Out of morbid curiosity:

[Bernhard Fischer]

On Thu, May 18, 2006 at 01:09:11PM -0700, ldoolitt at recycle.lbl.gov wrote:
>Rob -
>
>On Thu, May 18, 2006 at 03:45:17PM -0400, Rob Landley wrote:
>> Does anybody have an idea what these idiots are blathering about?
>> http://securitytracker.com/alerts/2004/May/1010272.html
>
>All they did was read SuSE-SA:2004:012.
>   http://www.novell.com/linux/security/advisories/2004_12_mc.html
>The only relevant (to us) section is
>
>2)  Pending vulnerabilities in SUSE Distributions and Workarounds:
>  - sharutils [chop]
>  - xine, xine-lib, xine-ui [chop]
>  - sysconfig [chop]
>  - clamav [chop]
>  - exim [chop]
>  - utempter [chop]
>  - busybox
>  Busybox does not handle netlink sockets correctly, which allows
>  local attackers to spoof netlink messages to the busybox process
>  New packages are available on our FTP servers.
>  - monit [chop]
>  - ethereal [chop]
>  - kphone [chop]
>
>> I mention this because reading it gives me no idea what vulnerability they're 
>> talking about (we use netlink?  Where?  For what?)  It's 2 years old, they 
>> apparently never bothered to report it to _us_, they provide no means to ask 
>> for more information...
>
>Try sending an email to Thomas Biege, his name and e-mail is at
>the top of the SUSE advisory.
>
>I also find
>  http://rpmfind.net/linux/RPM/suse/9.3/i386/suse/i586/busybox-debuginfo-1.00-3.i586.html
>a changelog entry
>* Tue May 11 2004 - nashif at suse.de
>  - Bug #39461 - Fixes netlink vulnerability
>right before they updated to 1.00-rc1.
>
>Maybe this in combination with Bernhard's pointer can help
>figure out what happened two years ago.

The changelogs were quite elaborate back then, citing the actual changes
as provided by the user.

See
http://busybox.net/cgi-bin/viewcvs.cgi/trunk/busybox/networking/libiproute/libnetlink.c?rev=14437&view=log

specifically r8803

Nothing to worry about today, it seems.