full-disclosure - Debian Development Machine "Gluck" Hacked

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.64.0607131844100.26197@localhost.localdomain>
Date: Thu Jul 13 23:59:22 2006
From: gboyce at badbelly.com (gboyce)
Subject: Debian Development Machine "Gluck" Hacked -
	UPDATE

On Thu, 13 Jul 2006, David Taylor wrote:

> Curious why Secunia is rating this as 'less critical'.  The way I see it,
> this exploit could be integrated into the other exploits for mambo, joomla,
> phpbb, etc.  Also, all of us that have websites hosted on linux machines
> that have a vulnerable kernel could get root?
>
> I'm thinking 'highly critical'?

Think of their scoring as a minimum rating.  Depending on the particular 
impact to your system, you may need to adjust appropriately.

I would consider this highly critical on any system that would provide 
shell access to customers, non-privledged employees, etc.  If a system has 
shell access restricted to just admins, I'm would care less about this 
vulnerability.  On systems like this I generally assume that if someone 
gets shell to the system as a non-prileged user they will eventually get 
root anyways.

--
Greg