Flaw in most Linux kernel allows attack
Quote:
The Debian Project warned on Monday that a flaw in the Linux kernel helped attackers compromise four of the open-source software project's development servers.
During several intrusions Nov. 19, the flaw enabled an attacker who already had access to a server to remove the limitations that protected the system from everyday users. The technique is known as a privilege escalation.
Members of the development team found the flaw in September and fixed the latest version of the core Linux software, or kernel. The fix came a bit late, however. The latest version of the kernel, 2.4.23, was released Friday, eight days after the Debian breach.
The Debian Project, which uses only truly open-source software in its make-up, stressed that the breaches hadn't affected the project's code base.
"Fortunately, we require developers to sign the upload (software) digitally," said Martin Schulze, a developer and member of the project. "These files are stored off-site as well, which were used as a basis for a recheck."
The development team promised to lock all developer accounts until the flaw had been found and fixed. The team published patches for the flaw on Monday as well but didn't specify when the accounts would be unlocked.
The unknown attacker compromised at least four servers. The systems--known as Master, Murphy, Gluck and Klecker--had maintained the open-source project's bug tracking system, source code database, mailing lists, Web site and security patches.
The attacker gained access to one of the systems by compromising a developer's computer and installing a program to sniff out the characters typed on the developer's keyboard, according to a postmortem analysis the team published Friday. When the programmer logged into the klecker system, the attacker recorded his password.
Using the September flaw, the attacker gained owner privileges on Klecker. This is frequently referred to as "owning" the system. The flaw--in a part of the kernel that manages memory--allows only users that already have access to the system to raise their privileges. Such flaws are less critical than vulnerabilities that give an outside attacker access to a server and so are fixed less quickly.
The attacks have been the latest leveled at open-source software. In early November, an attacker attempted to corrupt the Linux kernel with a coding error that would have created a flaw similar to the one that affected the Debian Project. A year ago, malicious attackers placed spyware into a popular open-source tool, Tcpdump. Several other known attacks have also been executed against other open-source projects.
The latest bug has been fixed in the most recent version of the Linux kernel, 2.4.23, and has also been patched in the next generation of Linux since 2.6.0-test6, which was released in late September.
Despite a two-month delay in releasing a patch, Ian Murdock, the founder of Debian and the chairman of Linux distribution maintenance provider Progeny, praised the project team.
"All in all, the way the Debian guys handled the situation has been admirable: They have been open with what they found out, and the speed at which they have found things out has been quite quick," he said. Murdock is a developer on the team but no longer has day-to-day administration duties.
Source : http://zdnet.com.com/2100-1104_2-5112427.html
Need user access to the machine
FYI, it is a system call available to any process that is broken. You need to make a C program with that particular system call, compile it, run it on that machine as a user (you need to have a valid login to the machine to do any of this), and the user that runs it gets a bump in permissions to root level. Basically, if someone doesn't have a login with a valid shell on your box, they can't use this exploit. It is a serious problem for those providers of a shell with their web/ftp accounts, but for the vast majority, your user base with a shell is much smaller and more manageable, plus, if the admin is smart, they'll restart all shells and do a symbolic link for everyone but root to /bin/false as their shell until they get this resolved. Plus, it would be interesting to see which users were actively creating such a process. Anyway, no-one is going to gain access to your machine with this. It only increases their permissions that they already have.
Re: Need user access to the machine
Quote:
Originally posted here by Turing_Machine
.....if the admin is smart, they'll restart all shells and do a symbolic link for everyone but root to /bin/false as their shell until they get this resolved.
Could you elaborate more on this?
