Home / vulnerabilities MDKSA-2007-078.txt
Posted on 05 April 2007
Source : packetstormsecurity.org Link
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2007:078
http://www.mandriva.com/security/
_______________________________________________________________________
Package : kernel
Date : April 4, 2007
Affected: 2007.0
_______________________________________________________________________
Problem Description:
Some vulnerabilities were discovered and corrected in the Linux
2.6 kernel:
When SELinux hooks are enabled, the kernel could allow a local user
to cause a DoS (crash) via a malformed file stream that triggers a
NULL pointer derefernece (CVE-2006-6056).
Multiple buffer overflows in the (1) read and (2) write handlers in
the Omnikey CardMan 4040 driver in the Linux kernel before 2.6.21-rc3
allow local users to gain privileges. (CVE-2007-0005)
The Linux kernel version 2.6.13 to 2.6.20.1 allowed a remote attacker to
cause a DoS (oops) via a crafted NFSACL2 ACCESS request that triggered
a free of an incorrect pointer (CVE-2007-0772).
A local user could read unreadable binaries by using the interpreter
(PT_INTERP) functionality and triggering a core dump; a variant of
CVE-2004-1073 (CVE-2007-0958).
The ipv6_getsockopt_sticky function in net/ipv6/ipv6_sockglue.c in the
Linux kernel before 2.6.20.2 allows local users to read arbitrary
kernel memory via certain getsockopt calls that trigger a NULL
dereference. (CVE-2007-1000)
Buffer overflow in the bufprint function in capiutil.c in libcapi,
as used in Linux kernel 2.6.9 to 2.6.20 and isdn4k-utils, allows local
users to cause a denial of service (crash) and possibly gain privileges
via a crafted CAPI packet. (CVE-2007-1217)
The do_ipv6_setsockopt function in net/ipv6/ipv6_sockglue.c in Linux
kernel 2.6.17, and possibly other versions, allows local users to cause
a denial of service (oops) by calling setsockopt with the IPV6_RTHDR
option name and possibly a zero option length or invalid option value,
which triggers a NULL pointer dereference. (CVE-2007-1388)
net/ipv6/tcp_ipv6.c in Linux kernel 2.4 and 2.6.x up to 2.6.21-rc3
inadvertently copies the ipv6_fl_socklist from a listening TCP socket
to child sockets, which allows local users to cause a denial of service
(OOPS) or double-free by opening a listeing IPv6 socket, attaching a
flow label, and connecting to that socket. (CVE-2007-1592)
The provided packages are patched to fix these vulnerabilities.
All users are encouraged to upgrade to these updated kernels immediately
and reboot to effect the fixes.
In addition to these security fixes, other fixes have been included
such as:
- Suspend to disk speed improvements
- Add nmi watchdog support for core2
- Add atl1 driver
- Update KVM
- Add acer_acpi
- Update asus_acpi
- Fix suspend on r8169, i8259A
- Fix suspend when using ondemand governor
- Add ide acpi support
- Add suspend/resume support for sata_nv chipsets.
- USB: Let USB-Serial option driver handle anydata devices (#29066)
- USB: Add PlayStation 2 Trance Vibrator driver
- Fix bogus delay loop in video/aty/mach64_ct.c
- Add MCP61 support (#29398)
- USB: fix floppy drive SAMSUNG SFD-321U/EP detected 8 times bug
- Improve keyboard handling on Apple MacBooks
- Add -latest patch
- Workaround a possible binutils bug in smp alternatives
- Add forcedeth support
- Fix potential deadlock in driver core (USB hangs at boot time
#24683)
To update your kernel, please follow the directions located at:
http://www.mandriva.com/en/security/kernelupdate
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6056
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0005
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0772
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0958
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1000
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1217
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1388
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1592
http://qa.mandriva.com/show_bug.cgi?id=29066
http://qa.mandriva.com/show_bug.cgi?id=29398
http://qa.mandriva.com/show_bug.cgi?id=24683
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2007.0:
84459fea8b1b4548fea8864694feb5e9 2007.0/i586/kernel-2.6.17.13mdv-1-1mdv2007.0.i586.rpm
4f2ae01ccf337c0c538c1e8d4b41bb84 2007.0/i586/kernel-doc-2.6.17.13mdv-1-1mdv2007.0.i586.rpm
a432c277b621f02670692a83fd9cf4cd 2007.0/i586/kernel-enterprise-2.6.17.13mdv-1-1mdv2007.0.i586.rpm
f1a62fd01f7b14aef9d55bfe57fb352c 2007.0/i586/kernel-legacy-2.6.17.13mdv-1-1mdv2007.0.i586.rpm
2a46a4009273f725e6f3ba66073d6186 2007.0/i586/kernel-source-2.6.17.13mdv-1-1mdv2007.0.i586.rpm
b954cacf1af9775900c0180c66f731b2 2007.0/i586/kernel-source-stripped-2.6.17.13mdv-1-1mdv2007.0.i586.rpm
750b4e67fe1be3c87802297a7745ab1f 2007.0/i586/kernel-xen0-2.6.17.13mdv-1-1mdv2007.0.i586.rpm
2d28253eafc9c7dadb116e571dce00d5 2007.0/i586/kernel-xenU-2.6.17.13mdv-1-1mdv2007.0.i586.rpm
25f757eb5d57317dc91ddd37f37e8abb 2007.0/SRPMS/kernel-2.6.17.13mdv-1-1mdv2007.0.src.rpm
Mandriva Linux 2007.0/X86_64:
e1ca731fc7376199172238e5d92063a4 2007.0/x86_64/kernel-2.6.17.13mdv-1-1mdv2007.0.x86_64.rpm
8c02b29e58f8fbc6f90693ccc3e0855a 2007.0/x86_64/kernel-doc-2.6.17.13mdv-1-1mdv2007.0.x86_64.rpm
f0d98a19885831fc0323c8d2dac615db 2007.0/x86_64/kernel-source-2.6.17.13mdv-1-1mdv2007.0.x86_64.rpm
cc53d2abaf5aaa284cda0327516bc9c5 2007.0/x86_64/kernel-source-stripped-2.6.17.13mdv-1-1mdv2007.0.x86_64.rpm
77e4a2f83a8ce5b652b2847cac8467ce 2007.0/x86_64/kernel-xen0-2.6.17.13mdv-1-1mdv2007.0.x86_64.rpm
bbe4780078b5ffd6cf9e47ae6920518f 2007.0/x86_64/kernel-xenU-2.6.17.13mdv-1-1mdv2007.0.x86_64.rpm
25f757eb5d57317dc91ddd37f37e8abb 2007.0/SRPMS/kernel-2.6.17.13mdv-1-1mdv2007.0.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
iD8DBQFGE/qkmqjQ0CJFipgRAhFJAKDxW476ewc4Ixk8MAhK0AQFW+RKCQCg4LsO
PC34rll1d2d3D2uKqPw1h+o=
=Fjgh
-----END PGP SIGNATURE-----
