Advisories
Mandriva Advisories
|
 |
| Problem Description |
A vulnerability was discovered in linuxconf by Dave Aitel and later by
iDEFENSE that is locally exploitable to obtain elevated privilege. By
default, Mandrake Linux ships linuxconf as setuid root in versions 7.2
through 8.2. Successful exploitation will yield a root shell.
MandrakeSoft recommends that all users take steps and remove the setuid
bit from linuxconf. This can be done by issuing, as root, the following
command:
For users of Linux-Mandrake 7.2, the correct location of the linuxconf
executable is /sbin.
| Updated Packages |
| References |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0391
http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2002-001-xdr.txt
| Upgrade |
To upgrade automatically, use MandrivaUpdate.
| Verification |
Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command :
rpm --checksig package.rpm
You can get the GPG public key of the Mandriva Security Team to verify the GPG signature of each RPM.
If you use MandrivaUpdate, the verification of md5 checksum and GPG signature is performed automatically for you.