SARA Malware that exploits the vmsplice bug in the Linux kernel. Affects kernel versions 2.6.17 through 2.6.24.1. Successful exploitation allows the disabling of INPUT rules on the firewall, opens TCP port 1407 for execution of remote commands, and more.
13a1429b254b235cd35bb2ba6d42f62816ef074799e92cf199b306ba57d0309fDebian Security Advisory 1494-2 - The vmsplice system call did not properly verify address arguments passed by user space processes, which allowed local attackers to overwrite arbitrary kernel memory, gaining root privileges. In the vserver-enabled kernels, a missing access check on certain symlinks in /proc enabled local attackers to access resources in other vservers.
34b719d3875c967855d387fd2b1f6c6924524020e468be586fbfcf5abcaffc62Ubuntu Security Notice 577-1 - Wojciech Purczynski discovered that the vmsplice system call did not properly perform verification of user-memory pointers. A local attacker could exploit this to overwrite arbitrary kernel memory and gain root privileges.
c3097de3abfb7924d2558c14687527f7f3e24c385dfac514b18b0843fe5d9effMandriva Linux Security Advisory - Various local denial of service and privilege escalation vulnerabilities have been added for the Linux 2.6 kernel package.
15110333a170cf683e179d93999a7af19fc080a86fb4507d86be6f743bbbae3cMandriva Linux Security Advisory - A flaw in the vmsplice system call did not properly verify address arguments passed by user-space processes, which allowed local attackers to overwrite arbitrary kernel memory and gain root privileges. Mandriva urges all users to upgrade to these new kernels immediately as this flaw is being actively exploited. This issue only affects 2.6.17 and newer Linux kernels, so neither Corporate 3.0 nor Corporate 4.0 are affected.
9bd3bb51b8241006cbb0fe04e1276bc890793ba7fce3fc86bc75440386aace87Debian Security Advisory 1494-1 - The vmsplice system call did not properly verify address arguments passed by user space processes, which allowed local attackers to overwrite arbitrary kernel memory, gaining root privileges. In the vserver-enabled kernels, a missing access check on certain symlinks in /proc enabled local attackers to access resources in other vservers.
dca93886f4927b2832e7fab1161ee721a75920d9083dc86b3ed21e246e5cb727
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed