Home > Security > Advisories


Mandriva Advisories

Package name linuxconf
Date September 4th, 2002
Advisory ID MDKSA-2002:056
Affected versions 7.2, 8.0, 8.1, 8.2, CS1.0
Synopsis Loval root vulnerability in linuxconf

Problem Description

A vulnerability was discovered in linuxconf by Dave Aitel and later by
iDEFENSE that is locally exploitable to obtain elevated privilege. By
default, Mandrake Linux ships linuxconf as setuid root in versions 7.2
through 8.2. Successful exploitation will yield a root shell.

MandrakeSoft recommends that all users take steps and remove the setuid
bit from linuxconf. This can be done by issuing, as root, the following

For users of Linux-Mandrake 7.2, the correct location of the linuxconf
executable is /sbin.

Updated Packages




To upgrade automatically, use MandrivaUpdate.


Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command :

                rpm --checksig package.rpm

You can get the GPG public key of the Mandriva Security Team to verify the GPG signature of each RPM.

If you use MandrivaUpdate, the verification of md5 checksum and GPG signature is performed automatically for you.