full-disclosure - Automated ssh scanning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20040827233029.GB16109@alcor.net>
From: mdz at debian.org (Matt Zimmerman)
Subject: Automated ssh scanning

On Sat, Aug 28, 2004 at 12:40:32AM +0200, Robert Jaroszuk wrote:

> I have checked today dist-upgraded debian sarge, with *default* kernel 
> (2.4.18-bf2.4), and it is still *vulnerable* to do_brk, kmod, and
> ptrace exploits.

The default kernel in Debian sarge (unreleased) is a 2.4.26 kernel.
The 2.4.18-bf2.4 kernel was part of Debian 3.0 (woody).

> This kernel seems to be *not* patched since 2002.

That kernel has been patched a total of eight (8) times since woody's
release in 2002.

This misunderstanding is probably derived from the fact that the initial
kernel supplied by the woody installer is copied, at the file level, into
/boot, rather than being installed as a package.  Therefore, it is not
automatically upgraded until you install the corresponding package.

You need to run "apt-get install kernel-image-2.4.18-bf2.4" as explained in
the instructions in the relevant Debian Security Advisories:

> If you are using the kernel installed by the installation system when the
> "bf24" option is selected (for a 2.4.x kernel), you should install the
> kernel-image-2.4.18-bf2.4 package.

Yes, this is unintuitive and problematic.  Yes, it was done this way for
historical reasons.  Yes, it has long since been fixed for the next release
(sarge).

-- 
 - mdz