By John Leyden, VNU Net
The perceived security of Linux has suffered a setback after the
discovery of a serious bug in the Linux kernel which allows
attackers to gain root access through a variety of programs,
including Sendmail.
The kernel bug affects versions 2.2.15 and earlier, as well as
some 2.4.0 versions, and Linux users are advised to upgrade to
2.2.16. The problem is all the more serious because code that
exploits the flaw has been posted widely on the internet, including
on a number of well-known security sites.
A notice on the Sendmail website this week said: “There is a bug
in the Linux kernel capability model for versions through 2.2.15
that allows local users to get root. Sendmail is one of the
programs that can be attacked this way. This problem may occur in
other capabilities-based kernels. The correct fix is to update your
Linux kernel to version 2.2.16. This is the only way to ensure that
other programs running on Linux cannot be attacked by this
bug.”
Sendmail 8.10.2 has been released with a patch to prevent the
Linux kernel being exploited, and also includes improved content
filtering and authentication features.
Neil Barrett, technical director at security consultants
Information Risk Management, said that more careful attention now
needs to be paid to making Linux systems secure because the growing
popularity of the freeware operating system makes it a more
attractive target for crackers.
“The openness of the source code for Linux means that it is
easier to find security vulnerabilities, such as ways to create
buffer overflows. However, the advantage with Linux is that
problems are fixed more quickly – and arguably more competently –
than they would be with Windows NT,” he said.
Barrett added that despite the problems, Linux-based systems had
richer and more powerful security features than Windows NT, but
expertise was needed to harness them to create secure systems.
In a separate development it has been discovered that there are
a number of security issues affecting the server component in MIT’s
Kerberos, the most popular version of the documented open standard
for strong authentication.
The impact of the flaws includes the potential for an attacker
to gain root access to the Kerberos server.
MIT plans an update to version 5.12 which will address the
flaws, and various vendors whose Kerberos versions are based on MIT
code are making patches available.”