huge linux vulnerability could allow others to gain full control of system

[Red Squirrel]

Time to patch up.

I could see MS pulling this off, but Linux? Guess it shows no OS is 100% secure.

http://blogs.techrepublic.com.com/opensource/?p=1760&tag=nl.e101


Security researcher Rafal Wojtczuk from Invisible Things Lab reported a Linux kernel vulnerability, which would allow any GUI application that could be compromised, such as a PDF viewer, to bypass Linux security and potentially take over the system. The flaw has been present since at least 2003, and according to LinuxPlanet, it first became known to developers and distros only in June. You can read the PDF report compiled by Wojtczuk here.

So far, though, only some progress has been made in closing the hole, known officially as CVE-2010-2240. Linux founder Linus Torvalds comitted a patch for the issue on Friday, and Linux kernel developer Greg Kroah-Hartman that same day formally announced the 2.6.35.2 Linux kernel release, advising all users to update.

The problem, of course, is that just because the main kernel has been patched, doesn’t mean all the Linux versions of the kernel have been patched.

“Updated kernel packages for Fedora 12 and 13 will soon be available from the updates testing repositories, and will be released as stable after being tested,” Mark Cox, director of security response at Red Hat, told InternetNews.com. “Packages for Red Hat Enterprise Linux are being worked on and will be released as soon as they are complete.”

Although there are no reports of the flaw having been exploited (according to Mark Cox), be aware of the vulnerability and update your distros as needed, as soon as the patches are available.

 

[XOR != OR]

No OS is secure, and if your security plan/response depends on a specific vendor, then you are already a bit behind the game.

That said, I don't see this being as critical as a similar windows flaw for the simple reason that most linux boxes out there are not used in a desktop capacity. Sure, we have services running on the system but unless those services can be exploited in such a way as to exploit this flaw, we're mostly OK.

For instance, I can't see this vulnerability making apache httpd more vulnerable. Or bind.