[kernel-sec-discuss] r1056 - active

[dannf at alioth.debian.org]

Author: dannf
Date: 2007-12-11 04:57:26 +0000 (Tue, 11 Dec 2007)
New Revision: 1056

Modified:
   active/CVE-2007-6206
Log:
fleshing out

Modified: active/CVE-2007-6206
===================================================================
--- active/CVE-2007-6206	2007-12-07 22:25:20 UTC (rev 1055)
+++ active/CVE-2007-6206	2007-12-11 04:57:26 UTC (rev 1056)
@@ -1,7 +1,12 @@
 Candidate: CVE-2007-6206
 Description: 
+ Linux kernel 2.4.x and 2.6.x up to 2.6.24-rc3, and possibly other versions,
+ does not change the UID of a core dump file if it exists before a root process
+ creates a core dump in the same location, which might allow local users to
+ obtain sensitive information.
 References: 
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=c46f739dd39db3b07ab5deb4e3ec81e1c04a91af
+ http://bugzilla.kernel.org/show_bug.cgi?id=3043
+ http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=c46f739dd39db3b07ab5deb4e3ec81e1c04a91af 
 Ubuntu-Description: 
 Notes: 
 Bugs: