OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: !SPAM! [Full-Disclosure] Automated ssh scanning

sec-focusrpmdp.com
Date: Thu Aug 26 2004 - 16:53:13 CDT


On Thu, 26 Aug 2004, Richard Verwayen wrote:

> Then I updated this machine at least once a week with
> apt-get update && apt-get dist-upgrade
>
> You may want have a look at the installed packages in the list attached

I noticed from your installed list the kernel you have is:

kernel-source- 2.4.19-4.woody Linux kernel source for version 2.4.19

In the tools you posted about earlier, in xpl.tar.gz is the program "p4",
this is a compiled version of:

http://www.isec.pl/vulnerabilities/isec-0014-mremap-unmap.txt

I expect this is how the privilage escallation was done from guest to
root. I've seen this very thing used on another system. The kernel you
have on that woody machine is within the range of exploitable kernels.

 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html