RE: [cobalt-security] RaQ3-All-Kernel-4.0.1-2.216C24III.pkg

[Jerome Tytgat <j.tytgat@xxxxxxxx>]

Do you really believe that uninstaller,
"RaQ3-All-Kernel-4.0.1-2.216C24III-4.0.1-2.216C24III.uninst",
will do the job ???? 

<<!----cut there----!>>
#!/bin/sh

if [ -e /var/lib/cobalt/RaQ-Kernel_i386_III-2.2.16C24* ]; then
        rm -f /var/lib/cobalt/RaQ-Kernel_i386_III-2.2.16C24*
fi
<<!----cut there----!>>

will back up the kernel ???

No  !
(by the way there is no RaQ-Kernel_i386_III-2.2.16C24*, 
but there is RaQ3-All-Kernel-4.0.1-2.216C24III-4.0.1-2.216C24III.md5lst)

This should be

[root@square1 /boot]# mv System.map System.map.bad
[root@square1 /boot]# mv vmlinux.gz vmlinux.gz.bad
[root@square1 /boot]# mv System.map.pkgsave System.map 
[root@square1 /boot]# mv vmlinux.gz.pkgsave vmlinux.gz 

[root@square1 conf]# pwd
/etc/httpd/conf
[root@square1 conf]# mv httpd.conf httpd.conf.bad
[root@square1 conf]# mv httpd.conf.pkgsave httpd.conf 

This work.

_______________________________________________________________
>ISION FRANCE
Jerome Tytgat
Network and Security Administrator
mailto:j.tytgat@xxxxxxxx        http://www.ision.fr 
_______________________________________________________________
 
  
> Should you find yourself with a "hosed" system and need to get it back
> up and running, you can un-install the patch. You do so by dropping in
> terminal as su - root. Cd to /var/lib/cobalt/uninstallers and find the
> uninstaller for the kernel patch. Type "./<filename of package>" without
> quotes and it *should* uninstall. If it doesn't you would probably have
> to OS Restore. You did backup before attempting the patch didn't you?