NYLXS - Free Software Events

Thu Apr 25 08:40:10 2024

EVENTS

FREE
SOFTWARE
INSTITUTE

POLITICS

JOBS

MEMBERS'
CORNER

MAILING
LIST

NYLXS Members have a lot to say and share but we don't keep many secrets. Join the Hangout Mailing List and say your peice.

DATE 2010-12-01

HANGOUT

2024-04-25 | 2024-03-25 | 2024-02-25 | 2024-01-25 | 2023-12-25 | 2023-11-25 | 2023-10-25 | 2023-09-25 | 2023-08-25 | 2023-07-25 | 2023-06-25 | 2023-05-25 | 2023-04-25 | 2023-03-25 | 2023-02-25 | 2023-01-25 | 2022-12-25 | 2022-11-25 | 2022-10-25 | 2022-09-25 | 2022-08-25 | 2022-07-25 | 2022-06-25 | 2022-05-25 | 2022-04-25 | 2022-03-25 | 2022-02-25 | 2022-01-25 | 2021-12-25 | 2021-11-25 | 2021-10-25 | 2021-09-25 | 2021-08-25 | 2021-07-25 | 2021-06-25 | 2021-05-25 | 2021-04-25 | 2021-03-25 | 2021-02-25 | 2021-01-25 | 2020-12-25 | 2020-11-25 | 2020-10-25 | 2020-09-25 | 2020-08-25 | 2020-07-25 | 2020-06-25 | 2020-05-25 | 2020-04-25 | 2020-03-25 | 2020-02-25 | 2020-01-25 | 2019-12-25 | 2019-11-25 | 2019-10-25 | 2019-09-25 | 2019-08-25 | 2019-07-25 | 2019-06-25 | 2019-05-25 | 2019-04-25 | 2019-03-25 | 2019-02-25 | 2019-01-25 | 2018-12-25 | 2018-11-25 | 2018-10-25 | 2018-09-25 | 2018-08-25 | 2018-07-25 | 2018-06-25 | 2018-05-25 | 2018-04-25 | 2018-03-25 | 2018-02-25 | 2018-01-25 | 2017-12-25 | 2017-11-25 | 2017-10-25 | 2017-09-25 | 2017-08-25 | 2017-07-25 | 2017-06-25 | 2017-05-25 | 2017-04-25 | 2017-03-25 | 2017-02-25 | 2017-01-25 | 2016-12-25 | 2016-11-25 | 2016-10-25 | 2016-09-25 | 2016-08-25 | 2016-07-25 | 2016-06-25 | 2016-05-25 | 2016-04-25 | 2016-03-25 | 2016-02-25 | 2016-01-25 | 2015-12-25 | 2015-11-25 | 2015-10-25 | 2015-09-25 | 2015-08-25 | 2015-07-25 | 2015-06-25 | 2015-05-25 | 2015-04-25 | 2015-03-25 | 2015-02-25 | 2015-01-25 | 2014-12-25 | 2014-11-25 | 2014-10-25 | 2014-09-25 | 2014-08-25 | 2014-07-25 | 2014-06-25 | 2014-05-25 | 2014-04-25 | 2014-03-25 | 2014-02-25 | 2014-01-25 | 2013-12-25 | 2013-11-25 | 2013-10-25 | 2013-09-25 | 2013-08-25 | 2013-07-25 | 2013-06-25 | 2013-05-25 | 2013-04-25 | 2013-03-25 | 2013-02-25 | 2013-01-25 | 2012-12-25 | 2012-11-25 | 2012-10-25 | 2012-09-25 | 2012-08-25 | 2012-07-25 | 2012-06-25 | 2012-05-25 | 2012-04-25 | 2012-03-25 | 2012-02-25 | 2012-01-25 | 2011-12-25 | 2011-11-25 | 2011-10-25 | 2011-09-25 | 2011-08-25 | 2011-07-25 | 2011-06-25 | 2011-05-25 | 2011-04-25 | 2011-03-25 | 2011-02-25 | 2011-01-25 | 2010-12-25 | 2010-11-25 | 2010-10-25 | 2010-09-25 | 2010-08-25 | 2010-07-25 | 2010-06-25 | 2010-05-25 | 2010-04-25 | 2010-03-25 | 2010-02-25 | 2010-01-25 | 2009-12-25 | 2009-11-25 | 2009-10-25 | 2009-09-25 | 2009-08-25 | 2009-07-25 | 2009-06-25 | 2009-05-25 | 2009-04-25 | 2009-03-25 | 2009-02-25 | 2009-01-25 | 2008-12-25 | 2008-11-25 | 2008-10-25 | 2008-09-25 | 2008-08-25 | 2008-07-25 | 2008-06-25 | 2008-05-25 | 2008-04-25 | 2008-03-25 | 2008-02-25 | 2008-01-25 | 2007-12-25 | 2007-11-25 | 2007-10-25 | 2007-09-25 | 2007-08-25 | 2007-07-25 | 2007-06-25 | 2007-05-25 | 2007-04-25 | 2007-03-25 | 2007-02-25 | 2007-01-25 | 2006-12-25 | 2006-11-25 | 2006-10-25 | 2006-09-25 | 2006-08-25 | 2006-07-25 | 2006-06-25 | 2006-05-25 | 2006-04-25 | 2006-03-25 | 2006-02-25 | 2006-01-25 | 2005-12-25 | 2005-11-25 | 2005-10-25 | 2005-09-25 | 2005-08-25 | 2005-07-25 | 2005-06-25 | 2005-05-25 | 2005-04-25 | 2005-03-25 | 2005-02-25 | 2005-01-25 | 2004-12-25 | 2004-11-25 | 2004-10-25 | 2004-09-25 | 2004-08-25 | 2004-07-25 | 2004-06-25 | 2004-05-25 | 2004-04-25 | 2004-03-25 | 2004-02-25 | 2004-01-25 | 2003-12-25 | 2003-11-25 | 2003-10-25 | 2003-09-25 | 2003-08-25 | 2003-07-25 | 2003-06-25 | 2003-05-25 | 2003-04-25 | 2003-03-25 | 2003-02-25 | 2003-01-25 | 2002-12-25 | 2002-11-25 | 2002-10-25 | 2002-09-25 | 2002-08-25 | 2002-07-25 | 2002-06-25 | 2002-05-25 | 2002-04-25 | 2002-03-25 | 2002-02-25 | 2002-01-25 | 2001-12-25 | 2001-11-25 | 2001-10-25 | 2001-09-25 | 2001-08-25 | 2001-07-25 | 2001-06-25 | 2001-05-25 | 2001-04-25 | 2001-03-25 | 2001-02-25 | 2001-01-25 | 2000-12-25 | 2000-11-25 | 2000-10-25 | 2000-09-25 | 2000-08-25 | 2000-07-25 | 2000-06-25 | 2000-05-25 | 2000-04-25 | 2000-03-25 | 2000-02-25 | 2000-01-25 | 1999-12-25

