A number of vulnerabilities are fixed in the 2.4 and 2.6 kernels with this advisory :

  - Multiple race conditions in the terminal layer of 2.4     and 2.6 kernels (prior to 2.6.9) can allow a local     attacker to obtain portions of kernel data or allow     remote attackers to cause a kernel panic by switching     from console to PPP line discipline, then quickly     sending data that is received during the switch     (CVE-2004-0814)

  - Richard Hart found an integer underflow problem in the     iptables firewall logging rules that can allow a remote     attacker to crash the machine by using a specially     crafted IP packet. This is only possible, however, if     firewalling is enabled. The problem only affects 2.6     kernels and was fixed upstream in 2.6.8 (CVE-2004-0816)

  - Stefan Esser found several remote DoS confitions in the     smbfs file system. This could be exploited by a hostile     SMB server (or an attacker injecting packets into the     network) to crash the client systems (CVE-2004-0883 and     CVE-2004-0949)

  - Paul Starzetz and Georgi Guninski reported,     independently, that bad argument handling and bad     integer arithmetics in the IPv4 sendmsg handling of     control messages could lead to a local attacker crashing     the machine. The fixes were done by Herbert Xu     (CVE-2004-1016)

  - Rob Landley discovered a race condition in the handling     of /proc/.../cmdline where, under rare circumstances, a     user could read the environment variables of another     process that was still spawning leading to the potential     disclosure of sensitive information such as passwords     (CVE-2004-1058)

  - Paul Starzetz reported that the missing serialization in     unix_dgram_recvmsg() which was added to kernel 2.4.28     can be used by a local attacker to gain elevated (root)     privileges (CVE-2004-1068)

  - Ross Kendall Axe discovered a possible kernel panic     (DoS) while sending AF_UNIX network packets if certain     SELinux-related kernel options were enabled. By default     the CONFIG_SECURITY_NETWORK and CONFIG_SECURITY_SELINUX     options are not enabled (CVE-2004-1069)

  - Paul Starzetz of isec.pl discovered several issues with     the error handling of the ELF loader routines in the     kernel. The fixes were provided by Chris Wright     (CVE-2004-1070, CVE-2004-1071, CVE-2004-1072,     CVE-2004-1073)

  - It was discovered that hand-crafted a.out binaries could     be used to trigger a local DoS condition in both the 2.4     and 2.6 kernels. The fixes were done by Chris Wright     (CVE-2004-1074)

  - Paul Starzetz found bad handling in the IGMP code which     could lead to a local attacker being able to crash the     machine. The fix was done by Chris Wright     (CVE-2004-1137)

  - Jeremy Fitzhardinge discovered two buffer overflows in     the sys32_ni_syscall() and sys32_vm86_warning()     functions that could be used to overwrite kernel memory     with attacker-supplied code resulting in privilege     escalation (CVE-2004-1151)

  - Paul Starzetz found locally exploitable flaws in the     binary format loader's uselib() function that could be     abused to allow a local user to obtain root privileges     (CVE-2004-1235)

  - Paul Starzetz found an exploitable flaw in the page     fault handler when running on SMP machines     (CVE-2005-0001)

  - A vulnerability in insert_vm_struct could allow a locla     user to trigger BUG() when the user created a large vma     that overlapped with arg pages during exec     (CVE-2005-0003)

  - Paul Starzetz also found a number of vulnerabilities in     the kernel binfmt_elf loader that could lead a local     user to obtain elevated (root) privileges     (isec-0017-binfmt_elf)

The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels.

To update your kernel, please follow the directions located at :

http://www.mandrakesoft.com/security/kernelupdate

PLEASE NOTE: Mandrakelinux 10.0 users will need to upgrade to the latest module-init-tools package prior to upgrading their kernel.
Likewise, MNF8.2 users will need to upgrade to the latest modutils package prior to upgrading their kernel.

Updated kernel packages that fix several security issues in Red Hat Enterprise Linux 3 are now available.

The Linux kernel handles the basic functions of the operating system.

This update includes fixes for several security issues :

A missing serialization flaw in unix_dgram_recvmsg was discovered that affects kernels prior to 2.4.28. A local user could potentially make use of a race condition in order to gain privileges. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1068 to this issue.

Paul Starzetz of iSEC discovered various flaws in the ELF binary loader affecting kernels prior to 2.4.28. A local user could use thse flaws to gain read access to executable-only binaries or possibly gain privileges. (CVE-2004-1070, CVE-2004-1071, CVE-2004-1072, CVE-2004-1073)

A flaw when setting up TSS limits was discovered that affects AMD AMD64 and Intel EM64T architecture kernels prior to 2.4.23. A local user could use this flaw to cause a denial of service (crash) or possibly gain privileges. (CVE-2004-0812)

An integer overflow flaw was discovered in the ubsec_keysetup function in the Broadcom 5820 cryptonet driver. On systems using this driver, a local user could cause a denial of service (crash) or possibly gain elevated privileges. (CVE-2004-0619)

Stefan Esser discovered various flaws including buffer overflows in the smbfs driver affecting kernels prior to 2.4.28. A local user may be able to cause a denial of service (crash) or possibly gain privileges. In order to exploit these flaws the user would require control of a connected Samba server. (CVE-2004-0883, CVE-2004-0949)

SGI discovered a bug in the elf loader that affects kernels prior to 2.4.25 which could be triggered by a malformed binary. On architectures other than x86, a local user could create a malicious binary which could cause a denial of service (crash). (CVE-2004-0136)

Conectiva discovered flaws in certain USB drivers affecting kernels prior to 2.4.27 which used the copy_to_user function on uninitialized structures. These flaws could allow local users to read small amounts of kernel memory. (CVE-2004-0685)

All Red Hat Enterprise Linux 3 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

ID	名稱	產品	系列	已發布	已更新	嚴重性
16259	Mandrake Linux Security Advisory : kernel (MDKSA-2005:022)	Nessus	Mandriva Local Security Checks	2005/1/26	2021/1/6	critical
15944	RHEL 3 : kernel (RHSA-2004:549)	Nessus	Red Hat Local Security Checks	2004/12/13	2021/1/14	high

偵測

搜尋 Plugin

critical

high