Hi,
I am new to patching systems, so forgive stupid questions. We have some 6.1
systems. Are or will there be a patch for them or are they not involved in
this problem?
I am new to patching systems, so forgive me any stupid questions. We have some
6.1 and 6.3 systems. Are or will there be
Alex Huth a.h...@tmr.net writes:
I am new to patching systems, so forgive stupid questions. We have
some 6.1 systems. Are or will there be a patch for them or are they
not involved in this problem?
Support for 6.1 ended one and a half years ago (almost to the day), so
no to the first part of
Rudy Rucker r...@monkeybrains.net writes:
Causes lots of things to freeze up or crash (example: apache /
mysql).
That's... strange. I'm sure there is a good explanation, though.
I would just reboot the system after applying the patch.
Now, how do I go about updating /libexec/ld-elf32.so.1
I've used that patch to close the hole. This patch is temporary and doesn't fix
real trouble maker - problem in new version in getenv() (after 6.3 it got
changed to something monstrous and non-working right if environment has only
one variable), hope it will get fixed soon.
*** rtld.c.orig Tue
Good evening.
Tue, Dec 01, 2009 at 05:09:57PM +0300, Vasim Valejev wrote:
I've used that patch to close the hole. This patch is temporary and
doesn't fix real trouble maker - problem in new version in getenv()
If you're talking about rtld-elf local root, then the real issue
is that return
Tue, Dec 01, 2009 at 07:00:16PM +0300, Eygene Ryabinkin wrote:
Sorry, what do you mean by this? Does the attached script print 'VAR =
variable' for you as it does for me on 8.0-BETA2 (and undoubtly, on
8.0)? If yes then getenv() works properly with a single environment
variable. Perhaps you
On Tue, 1 Dec 2009, Dan Lukes wrote:
Dag-Erling Smørgrav napsal/wrote, On 12/01/09 14:12:
As to the second: yes, 6.1 is most likely affected.
Probably no.
The older algorithm used in 6.1 looks like
-
if (trusted) {
variable = getenv(NAME);
Eygene Ryabinkin schreef:
Good evening.
Tue, Dec 01, 2009 at 05:09:57PM +0300, Vasim Valejev wrote:
I've used that patch to close the hole. This patch is temporary and
doesn't fix real trouble maker - problem in new version in getenv()
If you're talking about rtld-elf local root,
Everyone:
I don't know if it's a coincidence, but I doubt it is: Since the
announcement of the rtld bug, we've seen a precipitous increase in
the number of SSH password guessing attacks on our systems.
Apparently, the folks who are mounting the attacks (usually via
botnets) have realized
http://twitter.com/spendergrsec/status/6223864530
http://xorl.wordpress.com/2009/12/01/freebsd-ld_preload-security-bypass/
On 12/1/09, Sean C. Farley s...@freebsd.org wrote:
On Tue, 1 Dec 2009, Dan Lukes wrote:
Dag-Erling Smørgrav napsal/wrote, On 12/01/09 14:12:
As to the second: yes, 6.1
I'd be greatly surprised if the affected code looked different in 6.x.
There is No unsetenv in 6.2-RELEASE/src/libexec/rtld-elf/rtld.
There Isunsetenv in 6.[34]-RELEASE/src/libexec/rtld-elf/rtld.
Yeah, I already saw that (and am surprised :) ).
My comment was just based on
On Dec 1, 2009, at 2:20 AM, FreeBSD Security Officer wrote:
A short time ago a local root exploit was posted to the full-disclosure
mailing list; as the name suggests, this allows a local user to execute
arbitrary code as root.
Dr. Strangelove, or How I learned to love the MAC subsystem.
#
Reference:
From: Jan Muenther jan.muent...@nruns.com
I'd be greatly surprised if the affected code looked different in 6.x.
There is No unsetenv in 6.2-RELEASE/src/libexec/rtld-elf/rtld.
There Isunsetenv in 6.[34]-RELEASE/src/libexec/rtld-elf/rtld.
Cheers,
Julian
--
Julian
Julian H. Stacey ha scritto:
Reference:
From: Jan Muenther jan.muent...@nruns.com
I'd be greatly surprised if the affected code looked different in 6.x.
There is No unsetenv in 6.2-RELEASE/src/libexec/rtld-elf/rtld.
There Isunsetenv in 6.[34]-RELEASE/src/libexec/rtld-elf/rtld.
Hi--
On Dec 1, 2009, at 11:09 AM, Mike Tancsa wrote:
http://isc.sans.org/trends.html
and
http://isc.sans.org/port.html
Do not seem to show any increase.
I've checked, and the volume of attempts over the past few days seems pretty
constant, although there was actually a decrease around Nov
2009/12/1 Roberto Nunnari roberto.nunn...@supsi.ch:
Julian H. Stacey ha scritto:
Reference:
From: Jan Muenther jan.muent...@nruns.com
I'd be greatly surprised if the affected code looked different in 6.x.
There is No unsetenv in 6.2-RELEASE/src/libexec/rtld-elf/rtld.
There Is
At 10:23 AM -0700 12/1/09, Brett Glass wrote:
Everyone:
I don't know if it's a coincidence, but I doubt it is: Since the
announcement of the rtld bug, we've seen a precipitous increase
in the number of SSH password guessing attacks on our systems.
I have seen an increase in attacks on some of
At 08:44 PM 12/1/2009, Brett Glass wrote:
At 12:09 PM 12/1/2009, Mike Tancsa wrote:
http://isc.sans.org/trends.html
and
http://isc.sans.org/port.html
Do not seem to show any increase.
Do those stats account for the fact that the attackers may first be
fingerprinting servers to see if
Jille, good day.
Tue, Dec 01, 2009 at 05:37:19PM +0100, Jille Timmermans wrote:
Eygene Ryabinkin schreef:
If you're talking about rtld-elf local root, then the real issue
is that return values of unsetenv() are not checked and unsetenv()
could fail, thus leaving LD_PRELOAD and friends left
19 matches
Mail list logo
