<snip>

No holes in Linux as far as I can tell. Never had a virus in six
years.

Paul Lamar

Since 1992, there have been 4 virus / worms / trojans - total of 4.
All were rendered immune after the rapid deployment of a patch that
didn't require a reboot.  Not bad.

-dave

Hi Paul,
        Just received this internally at work from our Linux security types. The public url is
http://www.linuxsecurity.com/articles/server_security_article-9444.html, it does seem that even Linux is starting to fall prey to the cyber terrorists.


Overview
A Linux kernel bug (discovered by accident by a code tester) allows a simple C program crash the kernel, effectively locking the whole system. The security
hole affects both 2.4.2x and 2.6.x kernels on the x86 and x86_86 architectures. Root access is not required, nor does a compiler have to be present on the
target.


Description
Using this exploit to crash Linux systems requires the attacker to have shell access or other means of uploading and running the program (like cgi-bin and FTP
access). The program works on any normal user account, root access is not required. The exploit code was posted to the Internet on June 15, 2004 and is now
receiving media attention.

Testing by SATF has validated the exploit code; a target was taken out of service in seconds.

Systems Affected
The security hole affects both 2.4.2x and 2.6.x kernels on the x86 and x86_86 architectures. The bug is not present in 2.2.19, it seems this bug only affects
2.4 and later. The code does not compile (makes no executable) on sparc64 sun4u TI UltraSparc II (BlackBird). This doesn't affect NetBSD Stable.

SMP systems can be compromised, but a separate instance of the program is required for each CPU before the system halts. Each instance of the program code
will lock one CPU and this process can not be killed. If you have two CPUs the second instance of the program kills the entire machine

Cheers.........Gary

 
The Rotary Engine NewsLetter.  Powered by Linux.
ACRE NL web site. http://home.earthlink.net/~rotaryeng/            
Copyright 1998-2004 All world wide rights reserved.