lkml.org 
[lkml]   [2011]   [Mar]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: milw0rm rootkit
On Mon, 14 Mar 2011 12:28:11 -0700
Justin <wellspring3@gmail.com> wrote:

> Yes, she runs 2.6.34.8-68.fc13.i686.PAE
>
> I know this is for the kernel... The C file seems to exploit a
> vulnerability in the kernel, so I thought I should let the kernel
> people know so they could patch it upstream. Right? I know the hacker
> couldnt have gotten in if the security was stronger, but shouldnt the
> kernel be secured against the rootkit?

Firstly 2.6.34 is an old kernel, and we've no idea what other patches and
the like are in the Fedora version. You should ask the Fedora people
about that. Secondly the answer is no - there are various bits of user
space that are privileged and bugs in those can lead to exploitation
without the kernel being involved, particularly if you are not using
security containment setups like SELinux.

You need to talk to the distro.

Alan


\
 
 \ /
  Last update: 2011-03-14 21:15    [W:0.052 / U:0.256 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site