Martin Fahlgren <martin@as3-1-1.hn.g.bonet.se> wrote:
On 8 May 2001, Martin Peikert wrote:
Martin Fahlgren <martin@as3-1-1.hn.g.bonet.se> wrote:
This is probably the "worst" exploit up to now and a big problem for all networks with many login accounts (web sites, schools, universities etc).
So the options I have are 1) Compile and install my own kernel 2) Disable logins until SuSE comes with a new kernel 3) Switch to a distribution which provides the necessary updates
You are kidding, aren't you?
Why do you think that I'm kidding? We are talking about a very nasty exploit which I already has been used in practice, and measures must be taken to stop it.
Do you have other options better than "my" 3 alternatives. I can see another alternative: Kernel 2.4. It has also problems, but should not be directly vulnerable to the eploit we are discussing now.
As H D Moore wrote: It's your own fault if you get rooted. If you are not able to compile a kernel by yourself with the patches you need, go and read the Kernel-HOWTO, the files in /usr/src/linux/Documentation and some man pages instead of moaning in public. Martin -- martin.peikert@innominate.com innominate AG project manager the linux architects dipl. math. http://www.innominate.com tel: +49-30-308806-0 fax: -77 gpg: http://innominate.org/gpg/mpe.gpg