Linux kernel bug prompts security alert

The perceived security of Linux has suffered a setback after the discovery of a serious bug in the Linux kernel which allows attackers to gain root access through a variety of programs, including Sendmail.

The kernel bug affects versions 2.2.15 and earlier, as well as some 2.4.0 versions, and Linux users are advised to upgrade to 2.2.16. The problem is all the more serious because code that exploits the flaw has been posted widely on the internet, including on a number of well-known security sites.

A notice on the Sendmail website this week said: "There is a bug in the Linux kernel capability model for versions through 2.2.15 that allows local users to get root. Sendmail is one of the programs that can be attacked this way. This problem may occur in other capabilities-based kernels. The correct fix is to update your Linux kernel to version 2.2.16. This is the only way to ensure that other programs running on Linux cannot be attacked by this bug."

Sendmail 8.10.2 has been released with a patch to prevent the Linux kernel being exploited, and also includes improved content filtering and authentication features.

Neil Barrett, technical director at security consultants Information Risk Management, said that more careful attention now needs to be paid to making Linux systems secure because the growing popularity of the freeware operating system makes it a more attractive target for crackers.

"The openness of the source code for Linux means that it is easier to find security vulnerabilities, such as ways to create buffer overflows. However, the advantage with Linux is that problems are fixed more quickly - and arguably more competently - than they would be with Windows NT," he said.

Barrett added that despite the problems, Linux-based systems had richer and more powerful security features than Windows NT, but expertise was needed to harness them to create secure systems.

In a separate development it has been discovered that there are a number of security issues affecting the server component in MIT's Kerberos, the most popular version of the documented open standard for strong authentication.

The impact of the flaws includes the potential for an attacker to gain root access to the Kerberos server.

MIT plans an update to version 5.12 which will address the flaws, and various vendors whose Kerberos versions are based on MIT code are making patches available.