Home / vulnerabilities MDKSA-2007-196.txt
Posted on 16 October 2007
Source : packetstormsecurity.org Link
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2007:196
http://www.mandriva.com/security/
_______________________________________________________________________
Package : kernel
Date : October 15, 2007
Affected: Corporate 4.0
_______________________________________________________________________
Problem Description:
Some vulnerabilities were discovered and corrected in the Linux
2.6 kernel:
The compat_sys_mount function in fs/compat.c allowed local users
to cause a denial of service (NULL pointer dereference and oops)
by mounting a smbfs file system in compatibility mode (CVE-2006-7203).
The nf_conntrack function in netfilter did not set nfctinfo during
reassembly of fragmented packets, which left the default value as
IP_CT_ESTABLISHED and could allow remote attackers to bypass certain
rulesets using IPv6 fragments (CVE-2007-1497).
A typo in the Linux kernel caused RTA_MAX to be used as an array size
instead of RTN_MAX, which lead to an out of bounds access by certain
functions (CVE-2007-2172).
The IPv6 protocol allowed remote attackers to cause a denial of
service via crafted IPv6 type 0 route headers that create network
amplification between two routers (CVE-2007-2242).
The random number feature did not properly seed pools when there was
no entropy, or used an incorrect cast when extracting entropy, which
could cause the random number generator to provide the same values
after reboots on systems without an entropy source (CVE-2007-2453).
A memory leak in the PPPoE socket implementation allowed local users
to cause a denial of service (memory consumption) by creating a
socket using connect, and releasing it before the PPPIOCGCHAN ioctl
is initialized (CVE-2007-2525).
An integer underflow in the cpuset_tasks_read function, when the cpuset
filesystem is mounted, allowed local users to obtain kernel memory
contents by using a large offset when reading the /dev/cpuset/tasks
file (CVE-2007-2875).
The sctp_new function in netfilter allowed remote attackers to cause
a denial of service by causing certain invalid states that triggered
a NULL pointer dereference (CVE-2007-2876).
A stack-based buffer overflow in the random number generator could
allow local root users to cause a denial of service or gain privileges
by setting the default wakeup threshold to a value greater than the
output pool size (CVE-2007-3105).
The lcd_write function did not limit the amount of memory used by
a caller, which allows local users to cause a denial of service
(memory consumption) (CVE-2007-3513).
The Linux kernel allowed local users to send arbitrary signals
to a child process that is running at higher privileges by
causing a setuid-root parent process to die which delivered an
attacker-controlled parent process death signal (PR_SET_PDEATHSIG)
(CVE-2007-3848).
The aac_cfg_openm and aac_compat_ioctl functions in the SCSI layer
ioctl patch in aacraid did not check permissions for ioctls, which
might allow local users to cause a denial of service or gain privileges
(CVE-2007-4308).
The IA32 system call emulation functionality, when running on the
x86_64 architecture, did not zero extend the eax register after the
32bit entry path to ptrace is used, which could allow local users to
gain privileges by triggering an out-of-bounds access to the system
call table using the %RAX register (CVE-2007-4573).
In addition to these security fixes, other fixes have been included
such as:
- The 3w-9xxx module was updated to version 9.4.1.2, adding support
for 9650SE
- Fixed the build of e1000-ng
- Added NIC support for MCP55
- Added LSI Logic MegaRAID SAS 8300XLP support
To update your kernel, please follow the directions located at:
http://www.mandriva.com/en/security/kernelupdate
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7203
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1497
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2172
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2242
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2453
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2525
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2875
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2876
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3105
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3513
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3848
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4308
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4573
_______________________________________________________________________
Updated Packages:
Corporate 4.0:
3657c208eeb3c079d9ff0a4ca55a9b03 corporate/4.0/i586/kernel-2.6.12.32mdk-1-1mdk.i586.rpm
0cd8fd1c504f3365fe503c4fd627b6ea corporate/4.0/i586/kernel-BOOT-2.6.12.32mdk-1-1mdk.i586.rpm
fbabe3497810452a0052bc67a5fb4f29 corporate/4.0/i586/kernel-doc-2.6.12.32mdk-1-1mdk.i586.rpm
02edfc1bbb2bd826c4a9152d670cc2cc corporate/4.0/i586/kernel-i586-up-1GB-2.6.12.32mdk-1-1mdk.i586.rpm
88b0876de92beff866bb91ba57be0a70 corporate/4.0/i586/kernel-i686-up-4GB-2.6.12.32mdk-1-1mdk.i586.rpm
e813926dc184e911deb62a1e34cff8ed corporate/4.0/i586/kernel-smp-2.6.12.32mdk-1-1mdk.i586.rpm
a8011ebbe529551463f87cc22f3da22f corporate/4.0/i586/kernel-source-2.6.12.32mdk-1-1mdk.i586.rpm
813ba955a1e9b5ff9834aeebbe477a93 corporate/4.0/i586/kernel-source-stripped-2.6.12.32mdk-1-1mdk.i586.rpm
be08ad30fbc3988f654c1532e73fc330 corporate/4.0/i586/kernel-xbox-2.6.12.32mdk-1-1mdk.i586.rpm
5894ac0216cf38203d2002a19db70c15 corporate/4.0/i586/kernel-xen0-2.6.12.32mdk-1-1mdk.i586.rpm
62d5b93083df571edbf8785bc754dd6e corporate/4.0/i586/kernel-xenU-2.6.12.32mdk-1-1mdk.i586.rpm
423fe3296a56ff845fd643890663cdee corporate/4.0/SRPMS/kernel-2.6.12.32mdk-1-1mdk.src.rpm
Corporate 4.0/X86_64:
a51bd78ce00e65f7521625c8c67605f0 corporate/4.0/x86_64/kernel-2.6.12.32mdk-1-1mdk.x86_64.rpm
8d407ed81be714537c2c957918cedfed corporate/4.0/x86_64/kernel-BOOT-2.6.12.32mdk-1-1mdk.x86_64.rpm
730c0bae9b443e5f9d8cb3c8a3486488 corporate/4.0/x86_64/kernel-doc-2.6.12.32mdk-1-1mdk.x86_64.rpm
06391bd475945e8a8b76dcb33989fc83 corporate/4.0/x86_64/kernel-smp-2.6.12.32mdk-1-1mdk.x86_64.rpm
bc9c9a881f18b5c2f892684aaeee84cf corporate/4.0/x86_64/kernel-source-2.6.12.32mdk-1-1mdk.x86_64.rpm
b0240b751985babe1aabda9c9e231a92 corporate/4.0/x86_64/kernel-source-stripped-2.6.12.32mdk-1-1mdk.x86_64.rpm
b1b4750de7daf9cb12ed0057a8851f32 corporate/4.0/x86_64/kernel-xen0-2.6.12.32mdk-1-1mdk.x86_64.rpm
915a8eb87a9fc0c0deab5e696f27c59b corporate/4.0/x86_64/kernel-xenU-2.6.12.32mdk-1-1mdk.x86_64.rpm
423fe3296a56ff845fd643890663cdee corporate/4.0/SRPMS/kernel-2.6.12.32mdk-1-1mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
iD8DBQFHE+PimqjQ0CJFipgRAprEAKCoEfNhoDZrxQng2IYqYumR/3zVvACeOoJQ
51R6ymKyEZNBb9xnSWE/E64=
=QWz7
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
