all services files can be manipulated.
This can be exploited by:
a. Boot the PC in SafeBoot mode, by pressing F8 during the boot
process
b. Rename PAVSRV51.exe to PAVSRV51.old in Panda folder
c. Copy any application to PAVSRV51.exe
d. Reboot
Upon reboot trojaned application will be executed with LocalSystem
all services files can be manipulated.
This can be exploited by:
a. Boot the PC in SafeBoot mode, by pressing F8 during the boot
process
b. Rename PAVSRV51.exe to PAVSRV51.old in Panda folder
c. Copy any application to PAVSRV51.exe
d. Reboot
Upon reboot trojaned application will be executed with LocalSystem
* GEOM shsec providers. The GEOM shsec subsytem is used to split a shared
secret between two providers so that it can be recovered when both of
them are present. This is done by writing the random sequence to one
of providers while appending the result of the random sequence on the
other host to the original data. If the provider was created within the
first 300 seconds after booting, it might be possible for an attacker
to extract the original data with access to only one of the two providers
between which the secret data is split.
* System processes started early after boot may receive predictable IDs.
All in all, the behavior in this case is mostly as promised in the
documentation.
One plausible explanation for the fault is that part of the POST is
executed by the booting kernel. This design has the disadvantage that
it's possible to fault the domain from within, without actual hardware
failures (it might suffice to have a kernel image that checksums, but
doesn't signal booting success to the XSCF when run). The advantage is
that this part of the POST is easier to upgrade (and potentially to
validate as well), and it also makes sure that system administrators do
###########################################################
Ubuntu Privacy Remix (UPR), based on Ubuntu 8.04 (LTS), is a live,
read-only CD that seals off your private data from the outside world. It
does this using encryption and isolation methods. This method of booting
off a read-only CD provides a isolated and unmodifiable system that is
exceedingly difficult to compromise by spyware.
The following security issues affect the "Ubuntu Privacy Remix" releases
prior 8.04_r2.
From vendor's website:
"Client Management Services® (CMS) includes all the server-based
services (PXE Server, BOOTP Server) and administration tools needed to
setup an open network boot environment. You can deploy your favorite
third party client management tools in a pre-OS booting phase."
#######################################################################
======
###########################################################
Ubuntu Privacy Remix (UPR), based on Ubuntu 8.04 (LTS), is a live,
read-only CD that seals off your private data from the outside world. It
does this using encryption and isolation methods. This method of booting
off a read-only CD provides a isolated and unmodifiable system that is
exceedingly difficult to compromise by spyware.
The following security issues affect the "Ubuntu Privacy Remix" releases
prior 8.04_r1.
read-only CD that seals off your private data from the outside world to
offer protection against spying measures such as the german
„Bundestrojaner“, with which the German government and federal police
tries to spy on its citizens.
UPR does this using encryption and isolation methods. This method of
booting off a read-only CD provides a isolated and unmodifiable system
that is exceedingly difficult to compromise by spyware.
The following security issues affect the "Ubuntu Privacy Remix" releases
prior 9.04_r2.
Ubuntu Privacy Remix 9.04_r2 can be downloaded from
Jermome Marchand reported an issue in the futex subsystem that
allows a local user to force an invalid futex state which results
in a denial of service (oops).
This update also fixes a regression introduced by a previous security
update that caused problems booting on certain s390 systems.
For the oldstable distribution (etch), this problem has been fixed in
version 2.6.18.dfsg.1-26etch2.
We recommend that you upgrade your linux-2.6, fai-kernels, and
read-only CD that seals off your private data from the outside world to
offer protection against spying measures such as the german
„Bundestrojaner“, with which the German government and federal police
tries to spy on its citizens.
UPR does this using encryption and isolation methods. This method of
booting off a read-only CD provides a isolated and unmodifiable system
that is exceedingly difficult to compromise by spyware.
The following security issues affect the "Ubuntu Privacy Remix" releases
prior 8.04_r3.
Ubuntu Privacy Remix 8.04_r1 can be downloaded from
