LKM rootkit в современных Linux

В этой статье мы научимся собирать LKM-rootkit под современные ядра Linux, не смотря на то, что многие пишут, что это неактуально. Попробую опровергнуть это. В данной статье использованны вещи, доступные в паблике и некоторые мои наработки. Руткиты подразделяют на ядерные уровня ядра и неядерные...

[SECURITY] Fedora 12 Update: fuse-encfs-1.7.2-1.fc12

EncFS implements an encrypted filesystem in userspace using FUSE. FUSE provides a Linux kernel module which allows virtual filesystems to be writt en in userspace. EncFS encrypts all data and filenames in the filesystem and passes access through to the underlying filesystem. Similar to CFS except...

NDISwrapper: Arbitrary remote code execution

Background NDISwrapper is a Linux kernel module that enables the use of Microsoft Windows drivers for wireless network devices. Description Anders Kaseorg reported multiple buffer overflows related to long ESSIDs. Impact A physically proximate attacker could send packets over a wireless network...

Buffer oveflow in FTPFS (linux kernel module)

FTPFS http://sourceforge.net/projects/ftpfs is a Linux kernel module, enhancing VFS with FTP volume mounting capabilities. However, it has insufficient bounds checking. If a user can enter mount options through a wrapper, he can take over the whole system, even with restricted capabilities. Here'...

FTPFS 0.1.10.2.10.2.2 - mount Buffer Overflow

FTPFS 0.1.10.2.10.2.2 - mount Buffer Overflow source: https://www.securityfocus.com/bid/2498/info FTPFS is a Linux kernel module allowing users to mount remote files from any standard FTP server as a local filesystem. A version of FTPFS is vulnerable to a buffer overflow leading to a denial of...

FTPFS 0.1.1/0.2.1/0.2.2 - mount Buffer Overflow

source: https://www.securityfocus.com/bid/2498/info FTPFS is a Linux kernel module allowing users to mount remote files from any standard FTP server as a local filesystem. A version of FTPFS is vulnerable to a buffer overflow leading to a denial of service, and potentially execution of arbitrary...