Re: [Full-disclosure] [SECURITY] [DSA 1862-1] New Linux 2.6.26 packages fix privilege escalation

[morla <morla@xxxxxxxxxxxxx>]

dann frazier wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> - ----------------------------------------------------------------------
> Debian Security Advisory DSA-1862-1                security@xxxxxxxxxx
> http://www.debian.org/security/                           dann frazier
> Aug 14, 2009                        http://www.debian.org/security/faq
> - ----------------------------------------------------------------------
> 
> Package        : linux-2.6
> Vulnerability  : privilege escalation
> Problem type   : local
> Debian-specific: no
> CVE Id(s)      : CVE-2009-2692
> 
> A vulnerability has been discovered in the Linux kernel that may lead
> to privilege escalation. The Common Vulnerabilities and Exposures project
> identifies the following problem:
> 
> CVE-2009-2692
> 
>     Tavis Ormandy and Julien Tinnes discovered an issue with how the
>     sendpage function is initialized in the proto_ops structure.
>     Local users can exploit this vulnerability to gain elevated
>     privileges.
> 
> For the stable distribution (lenny), this problem has been fixed in
> version 2.6.26-17lenny2.
> 
> For the oldstable distribution (etch), this problem will be fixed in
> updates to linux-2.6 and linux-2.6.24.
> 
> We recommend that you upgrade your linux-2.6 and user-mode-linux
> packages.
> 
> Note: Debian carefully tracks all known security issues across every
> linux kernel package in all releases under active security support.
> However, given the high frequency at which low-severity security
> issues are discovered in the kernel and the resource requirements of
> doing an update, updates for lower priority issues will normally not
> be released for all kernels at the same time. Rather, they will be
> released in a staggered or "leap-frog" fashion.
> 
> Upgrade instructions
> - --------------------
> 
> wget url
>         will fetch the file for you
> dpkg -i file.deb
>         will install the referenced file.
> 
> If you are using the apt-get package manager, use the line for
> sources.list as given below:
> 
> apt-get update
>         will update the internal database
> apt-get upgrade
>         will install corrected packages


hey,

i think i am missing something over here....

i got lotza debian boxes here that run:

 $ uname -a
Linux srvdeb-1 2.6.26-1-686-bigmem #1 SMP Fri Mar 13 18:52:29 UTC 2009
i686 GNU/Linux


when i
 $ aptitude update ; aptitude safe-upgrade
or
 $ apt-get update ; apt-get upgrade

it tells me that im up 2 date. but in this release the bug is still
included,.,.


i had to install "linux-image-2.6.26-2-686-bigmem" via
 $ aptitude install linux-image-2.6.26-2-686-bigmem
by hand.

why is this? and how do i ensure that im not being fooled by aptitude or
apt?


regards,

moe

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/