提醒Debian用户Linux提权漏洞

dreamice

http://marc.info/?l=full-disclosure&m=129175358621826&w=2
利用了 Linux Econet 协议的3个安全漏洞，可以导致本地帐号对系统进行拒绝服务或特权提升

zhanglistar

利用了 Linux Econet 协议的3个安全漏洞，可以导致本地帐号对系统进行拒绝服务或特权提升
dreamice 发表于 2010-12-24 09:13

    影响ubuntu用户不？？？？

shappen

[*] Failed to open file descriptors.


测试不通过

abc@debian:/tmp$ uname -a
Linux debian 2.6.32-5-686 #1 SMP Fri Dec 10 16:12:40 UTC 2010 i686 GNU/Linux

sysulzh

跟楼上一样的结果，不知是否少了什么步骤？

$gcc full-nelson.c -o full-nelson
$./full-nelson
[*] Failed to open file descriptors.
$uname -a
Linux eg2004 2.6.36 #2 SMP Sun Nov 21 10:27:02 HKT 2010 i686 GNU/Linux
$more /etc/debian_version
squeeze/sid
$

fred_56

debian:~# mv full-nelson.c ~wq/
debian:~# chown wq:wq ~wq/full-nelson.c
debian:~# su wq
wq@debian:/root$ cd
wq@debian:~$ ls
full-nelson.c  linux/
wq@debian:~$ gcc full-nelson.c
wq@debian:~$ ./a.out
[*] Failed to open file descriptors.
wq@debian:~$ gcc full-nelson.c -o full-nelson
wq@debian:~$ ./full-nelson
[*] Failed to open file descriptors.
wq@debian:~$ uname -r
2.6.28.2-usbboot
wq@debian:~$ grep commit_creds /proc/kallsyms
wq@debian:~$ grep prepare_kernel_cre /proc/kallsyms
wq@debian:~$

L_kernel

看來大家的測試都是一樣啊。

Resolving kernel addresses...
[+] Resolved econet_ioctl to 0xe0a9a206
[+] Resolved econet_ops to 0xe0a9afa0

Failed to resolve kernel symbols.

hhkbfan

呃，实际上是两个econet的漏洞,真正造成的提权的反而不是用的这个，clone的问题，其实这个漏洞在redhat上也有

ww2000e

回复  ww2000e


   你的内核符号里没有commit_creds和prepare_kernel_cred(从/proc/kallsyms查),
LunarBull 发表于 2010-12-29 13:54

没有