Tweet
Oh noooo, more Linux vulnerabilities...now without testing
Yet another couple vunerabilities for the Linux kernel. Pretty astonishing there are so many considering that it is so secure. 
Apparently they also don't test these fixes very well. They attribute their ability to get releases out quickly to their being open source, but anyone could release the fixes so early. The reason they're going out so early is they don't do testing, let alone the large-scale testing corporations like MS have to do on patches.
This is what you call Trustworthy Computing.
Apparently they also don't test these fixes very well. They attribute their ability to get releases out quickly to their being open source, but anyone could release the fixes so early. The reason they're going out so early is they don't do testing, let alone the large-scale testing corporations like MS have to do on patches.
Security flaws force Linux kernel upgrade
Last modified: January 5, 2004, 11:34 AM PST
By Robert Lemos
Staff Writer, CNET News.com
Open-source developers released a new version of the Linux kernel Monday in a move aimed at quickly fixing several bugs--among them two serious security flaws.
The 2.4.24 upgrade to the Linux kernel comes a month after the release of the previous version of the core system software and only includes patches for six software issues, including the two flaws.
The release is intended to prompt users to upgrade quickly, said Marcelo Tosatti, the maintainer of the 2.4 kernel series and a Linux developer for data center management company Cyclades.
"These security issues need to be fixed as soon as possible," Tosatti told CNET News.com in an interview Monday. As maintainer, Tosatti decides what changes can be made to the kernel and when to release new versions of the core system software for Linux.
The most serious flaw, which occurs in a function used by virtual memory, resembles a vulnerability fixed in late November that had been exploited by unknown attackers to control several key Linux servers open-source developers use. Both flaws allow an intruder to increase the privileges of a normal user account to the same level as the system's owner.
Tosatti said that once it became clear that the latest flaw could be used to circumvent security on Linux systems, he and other developers decided to immediately release the fixes. The move follows decisions by the kernel developers to curtail new features in the 2.4 kernel series in order to get developers and users to move to the next generation of core Linux software, the 2.6 kernel. The final set of features that had been intended for this release of the kernel have been postponed until the next version, he said.
"It is good that I have the ability--because this is open source--to release the code so quickly," Tosatti said.
The second security flaw results in a device driver problem that could allow an intruder to read some memory the kernel uses.
The latest version of the kernel can be downloaded from Kernel.org. Patches for specific Linux distributions can be downloaded from their developers.
Last modified: January 5, 2004, 11:34 AM PST
By Robert Lemos
Staff Writer, CNET News.com
Open-source developers released a new version of the Linux kernel Monday in a move aimed at quickly fixing several bugs--among them two serious security flaws.
The 2.4.24 upgrade to the Linux kernel comes a month after the release of the previous version of the core system software and only includes patches for six software issues, including the two flaws.
The release is intended to prompt users to upgrade quickly, said Marcelo Tosatti, the maintainer of the 2.4 kernel series and a Linux developer for data center management company Cyclades.
"These security issues need to be fixed as soon as possible," Tosatti told CNET News.com in an interview Monday. As maintainer, Tosatti decides what changes can be made to the kernel and when to release new versions of the core system software for Linux.
The most serious flaw, which occurs in a function used by virtual memory, resembles a vulnerability fixed in late November that had been exploited by unknown attackers to control several key Linux servers open-source developers use. Both flaws allow an intruder to increase the privileges of a normal user account to the same level as the system's owner.
Tosatti said that once it became clear that the latest flaw could be used to circumvent security on Linux systems, he and other developers decided to immediately release the fixes. The move follows decisions by the kernel developers to curtail new features in the 2.4 kernel series in order to get developers and users to move to the next generation of core Linux software, the 2.6 kernel. The final set of features that had been intended for this release of the kernel have been postponed until the next version, he said.
"It is good that I have the ability--because this is open source--to release the code so quickly," Tosatti said.
The second security flaw results in a device driver problem that could allow an intruder to read some memory the kernel uses.
The latest version of the kernel can be downloaded from Kernel.org. Patches for specific Linux distributions can be downloaded from their developers.
Comment