Last Updated: 2006-07-14 20:14:01 UTC
by Bojan Zdrnja (Version: 2)
prctl() suidsafe exploit
(C) Julien TINNES
[+] Installed signal handler
[+] We are suidsafe dumpable!
[+] Malicious string forged
[+] Segfaulting child
[+] Waiting for exploit to succeed (~28 seconds)
[+] getting root shell
Debian also confirmed that this exploit was used on their recently compromised machine (http://isc.sans.org/diary.php?storyid=1479).
As all kernels 2.6.13 up to version 126.96.36.199 and 2.6.16 before 188.8.131.52 are affected, you should patch as soon as possible, even if you don't allow any local users on your machines. Remember that even a small vulnerability in a PHP script can allow local access, which then can be escalated with this exploit.
CVE for this vulnerability has also been issued: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2451.
Thanks to David Taylor for sending information about this to us.
Update: (2006-07-14 20:13UTC) In a posting over on Bugtraq, Ronald Timmerman suggests the following as a possible work-around for those that can't patch immediately.
# echo /root/core > /proc/sys/kernel/core_pattern