Re: Kernel exploit in brk() function.
Christophe Devine <[email protected]>
| Newsgroups | gmane.linux.lfs.security |
|---|---|
| Organization | Linux From Scratch |
| Message-ID | <[email protected]> |
Ian Molton <[email protected]> wrote: > > Seems this is how the debian servers got rooted last week. Fixed in > > 2.4.23. > Impressive. fixed before release of a broken version, then discovered ;-) The team that created the exploit just released the source, which is an impressive piece of work, and actually works. I tested it on Debian 3.0: bash-2.05a$ gcc -static hatorihanzo.c bash-2.05a$ ./a.out sh-2.05a# id uid=0(root) gid=0(root) You can download the code at http://www.cr0.net:8040/misc/hatorihanzo.c -- http://linuxfromscratch.org/mailman/listinfo/lfs-security FAQ: http://www.linuxfromscratch.org/faq/ Unsubscribe: See the above information page