Advanced

SECURITY: Easy Rootkit Crontab Exploit Found

Posted by Tracer on · 15 comments
securityfocus.com; By Tracer/Supermike 		Mail this story
Print this story

This rootkit affects kernels 2.6.17.4 or earlier. On the Solution tab: The vendor has released kernel version 2.6.17.4 to address this issue.

This is the rootkit used to get into the Debian servers the other day by a malicious cracker posing as a Debian developer (in order to get shell access). It affects almost all popular distros, however.

* Requires at least local shell access before one can be hacked with the rootkit.

* Operates through an exploit activated by user's crontab that causes a coredump and root connectivity. Not quite clear how that works, but you can see the C source on the link above if you click the Exploit tab.

Fix appears to be:

* Remove 'gcc' if you don't use it.

* Linux kernel versions prior to 2.6.17.4 are vulnerable. Pressure your distro provider for a patch if they don't have one already. (I'm on Ubuntu Breezy 5.10 and kernel 2.6.12-10-686, so I'm at risk until Ubuntu decides to have a patch for existing kernels or releases a kernel update.)

* If someone's running an old version of Linux that may not have been tested, they should probably try the various versions of the exploit code and see if can be achieved on their systems. Lord help the person who still wants to run something like Red Hat 7 or something like that.

Full Story

  Nav
» Read more about: Story Type: News Story, Security; Groups: Community, Debian, Fedora, Kernel, Linux, LXer, Mandriva, Red Hat, Slackware, SUSE, Ubuntu

» Get new stories by e-mail: nightly or as they are published

« Return to the newswire homepage

  Related stories
» More like this

Comments (15)

jimf ·
This thing affects nearly all the 2.6 kernel series!
grouch ·
jimf:

The "This week at LWN" link has been up there for 5 days and the Debian server report was almost that long ago. Probably everyone who is affected and is likely to act, has. That compromise of the Debian server shows that just because it's a local exploit doesn't mean it's ignorable.
jimf ·
First, this isn't just Debian (this was a Red Hat find), and to my knowledge the 2.6.17-4 'fixed' kernel hasn't been in the repo for that long.

I'm really not that concerned about this specific exploit, but, it does cover a huge range of kernels and is pretty easy to fix. Maybe it's overkill, but, I think we need to take it seriously.
grouch ·
jimf:

I know it's not just Debian; didn't say it was. See the LWN link. Corbet was griping about this thing being first reported as a local denial of service hole. He said that initial report may be why distros were slow about taking it seriously.
jimf ·
grouch,

And this has what to do with the price of corn :).

Sorry, but I think we're on different tracks.
dcparris ·
> And this has what to do with the price of corn :).

Um, drives it up?
grouch ·
jimf:

It is exactly the vulnerability that is referenced. It was reported by rPath on 7 July, Corbet wrote his article on the 12th, pointing out that as of then only Ubuntu and Red Hat had updates available, 'gluck' was compromised on the 12th and reported here on the 13th. Now, 5 more days have passed and SecurityFocus is just now aware of the way the vulnerability is exploited?
jimf ·
Yes, that is important I suppose. These vulnerabilities need to be emphasised, and that's all good, but, my concern right now is to have the individual users aware of this one.

> Probably everyone who is affected and is likely to act, has.

'Probably' is the key here. The last guy I talked to thought "wasn't that a brute password attack"... He's not the only one who is misinformed.
grouch ·
Ah, I see.

The emphasis on the exploit itself might stand a better chance of reaching those who got the wrong idea about the vulnerability. If the attacker can get any local access, that hole lets him get root as well.
jimf ·
Yep, now ya got it :)
grouch ·
Yeahbut that dcparris guy said it drives the price of corn up. Thanks to you and your silly rootkit, the price of whiskey and gasohol just went up. Now barflies won't be able to afford to get drunk enough to pass out and will be out on the highways burning up dirtier gasoline instead of gasohol as they maim and murder other drivers. That's what's wrong with you GNU/Linux zealots -- you worry about little things like rootkits, ignoring the fact that almost everybody running MS Windows is root and rooted, while failing to see the big picture of keeping drunks too drunk to drive, or at least giving them more environmentally friendly fuel with which to careen down the interstates.
jimf ·
Well, that's our puritanical country's legacy grouch. blowing up stills. starting wars for the oil, it's a trend since Washington put down the wiskey rebellion. Eventually the plan is to take all human pleasures away no sex, no booze, no smokes, driving your car, highways, or anything else they can think of as fun, 'except' if we can pay the taxes on it (which with the elimination of jobs and falling wages you can't afford), or unless you're a member of congress. They're exempt. Expect those ('sin' taxes) to get to the point where no one will even be able to afford to run Linux.... oh, that's free?... Yeah, but corn costs real money... Besides, you can make wiskey from it... more taxes :)... Bankrupt you say???
dinotrac ·
I just can't help but hop on this thread to ask if anybody else saw the bit on TV about Willie Nelson's BioWillie venture?

I am not making this up...

Nelson is involved in a company that makes biodiesel fuel. I find that very cool, but find the "BioWillie" name even cooler. I have just GOT to get me a BioWillie hat.
grouch ·
I don't eat enough french fries to make my own biodiesel. Just in case, though:

http://journeytoforever.org/biodiesel_vehicle.html

jimf ·
> Willie Nelson's BioWillie venture?

Yeah dino, I saw that one.

In one way it's very innovative, but, I keep thinking that the Gov is going to decide that all those cars and trucks smelling like french frys is promoting obesity in America. Of course they'll have to tax or outright ban it accordingly.

Post a comment

A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.

Your message:
|||||
10
Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help

Sign up and post (it is free)  or  Log in and post