Found the following article on slashdot and immediately jumped over to my linux boxes to ensure we aren't vulnerable.
http://linux.slashdot.org/story/09/11/04/0320254/Bug-In-Most-Linuxes-Can-Give-Untrusted-Users-Root?from=rss
More information can be found at securityfocus here:
http://www.securityfocus.com/bid/26831/info
From what I understand, you can fix this vulnerability by simply setting the vm.mmap_min_addr setting to a value of 4096 or greater ( in short, if this value is 0, you are vulnerable). I also read that if you install wine (winehq.com) that it will automatically set this value to 0 and make you vulnerable.
To check the value of this variable on your linux system to see if you are currently vulnerable, just run this command and ensure it is not set to a value of 0:
sysctl vm.mmap_min_addr
On debian based installations, check the following site for how to fix this for the current boot and how to make it persist a reboot.
http://wiki.debian.org/mmap_min_addr
For those that are really concerned right now, I checked my Ubuntu 8.04.3 LTS servers and they all are defaulted to 65535 for this value, so they should not be vulnerable to this bug. Keep in mind what I stated above though, if you install wine, you become vulnerable.
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment