[Ksplice][Debian 6.0 Updates] Important update available for CVE-2014-4943

[Sonja Tideman]

Synopsis: Early update for local privilege escalation in L2TP sockets:
CVE-2014-4943

We felt that it's important for us to ship this update early, before
distributions released kernels that fix the problem, because our audit
showed that we have a large number of customers affected by the CVE.

DESCRIPTION

* CVE-2014-4943: Privilege escalation in PPP over L2TP setsockopt/getsockopt.

PPP over L2TP sockets incorrectly used UDP's getsockopt and setsockopt
as a fallback handler. Since UDP's implementation expects different
data structures, a local attacker could corrupt kernel memory and gain
root privileges.

INSTALLING THE UPDATES

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y

SUPPORT

Ksplice support is available atksplice-support_ww at oracle.com.