Al Viro 氏は、ネットワークデバイスの /proc ファイルハンドラーで競合状態を発見しました。/proc/sys/net/ipv4/conf/<interface>/ の中の任意のファイルを開いて、そのインターフェイスがシャットダウンされるまで待機することで、ローカルの攻撃者がこれを悪用する可能性があります。特定の状況下では、このためにカーネルクラッシュが発生したり、完全なカーネル権限で任意のコードが実行される可能性もあります。(CVE-2005-2709)

Tetsuo Handa 氏は、udp_v6_get_port() 関数でローカルのサービス拒否の脆弱性を発見しました。IPv6 を使用するコンピュータで、ローカルの攻撃者がこれを悪用して、カーネルで無限ループを発生させる可能性があります。
(CVE-2005-2973)

Harald Welte 氏は、USB devio ドライバーでサービス拒否の脆弱性を発見しました。ローカルの攻撃者がこれを悪用して、「USB リクエストブロック」（URB）を送信し、応答が到着する前に送信プロセスを終了することで、無効なポインターを残してカーネルクラッシュを引き起こす可能性がありました。(CVE-2005-3055)

Pavel Roskin 氏は、Orinoco 無線カードドライバーで情報漏洩を発見しました。データを格納するためのバッファの長さが増加するとき、バッファがゼロでパディングされないため、ユーザーにシステムメモリのランダムな部分が露出されました。(CVE-2005-3180)

exec() 関数の POSIX タイマーの処理で、リソース漏洩が発見されました。これは、ローカルユーザーのグループにより DoS 攻撃（サービス拒否攻撃）に悪用可能です。この脆弱性の影響を受けるのは、Ubuntu 4.10 のみです。(CVE-2005-3271)

Stephen Hemming 氏は、ネットワークブリッジドライバーの弱点を発見しました。
パケットフィルターですでに落とされているパケットが、転送テーブルを汚染するため、ブリッジ転送にパッケージを偽装させるために悪用可能です。この脆弱性の影響を受けるのは、Ubuntu 4.10 および 5.04 のみです。(CVE-2005-3272)

David S. Miller 氏は、rose_rt_ioctl() 関数でバッファオーバーフローを発見しました。大きな「ngidis」引数を付けてこの関数を呼び出すことで、ローカルの攻撃者がカーネルクラッシュを引き起こす可能性があります。この脆弱性の影響を受けるのは、Ubuntu 4.10 および 5.04 のみです。(CVE-2005-3273)

Neil Horman 氏は、接続タイマーの処理で競合状態を発見しました。このため、ローカルの攻撃者が、接続リストがまだトラバースされている間に、その接続リストを変更する期限切れハンドラーを設定して、カーネルクラッシュを引き起こす可能性があります。この脆弱性は、マルチプロセッサ（SMP）システムだけに影響を及ぼします。(CVE-2005-3274)

Patrick McHardy 氏は、ネットワークアドレス変換（NAT）接続トラッカーの論理エラーを発見しました。リモートの攻撃者がこれを悪用して、同じプロトコルの 2 つのパケットを同時に NAT 処理させることで、カーネルクラッシュを引き起こす可能性があります。(CVE-2005-3275)

Paolo Giarrusso 氏は、sys_get_thread_area() の情報漏洩を発見しました。戻される構造体が適切にクリアされず、少量のカーネルメモリがユーザー空間のプログラムに漏洩しました。これにより、機密データが漏洩する可能性があります。
（CVE-2005-3276）。

Al Viro discovered a race condition in the /proc file handler of network devices. A local attacker could exploit this by opening any file in /proc/sys/net/ipv4/conf/<interface>/ and waiting until that interface was shut down. Under certain circumstances this could lead to a kernel crash or even arbitrary code execution with full kernel privileges. (CVE-2005-2709)

Tetsuo Handa discovered a local Denial of Service vulnerability in the udp_v6_get_port() function. On computers which use IPv6, a local attacker could exploit this to trigger an infinite loop in the kernel.
(CVE-2005-2973)

