Debian 4.0 and mmap_min_addr null pointer dereference flaw

[john <lists.john@gmail.com>]

Hello all,

I see that there is another null pointer dereference flaw being talked about.
http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/

It looks like we can take step in Debian 5.0 to mitigate this threat by setting
echvm.mmap_min_addr = 4096

per http://wiki.debian.org/mmap_min_addr

I am running some servers running Debian 4.0. I doesn't look like
there is a /etc/sysctl.d/mmap_min_addr.conf to edit. Where are these
values stored
under Debian 4.0.

What is the right way to proceed? Should I be looking at upgrading my servers?

Thanks!

John