Advisories:rPSA-2006-0130

rPath Security Advisory 2006-0130-1

Critical

Local Root Deterministic Privilege Escalation

In previous versions of the kernel package, a local root privilege

escalation and a separate denial of service vulnerability are known

to exist.

The local root privilege escalation allows any local user to use

the /proc/self/environ file to reliably subvert the root user.

The local root privilege escalation has a known and publically

available exploit in current active use.

The denial of service applies if the ftdi_sio module that drives

a usb-serial hardware device is loaded, in which case any user

allowed to access the device can consume all the memory on the

system by producing data faster than the device can consume it,

either as an intentional attack or unintentionally, leading to a

denial of service.

A system reboot is required to resolve these vulnerabilities.

rPath recommends that you update your systems immediately.