Key: Value:

MESSAGE

DATE	2010-12-08
FROM	Ruben Safir
SUBJECT	Subject: [NYLXS - HANGOUT] This is bad news - I have to do a kernel upgrade
Hi, Dan Rosenberg published a new local root exploit for the kernel, linked e.g. in this LWN article http://lwn.net/Articles/419141/ and for our german readers on http://www.heise.de/newsticker/meldung/OOPS-Root-Rechte-auf-Linux-1149512.html The exploit itself uses 3 seperate security issues in chain, all found by Nelson Elhage. CVE-2010-4258[1]: This is the core vulnerability, which can basically turn any user program triggered Oops into a local privilege escalation. This problem affects all SUSE Linux Enterprise and openSUSE products (but needs another problem to trigger it.) In the published exploit this Oops is caused by: CVE-2010-3850[2]: Associating a ECONET address with any network interface. This is possible in older SUSE products before SUSE Linux Enterprise 11 SP1 and openSUSE 11.2. CVE-2010-3849[3]: A kernel Oops caused by a NULL pointer dereference in ECONET. This vulnerability does not affect any SUSE Linux or openSUSE product, as we do not have the the sub-configuration of ECONET enabled that are necessary to exploit this. As the ECONET parts of this exploit are not effective on openSUSE and SUSE Linux Enterprise, the published exploit will not work as-is. However, as SUSE kernels are affected by CVE-2010-4258, an exploit could be written that uses a different method to Oops the kernel. To mitigate this issue until updates are available, you can switch your kernel to cause a panic on any Oops by doing as root: echo 1 > /proc/sys/kernel/panic_on_oops We will be of course also be releasing updated kernel packages containing fixes. Ciao, Marcus [1] http://support.novell.com/security/cve/CVE-2010-4258.html [2] http://support.novell.com/security/cve/CVE-2010-3850.html [3] http://support.novell.com/security/cve/CVE-2010-3849.html