Harald Welte discovered a Denial of Service vulnerability in the USB devio driver. A local attacker could exploit this by sending an 'USB Request Block' (URB) and terminating the sending process before the arrival of the answer, which left an invalid pointer and caused a kernel crash. (CVE-2005-3055)

Pavel Roskin discovered an information leak in the Orinoco wireless card driver. When increasing the buffer length for storing data, the buffer was not padded with zeros, which exposed a random part of the system memory to the user. (CVE-2005-3180)

A resource leak has been discovered in the handling of POSIX timers in the exec() function. This could be exploited to a Denial of Service attack by a group of local users. This vulnerability only affects Ubuntu 4.10. (CVE-2005-3271)

Stephen Hemming discovered a weakness in the network bridge driver.
Packets which had already been dropped by the packet filter could poison the forwarding table, which could be exploited to make the bridge forward spoofed packages. This vulnerability only affects Ubuntu 4.10 and 5.04. (CVE-2005-3272)

David S. Miller discovered a buffer overflow in the rose_rt_ioctl() function. By calling the function with a large 'ngidis' argument, a local attacker could cause a kernel crash. This vulnerability only affects Ubuntu 4.10 and 5.04. (CVE-2005-3273)

Neil Horman discovered a race condition in the connection timer handling. This allowed a local attacker to set up an expiration handler which modified the connection list while the list still being traversed, which could result in a kernel crash. This vulnerability only affects multiprocessor (SMP) systems. (CVE-2005-3274)

Patrick McHardy noticed a logic error in the network address translation (NAT) connection tracker. A remote attacker could exploit this by causing two packets for the same protocol to be NATed at the same time, which resulted in a kernel crash. (CVE-2005-3275)

Paolo Giarrusso discovered an information leak in the sys_get_thread_area(). The returned structure was not properly cleared, which exposed a small amount of kernel memory to userspace programs. This could possibly expose confidential data.
(CVE-2005-3276).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Al Viro 在網路裝置的 /proc 檔案處置程式中發現爭用情形。本機攻擊者可在 /proc/sys/net/ipv4/conf/<interface>/ 中開啟任何檔案並等候到該介面關閉為止來加以惡意利用。在某些情況下，這可導致核心損毀甚或以完整核心權限執行任意程式碼。(CVE-2005-2709)

Tetsuo Handa 在 udp_v6_get_port() 函式中發現一個本機拒絕服務弱點。在使用 IPv6 的電腦上，本機攻擊者可加以惡意利用，在核心中觸發無限迴圈。
(CVE-2005-2973)

Harald Welte 在 USB devio 驅動程式中發現一個拒絕服務弱點。本機攻擊者可加以惡意利用，傳送 'USB Request Block' (URB) 並在答案到達之前終止傳送處理程序，進而留下無效的指標並造成核心損毀。(CVE-2005-3055)

Pavel Roskin 在 Orinoco 無線卡驅動程式中發現資訊洩漏。當增加儲存資料的緩衝區長度時，緩衝區並未填補零，而致使系統記憶體的隨機部分洩漏給使用者。(CVE-2005-3180)

在 exec() 函式的 POSIX 計時器處理中發現資源洩漏。本機使用者群組可加以惡意利用，發動拒絕服務攻擊。此弱點只會影響 Ubuntu 4.10。(CVE-2005-3271)

Stephen Hemming 在網路橋接器驅動程式中發現一個弱點。
已由封包篩選器捨棄的封包可毒害轉送表格，其可被惡意利用來使橋接器轉送偽造的套件。受此弱點影響的只有 Ubuntu 4.10 和 5.04。(CVE-2005-3272)

David S. Miller 在 rose_rt_ioctl() 函式中發現一個緩衝區溢位。透過以大型 'ngidis' 引數呼叫此函式，本機攻擊者可造成核心損毀。受此弱點影響的只有 Ubuntu 4.10 和 5.04。(CVE-2005-3273)

Neil Horman 在連線計時器處理中發現爭用情形。這允許本機攻擊者設定到期處置程式，其會在清單仍在遊走時修改連線清單，進而導致核心損毀。此弱點只會影響多處理器 (SMP) 系統。(CVE-2005-3274)

