|
|
Family: Debian Local Security Checks --> Category: infos
[DSA1018] DSA-1018-2 kernel-source-2.4.27 Vulnerability Scan
Vulnerability Scan Summary
DSA-1018-2 kernel-source-2.4.27
Detailed Explanation for this Vulnerability Test
The original update lacked recompiled ALSA modules against the new kernel
ABI. Furthermore, kernel-latest-2.4-sparc now correctly depends on the
updated packages. For completeness we're providing the original problem description:
Several local and remote vulnerabilities have been discovered in the Linux
kernel that may lead to a denial of service or the execution of arbitrary
code. The Common Vulnerabilities and Exposures project identifies the
following problems:
Martin Schwidefsky discovered that the privileged instruction SACF (Set
Address Space Control Fast) on the S/390 platform is not handled properly,
allowing for a local user to gain root rights.
A race condition allows for a local user to read the environment variables
of another process that is still spawning through /proc/.../cmdline.
A numeric casting discrepancy in sdla_xfer allows local users to read
portions of kernel memory via a large len argument which is received as an
int but cast to a short, preventing read loop from filling a buffer.
An error in the skb_checksum_help() function from the netfilter framework
has been discovered that allows the bypass of packet filter rules or
a denial of service attack.
A vulnerability in the ptrace subsystem of the IA-64 architecture can
allow local attackers to overwrite kernel memory and crash the kernel.
Tim Yamin discovered that insufficient input validation in the compressed
ISO file system (zisofs) allows a denial of service attack through
maliciously crafted ISO images.
Herbert Xu discovered that the setsockopt() function was not restricted to
users/processes with the CAP_NET_ADMIN capability. This allows attackers to
manipulate IPSEC policies or initiate a denial of service attack.
Al Viro discovered a race condition in the /proc handling of network devices.
A (local) attacker could exploit the stale reference after interface shutdown
to cause a denial of service or possibly execute code in kernel mode.
Tetsuo Handa discovered that the udp_v6_get_port() function from the IPv6 code
can be forced into an endless loop, which allows a denial of service attack.
Rudolf Polzer discovered that the kernel improperly restricts access to the
KDSKBSENT ioctl, which can possibly lead to privilege escalation.
The ptrace code using CLONE_THREAD didn't use the thread group ID to
acertain whether the caller is attaching to itself, which allows a denial
of service attack.
Yen Zheng discovered that the IPv6 flow label code modified an incorrect variable,
which could lead to memory corruption and denial of service.
Ollie Wild discovered a memory leak in the icmp_push_reply() function, which
allows denial of service through memory consumption.
Chris Wright discovered that excessive allocation of broken file lock leases
in the VFS layer can exhaust memory and fill up the system logging, which allows
denial of service.
Patrick McHardy discovered a memory leak in the ip6_input_finish() function fro
[...]
Solution : http://www.debian.org/security/2006/dsa-1018
Threat Level: High
Click HERE for more information and discussions on this network vulnerability scan.
|
