Debian Security Advisory: New version of modutils releasedNov 20, 2000, 20:20 (0 Talkback[s])
(Other stories by Wichert Akkerman)
Date: Mon, 20 Nov 2000 16:03:58 +0100
Debian Security Advisory email@example.com http://www.debian.org/security/ Wichert Akkerman November 20, 2000
Package: modutils Vulnerability: local exploit Debian-specific: noSebastian Krahmer found a problem in the modprobe utility that could be exploited by local users to run arbitrary commands as root if the machine is running a kernel with kmod enabled.
The kmod kernel feature allows the kernel to dynamically load kernel modules if functionality is required that is not present in the running kernel. It does this by invoking the modprobe command with the requested module as parameter. This parameter can be influenced by users, for example by opening a currently non-existing files on a devfs filesystem, or trying to access a non-existing network interface. Since modprobe did not properly escape shell meta-characters when calling external commands or check if the last parameters was an option instead of a modulename, users can cause it to run arbitrary commands.
This has been fixed in version 2.3.11-12 and we recommend that you upgrade your modutils package immediately.
wget url will fetch the file for you dpkg -i file.deb will install the referenced file.You may use an automated update by adding the resources from the footer to the proper configuration.
Debian GNU/Linux 2.2 alias potato
Potato was released for the alpha, arm, i386, m68k, powerpc and sparc architectures.
Intel ia32 architecture:
Motorola 680x0 architecture:
Sun Sparc architecture:
For not yet released architectures please refer to the
0 Talkback[s] (click to add your comment)