vulnerability of Linux

[Steffen Kluge]

On Tue, 2005-11-29 at 14:13 +0800, John Summerfied wrote:
> If there's a kernel update fixing a security problem only exploitable 
> with local access, and I control the only account with local access, 
> then I don't need it.

Are you sure? If there's a bug in httpd that allows an attacker to run
code as user apache, then the kernel bug may become quite useful to get
root.

Why run with a known vulnerability, just because one isn't smart enough
to think of an attack vector? Defense in depth...

Cheers
Steffen.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <http://listman.redhat.com/archives/fedora-list/attachments/20051129/55d18282/attachment-0001.sig>