Re: Symlink vulnerabilities

[Valdis.Kletnieks () vt edu]

On Thu, 27 Oct 2011 10:39:46 EDT,somebody before bugs () fbi dhs org said:
> > I still think its crap anyhow, so, enjoy your 60% chance s[ploit on,
> > whats not going to be a recent 2011 kernel :)

Whoever wrote this should stop and ponder a bit - how does the kernel release
enter into it?  The exploit depends on several *userspace* processes issuing
totally legal system calls in an unfortunate, but legal, order.  There's no
"pass the kernel a funky ioctl structure" or other "abuse the kernel" going on
that may have been patched between the ancient 2.6.18 that some distros used as
a base for still-supported releases, and the current 3.1.  If this sort of
userspace bug worked back on an old system with an old kernel, it should still
work now. As several people have pointed out already, the right place to fix
this is in userspace - either by whack-a-mole patching of gxexec, or by
deploying a polyinstantiation solution of some sort.

Attachment: _bin
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/