Patrick McHardy 在網路位址轉譯 (NAT) 連線追蹤器中發現一個邏輯錯誤。遠端攻擊者可加以惡意利用，造成相同通訊協定的兩個封包同時進行 NAT，進而導致核心損毀。(CVE-2005-3275)

Paolo Giarrusso 在 sys_get_thread_area() 中發現資訊洩漏。未正確清除傳回的結構，導致少量的核心記憶體洩漏給使用者空間程式。這可能洩漏機密資料。
(CVE-2005-3276)。

Al Viro 在网络设备的 /proc 文件处理程序中发现一个争用条件。本地攻击者可通过打开 /proc/sys/net/ipv4/conf/<interface>/ 中的任意文件并等待该界面关闭来利用此问题。在某些情况下，这样可导致内核崩溃，甚至以完整的内核权限执行任意代码。(CVE-2005-2709)

Tetsuo Handa 在 udp_v6_get_port() 函数中发现一个本地拒绝服务漏洞。在使用 IPv6 的计算机上，本地攻击者可利用此漏洞来触发内核中的无限循环。
(CVE-2005-2973)

Harald Welte 在 USB devio 驱动程序中发现一个拒绝服务漏洞。本地攻击者可通过发送“USB 请求块”(URB) 并在回复到达之前终止发送进程来利用此漏洞，从而留下无效指针并导致内核崩溃。(CVE-2005-3055)

Pavel Roskin 在 Orinoco 无线网卡驱动程序中发现一个信息泄漏。增加用户存储数据的缓冲区长度时，该缓冲区不会用 0 来填充，从而将系统内存的随机部分暴露给用户。(CVE-2005-3180)

在 exec() 函数中的 POSIX 定时器处理中发现一个资源泄漏。此问题可被一组本地用户用于进行拒绝服务攻击。此漏洞仅影响 Ubuntu 4.10。(CVE-2005-3271)

Stephen Hemming 在网桥驱动程序中发现一个漏洞。
已被数据包过滤器丢弃的数据包可使转发表中毒，这样可被利用于使桥接转发欺骗性程序包。此漏洞仅影响 Ubuntu 4.10 和 5.04。(CVE-2005-3272)

David S. Miller 在 rose_rt_ioctl() 函数中发现一个缓冲区溢出。通过以大型“ngidis”参数调用该函数，本地攻击者可造成内核崩溃。此漏洞仅影响 Ubuntu 4.10 和 5.04。(CVE-2005-3273)

Neil Horman 在连接定时器处理中发现一个争用条件。这样允许本地攻击者设置到期处理程序，该处理程序会在仍在遍历连接列表时修改该列表，这样可导致内核崩溃。此漏洞仅影响多处理器 (SMP) 系统。(CVE-2005-3274)

Patrick McHardy 注意到网络地址转换 (NAT) 连接跟踪器中的一个逻辑错误。远程攻击者可通过导致同时对同一协议的两个数据包进行 NAT 来利用此问题，从而导致内核崩溃。(CVE-2005-3275)

Paolo Giarrusso 在 sys_get_thread_area() 中发现一个信息泄漏。返回的结构未得到正确清理，这样会将少量内核内存暴露给用户空间程序。这样可能会暴露机密数据。
(CVE-2005-3276)。

Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 4 kernel are now available.

This security advisory has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the security issues described below :

* a flaw in the IPv6 implementation that allowed a local user to cause a denial of service (infinite loop and crash) (CVE-2005-2973, important)

* a flaw in the bridge implementation that allowed a remote user to cause forwarding of spoofed packets via poisoning of the forwarding table with already dropped frames (CVE-2005-3272, moderate)

* a flaw in the atm module that allowed a local user to cause a denial of service (panic) via certain socket calls (CVE-2005-3359, important)

* a flaw in the NFS client implementation that allowed a local user to cause a denial of service (panic) via O_DIRECT writes (CVE-2006-0555, important)

* a difference in 'sysretq' operation of EM64T (as opposed to Opteron) processors that allowed a local user to cause a denial of service (crash) upon return from certain system calls (CVE-2006-0741 and CVE-2006-0744, important)

* a flaw in the keyring implementation that allowed a local user to cause a denial of service (OOPS) (CVE-2006-1522, important)

* a flaw in IP routing implementation that allowed a local user to cause a denial of service (panic) via a request for a route for a multicast IP (CVE-2006-1525, important)

* a flaw in the SCTP-netfilter implementation that allowed a remote user to cause a denial of service (infinite loop) (CVE-2006-1527, important)

* a flaw in the sg driver that allowed a local user to cause a denial of service (crash) via a dio transfer to memory mapped (mmap) IO space (CVE-2006-1528, important)

* a flaw in the threading implementation that allowed a local user to cause a denial of service (panic) (CVE-2006-1855, important)

* two missing LSM hooks that allowed a local user to bypass the LSM by using readv() or writev() (CVE-2006-1856, moderate)

* a flaw in the virtual memory implementation that allowed local user to cause a denial of service (panic) by using the lsof command (CVE-2006-1862, important)

* a directory traversal vulnerability in smbfs that allowed a local user to escape chroot restrictions for an SMB-mounted filesystem via '..\\' sequences (CVE-2006-1864, moderate)

* a flaw in the ECNE chunk handling of SCTP that allowed a remote user to cause a denial of service (panic) (CVE-2006-2271, moderate)

* a flaw in the handling of COOKIE_ECHO and HEARTBEAT control chunks of SCTP that allowed a remote user to cause a denial of service (panic) (CVE-2006-2272, moderate)

* a flaw in the handling of DATA fragments of SCTP that allowed a remote user to cause a denial of service (infinite recursion and crash) (CVE-2006-2274, moderate)

All Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2004-2302     A race condition in the sysfs filesystem allows local     users to read kernel memory and cause a denial of     service (crash).

  - CVE-2005-0756     Alexander Nyberg discovered that the ptrace() system     call does not properly verify addresses on the amd64     architecture which can be exploited by a local attacker     to crash the kernel.

  - CVE-2005-0757     A problem in the offset handling in the xattr file     system code for ext3 has been discovered that may allow     users on 64-bit systems that have access to an ext3     filesystem with extended attributes to cause the kernel     to crash.

  - CVE-2005-1265     Chris Wright discovered that the mmap() function could     create illegal memory maps that could be exploited by a     local user to crash the kernel or potentially execute     arbitrary code.

  - CVE-2005-1761     A vulnerability on the IA-64 architecture can lead local     attackers to overwrite kernel memory and crash the     kernel.

  - CVE-2005-1762     A vulnerability has been discovered in the ptrace()     system call on the amd64 architecture that allows a     local attacker to cause the kernel to crash.

  - CVE-2005-1763     A buffer overflow in the ptrace system call for 64-bit     architectures allows local users to write bytes into     arbitrary kernel memory.

  - CVE-2005-1765     Zou Nan Hai has discovered that a local user could cause     the kernel to hang on the amd64 architecture after     invoking syscall() with specially crafted arguments.

  - CVE-2005-1767     A vulnerability has been discovered in the stack segment     fault handler that could allow a local attacker to cause     a stack exception that will lead the kernel to crash     under certain circumstances.

  - CVE-2005-2456     Balazs Scheidler discovered that a local attacker could     call setsockopt() with an invalid xfrm_user policy     message which would cause the kernel to write beyond the     boundaries of an array and crash.

  - CVE-2005-2458     Vladimir Volovich discovered a bug in the zlib routines     which are also present in the Linux kernel and allows     remote attackers to crash the kernel.

  - CVE-2005-2459     Another vulnerability has been discovered in the zlib     routines which are also present in the Linux kernel and     allows remote attackers to crash the kernel.

  - CVE-2005-2548     Peter Sandstrom noticed that snmpwalk from a remote host     could cause a denial of service (kernel oops from null     dereference) via certain UDP packets that lead to a     function call with the wrong argument.

  - CVE-2005-2801     Andreas Gruenbacher discovered a bug in the ext2 and     ext3 file systems. When data areas are to be shared     among two inodes not all information were compared for     equality, which could expose wrong ACLs for files.

  - CVE-2005-2872     Chad Walstrom discovered that the ipt_recent kernel     module on 64-bit processors such as AMD64 allows remote     attackers to cause a denial of service (kernel panic)     via certain attacks such as SSH brute force.

  - CVE-2005-3105     The mprotect code on Itanium IA-64 Montecito processors     does not properly maintain cache coherency as required     by the architecture, which allows local users to cause a     denial of service and possibly corrupt data by modifying     PTE protections.

  - CVE-2005-3106     A race condition in the thread management may allow     local users to cause a denial of service (deadlock) when     threads are sharing memory and waiting for a thread that     has just performed an exec.

  - CVE-2005-3107     When one thread is tracing another thread that shares     the same memory map a local user could cause a denial of     service (deadlock) by forcing a core dump when the     traced thread is in the TASK_TRACED state.

  - CVE-2005-3108     A bug in the ioremap() system call has been discovered     on the amd64 architecture that could allow local users     to cause a denial of service or an information leak when     performing a lookup of a non-existent memory page.

  - CVE-2005-3109     The HFS and HFS+ (hfsplus) modules allow local attackers     to cause a denial of service (oops) by using hfsplus to     mount a filesystem that is not hfsplus.

  - CVE-2005-3110     A race condition in the ebtables netfilter module on an     SMP system running under high load may allow remote     attackers to cause a denial of service (crash).

  - CVE-2005-3271     Roland McGrath discovered that exec() does not properly     clear posix-timers in multi-threaded environments, which     results in a resource leak and could allow a large     number of multiple local users to cause a denial of     service by using more posix-timers than specified by the     quota for a single user.

  - CVE-2005-3272     The kernel allows remote attackers to poison the bridge     forwarding table using frames that have already been     dropped by filtering, which can cause the bridge to     forward spoofed packets.

  - CVE-2005-3273     The ioctl for the packet radio ROSE protocol does not     properly verify the arguments when setting a new router,     which allows attackers to trigger out-of-bounds errors.

  - CVE-2005-3274     A race condition on SMP systems allows local users to     cause a denial of service (null dereference) by causing     a connection timer to expire while the connection table     is being flushed before the appropriate lock is     acquired.

  - CVE-2005-3275     An error in the NAT code allows remote attackers to     cause a denial of service (memory corruption) by causing     two packets for the same protocol to be NATed at the     same time, which leads to memory corruption.

  - CVE-2005-3276     A missing memory cleanup in the thread handling routines     before copying data into userspace allows a user process     to obtain sensitive information.

This update also contains a number of corrections for issues that turned out to have no security implication afterwards.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2006-0493.

ID	名稱	產品	系列	已發布	已更新	嚴重性
65105	Ubuntu 4.10 / 5.10：linux-source-2.6.8.1/-2.6.10/-2.6.12 の脆弱性（USN-219-1）	Nessus	Ubuntu Local Security Checks	2013/3/9	2021/1/19	medium
65105	Ubuntu 4.10 / 5.10 : linux-source-2.6.8.1/-2.6.10/-2.6.12 vulnerabilities (USN-219-1)	Nessus	Ubuntu Local Security Checks	2013/3/9	2021/1/19	medium
65105	Ubuntu 4.10 / 5.10：linux-source-2.6.8.1/-2.6.10/-2.6.12 弱點 (USN-219-1)	Nessus	Ubuntu Local Security Checks	2013/3/9	2021/1/19	medium
65105	Ubuntu 4.10 / 5.10：linux-source-2.6.8.1/-2.6.10/-2.6.12 漏洞 (USN-219-1)	Nessus	Ubuntu Local Security Checks	2013/3/9	2021/1/19	medium
21592	RHEL 4 : kernel (RHSA-2006:0493)	Nessus	Red Hat Local Security Checks	2006/5/24	2021/1/14	high
21997	CentOS 4 : kernel (CESA-2006:0493)	Nessus	CentOS Local Security Checks	2006/7/5	2021/1/4	high
22788	Debian DSA-922-1 : kernel-source-2.6.8 - several vulnerabilities	Nessus	Debian Local Security Checks	2006/10/14	2021/1/4	high
801418	CentOS RHSA-2006-0493 Security Check	Log Correlation Engine	Generic			high

偵測

搜尋 Plugin

medium

medium

medium

medium

high

high

high

high