A vulnerability has been identified in the 2.4 version of the Linux kernel, which potentially can be exploited by malicious, local users to gain knowledge of sensitive information.

The vulnerability is caused due to an error in the "execve()" system call when handling the file descriptor for the target executable. This has successfully been exploited to read suid executables, where the user only had execute permissions.

Solution
Don't expect that users aren't able to read files, on which they only have execute permissions. Therefore, sensitive content should not be placed within such files (eg. perl scripts and shell scripts).

Provided and/or discovered by
Paul Starzetz

Deep Links
Links available to Secunia VIM customers