LWN.net Logo

Advertisement

LWN Merchandise

Stand out from the crowd. Get yourself some of these LWN T-shirts, stickers, mugs, and more.

Advertise here

Not logged in

Log in now

Create an account

Subscribe to LWN

Recent Features

Three short stories, all about Android

LWN.net Weekly Edition for February 4, 2010

Samba with Active Directory: getting closer

Security in the 20-teens

LWN.net Weekly Edition for January 28, 2010

Printable page
Archives Kernel Security Distributions Search
Calendar Subscribe Write for LWN LWN.net FAQ Sponsors

kernel-utils: setuid vulnerability

Package(s):kernel-utils CVE #(s):CAN-2003-0019
Created:February 7, 2003 Updated:January 21, 2005
Description: The kernel-utils package contains several utilities that can be used to control the kernel or machine hardware. In Red Hat Linux 8.0 this package contains user mode linux (UML) utilities.

The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was incorrectly shipped setuid root. This could allow local users to control certain network interfaces, add and remove arp entries and routes, and put interfaces in and out of promiscuous mode.

All users of the kernel-utils package should update to these packages that contain a version of uml_net that is not setuid root.

Alternatively, as a work-around to this vulnerability issue the following command as root:

chmod -s /usr/bin/uml_net

Alerts:
Red Hat RHSA-2003:056-08 2003-02-07
(Log in to post comments)

Copyright © 2010, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds