A Polish security firm iSec Security Research has announced a new vulnerability for Linux Kernel, the CVE-2016-5195 or the Dirty COW.
CVE-2016-5195 is official reference to this bug. CVE which stands for “Common Vulnerabilities and Exposures is the Standard for Information Security Vulnerability Names maintained by MITRE.”
The experts have concluded that though the name given is silly, the problem is gravely serious, if you have a Magento store.
The Dirty COW bug is: “a race condition which was found in the way the Linux kernel’s memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings. An unprivileged local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase their privileges on the system.”
This is a compromising situation for the users of Magento store as the attacker can upload files to the users’ server or hosting account.”
All the important Linux Operating Systems had this vulnerability and wild (ITW) attacks had been detected by the security researchers, though the security patches for the vulnerability were yet to be released by the different operating systems.
List of downloadable security patches of different operating system:
- Debian: https://security-tracker.debian.org/tracker/CVE-2016-5195
- SUSE: https://www.suse.com/security/cve/CVE-2016-5195.html
- Red Hat / CentOS: https://access.redhat.com/security/cve/cve-2016-5195
- Ubuntu: http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-5195.html
The users maintaining their own servers will update the kernel and reboot the server after the issue of security patch by the operating system providers.
The ones who do not manage their server or use shared hosting can contact the hosting provider or server administrator to for ensuring protection against Dirty COW.
For more IT related scoops, stay glued to this space.Source: