- --------------------------------------------------------------------------
Debian-Edu/Skolelinux Security Advisory DESA 2004-01
                                                        Morten Werner Olsen
January 24th, 2004              debian-edu-security@lists.alioth.debian.org
- --------------------------------------------------------------------------

Package            : kernel-image-2.4.24-1-i386
Vulnerability      : mising boundary check
Problem-Type       : local
Debian-Edu-specific: no
CVE ID             : CAN-2003-0985
DSA ID             : DSA 413-1

Paul Starzetz discovered a flaw in bounds checking in mremap() in the
Linux kernel (present in version 2.2.x, 2.4.x and 2.6.x) which may
allow a local attacker to gain root privileges.

We recommend that you upgrade your kernel packages. This problem has
been fixed in the upstream version 2.4.24 as well.


Upgrade Instructions
- --------------------

Make sure 'deb ftp://ftp.skolelinux.no/skolelinux/ woody local' is
present in your /etc/apt/sources.list and run 'apt-get update' to
update your package lists.

Find which flavour of the kernel you are running with the command
'uname -r' (examples: 386, 586tsc, 686, 686-smp, k6, k7, k7-smp).

To upgrade, run this command replacing <flavour> with yours:

  apt-get install kernel-image-2.4.24-1-<flavour>

If you are not familiar with upgrading your kernel, please visit our
mini-HOWTO on this subject:

 http://www.skolelinux.org/security/kernel-upgrade

- --------------------------------------------------------------------------
For apt-get: deb ftp://ftp.skolelinux.no/skolelinux/ woody local

Mailing list: <not announced>
Package info: `apt-cache show <pkg>'