Home / vulnerabilities Mandriva Linux Security Advisory 2015-057
Posted on 10 March 2015
Source : packetstormsecurity.org Link
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2015:057
http://www.mandriva.com/en/support/security/
_______________________________________________________________________
Package : kernel
Date : March 10, 2015
Affected: Business Server 1.0
_______________________________________________________________________
Problem Description:
Multiple vulnerabilities has been found and corrected in the Linux
kernel:
The Crypto API in the Linux kernel before 3.18.5 allows local users
to load arbitrary kernel modules via a bind system call for an
AF_ALG socket with a parenthesized module template expression in
the salg_name field, as demonstrated by the vfat(aes) expression,
a different vulnerability than CVE-2013-7421 (CVE-2014-9644).
net/netfilter/nf_conntrack_proto_generic.c in the Linux kernel before
3.18 generates incorrect conntrack entries during handling of certain
iptables rule sets for the SCTP, DCCP, GRE, and UDP-Lite protocols,
which allows remote attackers to bypass intended access restrictions
via packets with disallowed port numbers (CVE-2014-8160).
The Crypto API in the Linux kernel before 3.18.5 allows local users
to load arbitrary kernel modules via a bind system call for an
AF_ALG socket with a module name in the salg_name field, a different
vulnerability than CVE-2014-9644 (CVE-2013-7421).
The updated packages provides a solution for these security issues.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9644
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8160
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7421
_______________________________________________________________________
Updated Packages:
Mandriva Business Server 1/X86_64:
ab21eb82b9f3b9998d89a9a96d802d89 mbs1/x86_64/cpupower-3.4.106-1.1.mbs1.x86_64.rpm
46fd73cc51df3b28d0d8514284fac385 mbs1/x86_64/kernel-firmware-3.4.106-1.1.mbs1.noarch.rpm
21a5b87104f323ab6f9c0053459b6758 mbs1/x86_64/kernel-headers-3.4.106-1.1.mbs1.x86_64.rpm
c98d416ff27d029db2a2b99074f8d8cc mbs1/x86_64/kernel-server-3.4.106-1.1.mbs1.x86_64.rpm
6d006fc713bf03befe27f52da7587bca mbs1/x86_64/kernel-server-devel-3.4.106-1.1.mbs1.x86_64.rpm
8e620bcc9138026e7e7ca6b2be965cf7 mbs1/x86_64/kernel-source-3.4.106-1.mbs1.noarch.rpm
ff53f8301daf71c8d118b3c751bc432d mbs1/x86_64/lib64cpupower0-3.4.106-1.1.mbs1.x86_64.rpm
d3b60137d548904023e4355a8035353a mbs1/x86_64/lib64cpupower-devel-3.4.106-1.1.mbs1.x86_64.rpm
f5013c8e961f3eb1841dbb1dcddfd44f mbs1/x86_64/perf-3.4.106-1.1.mbs1.x86_64.rpm
ac71f1e51ed1440926a80bec1c9bf8b1 mbs1/SRPMS/cpupower-3.4.106-1.1.mbs1.src.rpm
29ed687f12ca09bca945a49fb95e58e1 mbs1/SRPMS/kernel-firmware-3.4.106-1.1.mbs1.src.rpm
63d4ff2e470e1c15fd213119a893d0c7 mbs1/SRPMS/kernel-headers-3.4.106-1.1.mbs1.src.rpm
17c40cdb0e71f2e12ce1f04514a72ffa mbs1/SRPMS/kernel-server-3.4.106-1.1.mbs1.src.rpm
61f419409456eeae14af3b0346bcdb95 mbs1/SRPMS/kernel-source-3.4.106-1.mbs1.src.rpm
c5373a8d093e13288efb69376ef2fded mbs1/SRPMS/perf-3.4.106-1.1.mbs1.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/en/support/security/advisories/
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iD8DBQFU/ro5mqjQ0CJFipgRArhTAKDV/pfXBMXLzn4a30W2Gf881jRF8gCeN/bV
EVT7oxqY/TFjUsM+pfPNxTc=
=wLS6
-----END PGP SIGNATURE-----
