Re: !SPAM! Automated ssh scanning

[sec-focus () rpmdp com]

On Thu, 26 Aug 2004, Richard Verwayen wrote:

> Then I updated this machine at least once a week with 
> apt-get update && apt-get dist-upgrade
>
> You may want have a look at the installed packages in the list attached

I noticed from your installed list the kernel you have is:

kernel-source- 2.4.19-4.woody Linux kernel source for version 2.4.19

In the tools you posted about earlier, in xpl.tar.gz is the program "p4", 
this is a compiled version of:

http://www.isec.pl/vulnerabilities/isec-0014-mremap-unmap.txt

I expect this is how the privilage escallation was done from guest to 
root.  I've seen this very thing used on another system.  The kernel you 
have on that woody machine is within the range of exploitable kernels.

 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html