All the latest UK technology news, reviews and analysis
|
|
|
07 Apr 2006
A security flaw has been found in Linux kernel version 2.6.x that could allow malicious local users to cause a denial of service attack, according to an advisory from security firm Secunia.
The vulnerability is caused by an out-of-bounds memory error in the 'fill_write_buffer()' function in 'sysfs/file.c'.
The problem occurs when writing a PAGE_SIZE amount of data that does not contain any zeroes to a 'sysfs' file.
The vulnerability has been fixed in version 2.6.17-rc1 of the Linux kernel, and users are advised to download the latest patch immediately.
Latest stories from Security
Related articles
Related jobs
Poll
What is the most important IT priority for your company this year?
Connect with V3.co.uk
This paper focuses on a series of best practices and techniques for development teams looking to improve their software development processes
Why good data management at all levels is essential in the modern business (video, 6mins)
We have been given the privilege of recruiting for a...
My client is a proprietary, electronic trading firm and...
Our client is looking for a Senior Project Manager (Telecoms...
Business Analysts are being sought by my leading financial...
Keep up to date with the latest products, services and technologies from the world's leading IT companies. IThound.com brings you over 2,000 white papers, case studies and analyst reports.
Do you agree?
Do not update to 2.6.17-rc1
Users are recommended to install a development version of the kernel?! Please get your facts right, noone will ever recommend normal users to run an RC1 kernel, which contains all latest development code and has its share of bugs...
Posted by: Frederik 09 Apr 2006
Doesn't look dangerous
Looking at the sysfs filesystem on my machine nothing in there can we written to by anyone other than root, so it looks like you need to be root to trigger this exploit. On most machines if you're root you can do anything you want anyway. Even if you're using capabilities to limit what root can do, I'd hope whoever you allow access to the root account can be trusted not to try a denail of service attack.
Posted by: Richard 07 Apr 2006