So far just rumors but this looks potentially scary: http://seclists.org/fulldisclosure/2009/Jul/0028.html http://isc.sans.org/diary.html?storyid=6742 One of my biggest reasons for using SE Linux for so long has been the hopeful mitigation of such exploits. If this is real and SE Linux mitigates it this could be serious validation for the whole SE Linux philosophy. If somehow we still get owned while running the latest SE Linux confined ssh I will be very disappointed. Hopefully it's just a false alarm. -- Tracy Reed http://tracyreed.org
Attachment:
pgpVa9KuN0aLm.pgp
Description: PGP signature
