SECURITY: Easy Rootkit Crontab Exploit Found

This is the rootkit used to get into the Debian servers the other day by a malicious cracker posing as a Debian developer (in order to get shell access). It affects almost all popular distros, however.

* Requires at least local shell access before one can be hacked with the rootkit.

* Operates through an exploit activated by user's crontab that causes a coredump and root connectivity. Not quite clear how that works, but you can see the C source on the link above if you click the Exploit tab.

Fix appears to be:

* Remove 'gcc' if you don't use it.

* Linux kernel versions prior to 2.6.17.4 are vulnerable. Pressure your distro provider for a patch if they don't have one already. (I'm on Ubuntu Breezy 5.10 and kernel 2.6.12-10-686, so I'm at risk until Ubuntu decides to have a patch for existing kernels or releases a kernel update.)

* If someone's running an old version of Linux that may not have been tested, they should probably try the various versions of the exploit code and see if can be achieved on their systems. Lord help the person who still wants to run something like Red Hat 7 or something like that.

Full Story