The remote host is missing the patch for the advisory SUSE-SA:2004:037 (kernel).


An integer underflow problem in the iptables firewall logging rules can allow a remote attacker to crash the machine by using a handcrafted IP packet. This attack is only possible with firewalling enabled.

We would like to thank Richard Hart for reporting the problem.

This problem has already been fixed in the 2.6.8 upstream Linux kernel, this update contains a backport of the fix.

Products running a 2.4 kernel are not affected.

Mitre has assigned the CVE ID CVE-2004-0816 for this problem.


Additionaly Martin Schwidefsky of IBM found an incorrectly handled privileged instruction which can lead to a local user gaining root user privileges.

This only affects the SUSE Linux Enterprise Server 9 on the S/390 platform and has been assigned CVE ID CVE-2004-0887.


Additionaly the following non-security bugs were fixed:

- Two CD burning problems.

- USB 2.0 stability problems under high load on SMP systems.

- Several SUSE Linux Enterprise Server issues.
(see the Maintenance Information Mail for more informations).

The original update lacked recompiled ALSA modules against the new  kernel ABI. Furthermore, kernel-latest-2.4-sparc now correctly  depends on the updated packages. For completeness we're providing the  original problem description :

  Several local and remote vulnerabilities have been discovered in the   Linux kernel that may lead to a denial of service or the execution   of arbitrary code. The Common Vulnerabilities and Exposures project   identifies the following problems :

    - CVE-2004-0887       Martin Schwidefsky discovered that the privileged       instruction SACF (Set Address Space Control Fast) on       the S/390 platform is not handled properly, allowing       for a local user to gain root privileges.

    - CVE-2004-1058       A race condition allows for a local user to read the       environment variables of another process that is still       spawning through /proc/.../cmdline.

    - CVE-2004-2607       A numeric casting discrepancy in sdla_xfer allows       local users to read portions of kernel memory via a       large len argument which is received as an int but       cast to a short, preventing read loop from filling a       buffer.

    - CVE-2005-0449       An error in the skb_checksum_help() function from the       netfilter framework has been discovered that allows       the bypass of packet filter rules or a denial of       service attack.

    - CVE-2005-1761       A vulnerability in the ptrace subsystem of the IA-64       architecture can allow local attackers to overwrite       kernel memory and crash the kernel.

    - CVE-2005-2457       Tim Yamin discovered that insufficient input       validation in the compressed ISO file system (zisofs)       allows a denial of service attack through maliciously       crafted ISO images.

    - CVE-2005-2555       Herbert Xu discovered that the setsockopt() function       was not restricted to users/processes with the       CAP_NET_ADMIN capability. This allows attackers to       manipulate IPSEC policies or initiate a denial of       service attack.

    - CVE-2005-2709       Al Viro discovered a race condition in the /proc       handling of network devices. A (local) attacker could       exploit the stale reference after interface shutdown       to cause a denial of service or possibly execute code       in kernel mode.

    - CVE-2005-2973       Tetsuo Handa discovered that the udp_v6_get_port()       function from the IPv6 code can be forced into an       endless loop, which allows a denial of service attack.

    - CVE-2005-3257       Rudolf Polzer discovered that the kernel improperly       restricts access to the KDSKBSENT ioctl, which can       possibly lead to privilege escalation.

    - CVE-2005-3783       The ptrace code using CLONE_THREAD didn't use the       thread group ID to determine whether the caller is       attaching to itself, which allows a denial of service       attack.

    - CVE-2005-3806       Yen Zheng discovered that the IPv6 flow label code       modified an incorrect variable, which could lead to       memory corruption and denial of service.

    - CVE-2005-3848       Ollie Wild discovered a memory leak in the       icmp_push_reply() function, which allows denial of       service through memory consumption.

    - CVE-2005-3857       Chris Wright discovered that excessive allocation of       broken file lock leases in the VFS layer can exhaust       memory and fill up the system logging, which allows       denial of service.

    - CVE-2005-3858       Patrick McHardy discovered a memory leak in the       ip6_input_finish() function from the IPv6 code, which       allows denial of service.

    - CVE-2005-4618       Yi Ying discovered that sysctl does not properly       enforce the size of a buffer, which allows a denial of       service attack.

ID	名稱	產品	系列	已發布	已更新	嚴重性
15528	SUSE-SA:2004:037: kernel	Nessus	SuSE Local Security Checks	2004/10/21	2021/1/14	high
22560	Debian DSA-1018-2 : kernel-source-2.4.27 - several vulnerabilities	Nessus	Debian Local Security Checks	2006/10/14	2021/1/4	high

偵測

搜尋 Plugin

high

high