Re: [SECURITY] [DSA 1494-1] New linux-2.6 packages fix privilege escalation

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

Florian Weimer un jour écrivit:
>
> Package : linux-2.6
> Vulnerability : missing access checks
> Problem type : local
> Debian-specific: no
> CVE Id(s) : CVE-2008-0010 CVE-2008-0163 CVE-2008-0600

> In the vserver-enabled kernels, a missing access check on certain
> symlinks in /proc enabled local attackers to access resources in other
> vservers (CVE-2008-0163).
>
> For the stable distribution (etch), this problem has been fixed in
> version 2.6.18.dfsg.1-18etch1.
>
> In addition to these fixes, this update also incorporates changes
> from the upcoming point release of the stable distribution.
>
> The old stable distribution (sarge) is not affected by this problem.
>
> The unstable (sid) and testing distributions will be fixed soon.

  It seems that there is no update available for PowerPC and Sparc, and maybe other architectures as well. Do we have again the problems we had with security updates for PowerPC in August 2007?

  If the updates are known to be available only later, would It be possible to announce It in the advisory, as It is usually done?

  And maybe make a statement about It if an architecture is not affected (though It is obviously not the case here).

Simon Valiquette
http://gulus.USherbrooke.ca

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (Linux PPC)

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related lists.debian.org Links debian-announce debian-apache debian-arm-changes debian-beowulf debian-boot debian-cd debian-cd-vendors debian-changes debian-changes-digest debian-isp debian-kde debian-laptop debian-mirrors-announce debian-news debian-security debian-security-announce debian-testing debian-user debian-user-digest Request more information about Pantek

iD8DBQFHsNVRJPE+P+aMAJIRA9XjAKDBFjM1qF7Uoz69bWAqmShNgHr2vQCeJSTo 1fV9NossyFITd9IVkE5JtE8=
=9dXH
-----END PGP SIGNATURE-----

-- 
To UNSUBSCRIBE, email to debian-security-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org