I have a server with these properties :

cat /etc/lsb-release


Recently, I read an article about local privilege escalation - CVE-2012-0056, so I decided to test it on my server. I then connected to my server using unprivileged user account (not root) and uploaded Mempodipper.c and run it with gcc Mempodipper.c. This resulted in permission denied.

Am I immune to this attack, or should I be worried about this vulnerability being exploited in any other way? Unprivileged accounts don't have access to running gcc. Are there any other ways of running that exploit on my server, which I should be worried about?

  • 2
    gcc here is used to compile the exploit from the source. The attacker could simply compile the source on another machine and run the exploit on your server.
    – Adi
    May 25 '13 at 7:55
  • How cloud i prevent it ?
    – user13934
    May 25 '13 at 8:19
  • 2
    Since CentOS has already patched this vulnerability, a kernel update would fix it. If you want a quick solution, you can make sure that ASLR is enabled by going to your /etc/sysctl.conf and making sure that kernel.randomize_va_space is set to 2 then apply the changes using sysctl -p. But make sure you update anyway.
    – Adi
    May 25 '13 at 8:33
  • I don't have /etc/sysctl.conf file !! is it mean i am vulnerable to this attack ? or i don't apply patch correctly ?
    – user13934
    May 25 '13 at 8:44
  • 5
    You can create it yourself, then add kernel.randomize_va_space = 2 to it. In any case, perform an update to your system.
    – Adi
    May 25 '13 at 8:48

The answer is no, this doesn't mean you are immune to this attack.

If an attacker is unable to compile the exploit on your system, he can as well compile it somewhere else and then upload and run it on your server, providing he has an access to your server of course.

Generally speaking, you should not rely on denying access to gcc or any other utility to prevent an attacker from exploiting a vulnerability on your system. Vendors usually provide patches, and you should apply them as fast as you can.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy