Re: [Full-Disclosure] Automated ssh scanning

On Sat, Aug 28, 2004 at 12:40:32AM +0200, Robert Jaroszuk wrote:

> I have checked today dist-upgraded debian sarge, with *default* kernel 
> (2.4.18-bf2.4), and it is still *vulnerable* to do_brk, kmod, and
> ptrace exploits.

The default kernel in Debian sarge (unreleased) is a 2.4.26 kernel.
The 2.4.18-bf2.4 kernel was part of Debian 3.0 (woody).

> This kernel seems to be *not* patched since 2002.

That kernel has been patched a total of eight (8) times since woody's
release in 2002.

This misunderstanding is probably derived from the fact that the initial
kernel supplied by the woody installer is copied, at the file level, into
/boot, rather than being installed as a package.  Therefore, it is not
automatically upgraded until you install the corresponding package.

You need to run "apt-get install kernel-image-2.4.18-bf2.4" as explained in
the instructions in the relevant Debian Security Advisories:

> If you are using the kernel installed by the installation system when the
> "bf24" option is selected (for a 2.4.x kernel), you should install the
> kernel-image-2.4.18-bf2.4 package.

Yes, this is unintuitive and problematic.  Yes, it was done this way for
historical reasons.  Yes, it has long since been fixed for the next release
(sarge).

-- 
 - mdz

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html