[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Full-disclosure] Symlink vulnerabilities



On Thu, 27 Oct 2011 10:39:46 EDT,somebody before bugs@xxxxxxxxxxx said:
> > I still think its crap anyhow, so, enjoy your 60% chance s[ploit on,
> > whats not going to be a recent 2011 kernel :)

Whoever wrote this should stop and ponder a bit - how does the kernel release
enter into it?  The exploit depends on several *userspace* processes issuing
totally legal system calls in an unfortunate, but legal, order.  There's no
"pass the kernel a funky ioctl structure" or other "abuse the kernel" going on
that may have been patched between the ancient 2.6.18 that some distros used as
a base for still-supported releases, and the current 3.1.  If this sort of
userspace bug worked back on an old system with an old kernel, it should still
work now. As several people have pointed out already, the right place to fix
this is in userspace - either by whack-a-mole patching of gxexec, or by
deploying a polyinstantiation solution of some sort.

Attachment: pgpbmxJtfBVlr.pgp
Description: PGP signature

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/