LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Security Week: September 22nd, 2014
Linux Advisory Watch: September 19th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Mandriva: Updated kernel packages fix multiple vulnerabilities Print E-mail
User Rating:      How can I rate this item?
Posted by Benjamin D. Thomas   
Mandrake A number of vulnerabilities were discovered and corrected in the Linux 2.6 kernel: The udp_v6_get_port function in udp.c, when running IPv6, allows local users to cause a Denial of Service (infinite loop and crash) (CVE-2005-2973).
 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDKSA-2006:040
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : kernel
 Date    : February 17, 2006
 Affected: 2006.0
 _______________________________________________________________________
 
 Problem Description:
 
 A number of vulnerabilities were discovered and corrected in the Linux
 2.6 kernel:
 
 The udp_v6_get_port function in udp.c, when running IPv6, allows local
 users to cause a Denial of Service (infinite loop and crash)
 (CVE-2005-2973).
 
 The mq_open system call in certain situations can decrement a counter
 twice as a result of multiple calls to the mntput function when the
 dentry_open function call fails, allowing a local user to cause a DoS
 (panic) via unspecified attack vectors (CVE-2005-3356).
 
 The procfs code allows attackers to read sensitive kernel memory via
 unspecified vectors in which a signed value is added to an unsigned
 value (CVE-2005-4605).
 
 A buffer overflow in sysctl allows local users to cause a DoS and
 possibly execute arbitrary code via a long string, which causes sysctl
 to write a zero byte outside the buffer (CVE-2005-4618).
 
 A buffer overflow in the CA-driver for TwinHan DST Frontend/Card allows
 local users to cause a DoS (crash) and possibly execute arbitrary code
 by reading more than eight bytes into an eight byte long array
 (CVE-2005-4639).
 
 dm-crypt does not clear a structure before it is freed, which leads to
 a memory disclosure that could allow local users to obtain sensitive
 information about a cryptographic key (CVE-2006-0095).
 
 Remote attackers can cause a DoS via unknown attack vectors related to
 an "extra dst release when ip_options_echo fails" in icmp.c
 (CVE-2006-0454).
 
 In addition to these security fixes, other fixes have been included
 such as:
 
 - support for mptsas
 - fix for IPv6 with sis190
 - a problem with the time progressing twice as fast
 - a fix for Audigy 2 ZS Video Editor sample rates
 - a fix for a supermount crash when accessing a supermount-ed CD/DVD
   drive
 - a fix for improperly unloading sbp2 module
 
 The provided packages are patched to fix these vulnerabilities.  All
 users are encouraged to upgrade to these updated kernels.
 
 To update your kernel, please follow the directions located at:
 
   http://www.mandriva.com/en/security/kernelupdate
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2973
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3356
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4605
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4618
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4639
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0095
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0454
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2006.0:
 dcc4059bea4a73009da92ed328e8d9e7  2006.0/RPMS/kernel-2.6.12.17mdk-1-1mdk.i586.rpm
 ac45ea6b408ed5030c52ce8314ca9802  2006.0/RPMS/kernel-i586-up-1GB-2.6.12.17mdk-1-1mdk.i586.rpm
 5e35fab46c227cc00c93217b529b10fb  2006.0/RPMS/kernel-i686-up-4GB-2.6.12.17mdk-1-1mdk.i586.rpm
 df4a6406c8a52283a92fcb57d95eac0d  2006.0/RPMS/kernel-smp-2.6.12.17mdk-1-1mdk.i586.rpm
 4239a2d8938361b4d29a8e56d8bd6e8a  2006.0/RPMS/kernel-source-2.6-2.6.12-17mdk.i586.rpm
 a4843210cfad80c2e9c38553295d5163  2006.0/RPMS/kernel-source-stripped-2.6-2.6.12-17mdk.i586.rpm
 5e7d3446ead2d2fc62724a7d85472aab  2006.0/RPMS/kernel-xbox-2.6.12.17mdk-1-1mdk.i586.rpm
 8c7982ea467e1c841608627e0ce2264f  2006.0/RPMS/kernel-xen0-2.6.12.17mdk-1-1mdk.i586.rpm
 687140c2bc40e7d58d3edef69781caba  2006.0/RPMS/kernel-xenU-2.6.12.17mdk-1-1mdk.i586.rpm
 60f3379dc061180667d38234f6accf18  2006.0/SRPMS/kernel-2.6.12.17mdk-1-1mdk.src.rpm

 Mandriva Linux 2006.0/X86_64:
 70a4e16212e197a2c0bd06c9ad6d2862  x86_64/2006.0/RPMS/kernel-2.6.12.17mdk-1-1mdk.x86_64.rpm
 56a406cd52927ba8c7fb04054baa4cf4  x86_64/2006.0/RPMS/kernel-smp-2.6.12.17mdk-1-1mdk.x86_64.rpm
 1650081c68d255b825b493aae30cfaec  x86_64/2006.0/RPMS/kernel-source-2.6-2.6.12-17mdk.x86_64.rpm
 edb8af2127f83d27e6b14ac1d87180d8  x86_64/2006.0/RPMS/kernel-source-stripped-2.6-2.6.12-17mdk.x86_64.rpm
 60f3379dc061180667d38234f6accf18  x86_64/2006.0/SRPMS/kernel-2.6.12.17mdk-1-1mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  
 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
Snowden: New Zealand Is Spying, Too
DDoS attackers turn fire on ISPs and gaming servers
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.