Debian 2.2: Critical Modutils Local Exploit and Command Execution Risk

The kmod kernel feature allows the kernel to dynamically load kernel
modules if functionality is required that is not present in the running
kernel. It does this by invoking the modprobe command with the requested
module as parameter. This parameter can be influenced by users, for
example by opening a currently non-existing files on a devfs filesystem,
or trying to access a non-existing network interface. Since modprobe
did not properly escape shell meta-characters when calling external
commands or check if the last parameters was an option instead of a
modulename, users can cause it to run arbitrary commands.

This has been fixed in version 2.3.11-12 and we recommend that you upgrade
your modutils package immediately.

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 2.2 alias potato
architectures.

Sou...