Intrusion Prevention

Linux.Kernel.Local.Privilege.Escalation

Description

This indicates an attack attempt to exploit a Privilege Escalation vulnerability in multiple Linux Systems.
The vulnerability is due to insufficient checks of permission when handling writes to suid processes. A remote attack may be able to exploit this to escalate their privileges on a local system.

Affected Products

Red Hat Enterprise Linux Desktop (v. 6)
Red Hat Enterprise Linux HPC Node (v. 6)
Red Hat Enterprise Linux Server (v. 6)
Red Hat Enterprise Linux Server AUS (v. 6.2)
Red Hat Enterprise Linux Server EUS (v. 6.2.z)
Red Hat Enterprise Linux Workstation (v. 6)
Ubuntu 11.10
Linux kernel 2.6.39 rc4
Linux kernel 2.6.39
Linux kernel 2.6.39-rc6
Linux kernel 2.6.39-rc3

Impact

Privilege Escalation: Remote attackers can leverage their privilege on the vulnerable systems.

Recommended Actions

Apply the most recent upgrade or patch from the vendor.
http://www.ubuntu.com/usn/usn-1336-1/
http://rhn.redhat.com/errata/RHSA-2012-0052.html
http://www.kernel.org/

CVE References

CVE-2012-0056