Linux bug discovered

[Nomad559]

http://www.theinquirer.net/?article=16596

-Snip-

A Linux bug has been discovered which allows a whole system to be exploited by a simple C program.

On the site Linuxreviews.org the discoverer Øyvind Sæther, from Norway, said that using the exploit requires the (ab)user to have shell access or other means of uploading and running the program—like cgi-bin and FTP access. Then it is just a matter of running this code which works on any normal user account.

Along with the code needed to use the exploit, Sæther also posted several patches to 2.4 and 2.6 kernels that will keep the exploit from crashing systems.

[mrfrapp]

1. Patch

Patch here also

[Kellanved]

2. not a big thing

It is just another local post-authentication Denial of Service attack; as most end-users won't give out shell log-ins to untrustworthy/unknown users, I fail to see the problem. It went unnoticed for years, and is already patched.

And even without patch: a simple command will fix the problem: userdel -r ;-)