Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5086

Re: vulnerability in 8.6

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Hello Mike;

thanks for all help and I checked /boot

$ ls /boot/
config-3.16.0-4-amd64  grub  initrd.img-3.16.0-4-amd64
 System.map-3.16.0-4-amd64  vmlinuz-3.16.0-4-amd64

$ sudo update-grub
[sudo] password for x:
Generating grub configuration file ...
Found background image: /usr/share/images/desktop-base/desktop-grub.png
Found linux image: /boot/vmlinuz-3.16.0-4-amd64
Found initrd image: /boot/initrd.img-3.16.0-4-amd64
done


So, I'm shared below apt policy:

$ apt-cache policy linux-image-3.16.0-4-amd64
linux-image-3.16.0-4-amd64:
  Installed: 3.16.36-1+deb8u2
  Candidate: 3.16.36-1+deb8u2
  Version table:
 *** 3.16.36-1+deb8u2 0
        500 http://security.debian.org/ jessie/updates/main amd64 Packages
        100 /var/lib/dpkg/status
     3.16.36-1+deb8u1 0
        500 http://ftp.debian.org/debian/ jessie/main amd64 Packages
     3.16.7-ckt25-2 0
        500 http://ftp.debian.org/debian/ jessie-updates/main amd64 Packages


Regards,

Ozgur


2016-11-07 20:18 GMT+03:00 Mike Oliver <mike@mopmeat.net>:

> Can we confirm whether or not the kernel is already installed? Is the
> newest version in the kernel in /boot? It's unclear from what's been said
> if the system has even been rebooted into the updated kernel.
>
>
>
> On 11/07/2016 08:55 AM, Eduardo M KALINOWSKI wrote:
>
>> On Seg, 07 Nov 2016, Ozgur wrote:
>>
>>> I updated the Debian system and again exploit it successful.
>>>
>>
>> No, you didn't. (Well, kinda)
>>
>> $ uname -ar
>>> Linux x 3.16.0-4-amd64 #1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03) x86_64
>>> GNU/Linux
>>>
>>
>> That's not the latest version, and specifically is not the one in which
>> that vulnerability was fixed. You should have version 3.16.36-1+deb8u2 .
>>
>> ~$ cat /etc/apt/sources.list
>>>
>>> deb http://security.debian.org/ jessie/updates main contrib
>>> deb-src http://security.debian.org/ jessie/updates main contrib
>>>
>>> deb http://ftp.debian.org/debian/ jessie-updates main contrib
>>> deb-src http://ftp.debian.org/debian/ jessie-updates main contrib
>>>
>>> deb http://ftp.debian.org/debian/ jessie main contrib
>>> deb-src http://ftp.debian.org/debian/ jessie main contrib
>>>
>>
>> Your sources seem correct, though. What does "apt-cache policy
>> linux-image-3.16.0-4-amd64" says?
>>
>>
>


-- 
Ozgur

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

vulnerability in 8.6 Ozgur <okaratas@member.fsf.org> - 2016-11-07 17:00 +0100
  Re: vulnerability in 8.6 Richard van den Berg <richard@vdberg.org> - 2016-11-07 17:20 +0100
  Re: vulnerability in 8.6 Salvatore Bonaccorso <carnil@debian.org> - 2016-11-07 17:20 +0100
    Re: vulnerability in 8.6 Ozgur <okaratas@member.fsf.org> - 2016-11-07 17:50 +0100
      Re: vulnerability in 8.6 Nicholas Luedtke <nicholas.luedtke@hpe.com> - 2016-11-07 18:00 +0100
        Re: vulnerability in 8.6 Ozgur <okaratas@member.fsf.org> - 2016-11-07 18:10 +0100
          Re: vulnerability in 8.6 Matias Mucciolo <mmucciolo@suteba.org.ar> - 2016-11-07 18:10 +0100
          Re: vulnerability in 8.6 Andrew Deck <andrew.hastings.deck@gmail.com> - 2016-11-07 18:20 +0100
      Re: vulnerability in 8.6 Matias Mucciolo <mmucciolo@suteba.org.ar> - 2016-11-07 18:00 +0100
      Re: vulnerability in 8.6 Eduardo M KALINOWSKI <eduardo@kalinowski.com.br> - 2016-11-07 18:20 +0100
        Re: vulnerability in 8.6 Mike Oliver <mike@mopmeat.net> - 2016-11-07 18:30 +0100
          Re: vulnerability in 8.6 Ozgur <okaratas@member.fsf.org> - 2016-11-07 20:00 +0100
        Re: vulnerability in 8.6 Eduardo M KALINOWSKI <eduardo@kalinowski.com.br> - 2016-11-07 20:00 +0100
    Re: vulnerability in 8.6 Richard Waterbeek <richardwbb@versatel.nl> - 2016-11-10 03:40 +0100
      Re: vulnerability in 8.6 Vladislav Kurz <vladislav.kurz@webstep.net> - 2016-11-10 10:30 +0100
        Re: vulnerability in 8.6 Richard Waterbeek <richardwbb@versatel.nl> - 2016-11-16 21:30 +0100
          Re: vulnerability in 8.6 Salvatore Bonaccorso <carnil@debian.org> - 2016-11-16 21:40 +0100
      Re: vulnerability in 8.6 advocatux <advocatux@gmail.com> - 2016-11-10 10:50 +0100
        Re: vulnerability in 8.6 Tino <tinolin2010@gmail.com> - 2016-11-10 14:00 +0100
    Re: vulnerability in 8.6 Richard Waterbeek <richardwbb@versatel.nl> - 2016-11-22 19:20 +0100
      Re: vulnerability in 8.6 Riku Valli <riku.valli@vallit.fi> - 2016-11-22 20:30 +0100

csiph-web