN use ptrace if it were available to make me root. But if ptrace is exploitable through local user, would it be possible for the admin to set stricter parameters through the user settings?

I guess I should patch just to be safe...

[HEY4QDEMS]

As long as MicroSoft owns the lions share of the market, it will always be targeted by worms, attacks, etc., and therefore will always appear to have the most "holes" in it's security.

If or when Linux becomes the most common network OS, it will become increasingly targeted, when that happens you can be sure that new "holes" will be found in it as well.

There was a time when UNIX was the preffered target of hackers, security updates and audits were performed almost daily.

[Liberal Classic]

Both Windows and Linux are victims of their own success.

[hchutch]

Precisely.

The sheer volume of Windows as compared to Linux makes the chance that a security flaw will be found that much greater.

[Bush2000]

Here's a sample of the supposed "security" of Apache:

Apache Jakarta Tomcat 3 URL parsing vulnerability (Archive)
Last modified on: 2003-01-30

Apache Tomcat Example Web Application Cross Site Scripting Vulnerability (Vulnerabilities)
Last modified on: 2003-01-26

Apache Tomcat Web.XML File Contents Disclosure Vulnerability (Vulnerabilities)
Last modified on: 2003-01-26

Apache Tomcat Null Byte Directory/File Disclosure Vulnerability (Vulnerabilities)
Last modified on: 2003-01-26

Apache Web Server Default Script Mapping Bypass Vulnerability (Vulnerabilities)
Last modified on: 2003-01-22

Apache Web Server MS-DOS Device Name Denial Of Service Vulnerability (Vulnerabilities)

Apache Web Server MS-DOS Device Name Arbitrary Code Execution Vulnerability (Vulnerabilities)
Last modified on: 2003-01-22

Apache Web Server Illegal Character HTTP Request File Disclosure Vulnerability (Vulnerabilities)
Last modified on: 2003-01-22

Apache/Tomcat Denial Of Service And Information Leakage Vulnerability (Archive)
Last modified on: 2002-12-04

Apache/Tomcat Mod_JK Chunked Encoding Denial Of Service Vulnerability (Vulnerabilities)
Last modified on: 2002-12-04

Apache mod_php File Descriptor Leakage Vulnerability (Vulnerabilities)
Last modified on: 2002-11-06

apache mod_ssl cross-site scripting vulnerability (Advisories)
Last modified on: 2002-10-29

Apache 2 WebDAV CGI POST Request Information Disclosure Vulnerability (Vulnerabilities)
Last modified on: 2002-10-29

Apache HTPasswd Insecure Temporary File Vulnerability (Vulnerabilities)
Last modified on: 2002-10-17

Apache HTDigest Arbitrary Command Execution Vulnerability (Vulnerabilities)
Last modified on: 2002-10-17

Apache HTDigest Insecure Temporary File Vulnerability (Vulnerabilities)
Last modified on: 2002-10-17

[HEY4QDEMS]

That's exactly the point, most security weaknesses are exposed because someone was determined enough to expose them.
You don't have to tell me about Apache, we run Oracle App server (can you guess what the base app is, I'll give you a hint, it's not Soiux, or Seminole)

[Bush2000]

Oracle: Unbreakable (TM)

BWAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHA!!!!

[Bush2000]

Here's another fun link: Linux Root Kit.

[amigatec]

See what I have in my firewall logs?

03/16-21:47:09.640864 [**] [1:2003:2] MS-SQL Worm propagation attempt [**] [Classification: Misc Attack] [Priority: 2] {UDP} XXX.XXX.XXX.XX:1211 -> XX.XXX.XX.XXX:1434

I have been getting at least one of these every day for about a week now.

[B Knotts]

I'm a little confused. 2.4.20 is supposed to be vulnerable to this, but I cannot reproduce it.

[amigatec]

Here's another fun link: Windows Root Kit.

There fixed it for you!!

[sonofatpatcher2]

French Air Force Security Hole

[HiTech RedNeck]

What kind of access is needed to install each kit? Windows is easier to victimize since more users run routinely with admin privs than Linux users run routinely as root. Linux is a far simpler core operating system than Windows, pushing more of the complexity to unprivileged processes, so Linux simply has fewer cracks and crevices for malware to hide.

[Bush2000]

Whoopie. I hope you're patched to thwart the Linux Slammer worm, troll ...