Executive Summary

Informations
Name CVE-2009-1184 First vendor Publication 2009-05-05
Vendor Cve Last vendor Modification 2024-11-21

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score 4.4 Attack Range Local
Cvss Impact Score 6.4 Attack Complexity Medium
Cvss Expoit Score 3.4 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The selinux_ip_postroute_iptables_compat function in security/selinux/hooks.c in the SELinux subsystem in the Linux kernel before 2.6.27.22, and 2.6.28.x before 2.6.28.10, when compat_net is enabled, omits calls to avc_has_perm for the (1) node and (2) port, which allows local users to bypass intended restrictions on network traffic. NOTE: this was incorrectly reported as an issue fixed in 2.6.27.21.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1184

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-16 Configuration

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:13265
 
Oval ID: oval:org.mitre.oval:def:13265
Title: DSA-1809-1 linux-2.6 -- denial of service, privilege escalation
Description: Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-1630 Frank Filz discovered that local users may be able to execute files without execute permission when accessed via an nfs4 mount. CVE-2009-1633 Jeff Layton and Suresh Jayaraman fixed several buffer overflows in the CIFS filesystem which allow remote servers to cause memory corruption. CVE-2009-1758 Jan Beulich discovered an issue in Xen where local guest users may cause a denial of service. This update also fixes a regression introduced by the fix for CVE-2009-1184 in 2.6.26-15lenny3. This prevents a boot time panic on systems with SELinux enabled. For the stable distribution, these problems have been fixed in version 2.6.26-15lenny3. For the oldstable distribution, these problems, where applicable, will be fixed in future updates to linux-2.6 and linux-2.6.24. We recommend that you upgrade your linux-2.6 and user-mode-linux packages. Note: Debian carefully tracks all known security issues across every linux kernel package in all releases under active security support. However, given the high frequency at which low-severity security issues are discovered in the kernel and the resource requirements of doing an update, updates for lower priority issues will normally not be released for all kernels at the same time. Rather, they will be released in a staggered or "leap-frog" fashion.
Family: unix Class: patch
Reference(s): DSA-1809-1
CVE-2009-1630
CVE-2009-1633
CVE-2009-1758
CVE-2009-1184
 Version: 5
Platform(s): Debian GNU/Linux 5.0
 Product(s): linux-2.6
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:8079
 
Oval ID: oval:org.mitre.oval:def:8079
Title: DSA-1809 linux-2.6 -- denial of service, privilege escalation
Description: Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems: Frank Filz discovered that local users may be able to execute files without execute permission when accessed via an nfs4 mount. Jeff Layton and Suresh Jayaraman fixed several buffer overflows in the CIFS filesystem which allow remote servers to cause memory corruption. Jan Beulich discovered an issue in Xen where local guest users may cause a denial of service (oops). This update also fixes a regression introduced by the fix for CVE-2009-1184 in 2.6.26-15lenny3. This prevents a boot time panic on systems with SELinux enabled.
Family: unix Class: patch
Reference(s): DSA-1809
CVE-2009-1630
CVE-2009-1633
CVE-2009-1758
CVE-2009-1184
 Version: 3
Platform(s): Debian GNU/Linux 5.0
 Product(s): linux-2.6
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Os 335

OpenVAS Exploits

Date Description
2009-06-23 Name : Mandrake Security Advisory MDVSA-2009:135 (kernel)
File : nvt/mdksa_2009_135.nasl
2009-06-05 Name : Debian Security Advisory DSA 1809-1 (linux-2.6)
File : nvt/deb_1809_1.nasl
2009-06-05 Name : Mandrake Security Advisory MDVSA-2009:119 (kernel)
File : nvt/mdksa_2009_119.nasl
2009-06-05 Name : Ubuntu USN-776-2 (kvm)
File : nvt/ubuntu_776_2.nasl
2009-05-25 Name : Debian Security Advisory DSA 1800-1 (linux-2.6)
File : nvt/deb_1800_1.nasl
2009-05-25 Name : Mandrake Security Advisory MDVSA-2009:118 (kernel)
File : nvt/mdksa_2009_118.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
54667 Linux Kernel SELinux Subsystem security/selinux/hooks.c selinux_ip_postroute_...

Nessus® Vulnerability Scanner

Date Description
2010-07-30 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-119.nasl - Type : ACT_GATHER_INFO
2009-07-02 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-793-1.nasl - Type : ACT_GATHER_INFO
2009-06-18 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-135.nasl - Type : ACT_GATHER_INFO
2009-06-03 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1809.nasl - Type : ACT_GATHER_INFO
2009-05-20 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-118.nasl - Type : ACT_GATHER_INFO
2009-05-18 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1800.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.27.y.git%3Ba=commi...
http://lwn.net/Articles/331434/
http://lwn.net/Articles/331435/
http://patchwork.ozlabs.org/patch/25238/
http://secunia.com/advisories/35121
http://secunia.com/advisories/35656
http://www.debian.org/security/2009/dsa-1800
http://www.mandriva.com/security/advisories?name=MDVSA-2009:118
http://www.mandriva.com/security/advisories?name=MDVSA-2009:119
http://www.mandriva.com/security/advisories?name=MDVSA-2009:135
http://www.openwall.com/lists/oss-security/2009/05/04/1
http://www.ubuntu.com/usn/usn-793-1
https://launchpad.net/bugs/cve/2009-1184
Source Url

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
Date Informations
2024-11-28 23:11:23
  • Multiple Updates
2024-11-28 12:18:40
  • Multiple Updates
2024-08-02 12:11:20
  • Multiple Updates
2024-08-02 01:03:04
  • Multiple Updates
2024-02-02 01:10:50
  • Multiple Updates
2024-02-01 12:03:02
  • Multiple Updates
2023-11-07 21:47:43
  • Multiple Updates
2023-09-05 12:10:08
  • Multiple Updates
2023-09-05 01:02:54
  • Multiple Updates
2023-09-02 12:10:14
  • Multiple Updates
2023-09-02 01:02:55
  • Multiple Updates
2023-08-12 12:11:57
  • Multiple Updates
2023-08-12 01:02:54
  • Multiple Updates
2023-08-11 12:10:16
  • Multiple Updates
2023-08-11 01:03:01
  • Multiple Updates
2023-08-06 12:09:51
  • Multiple Updates
2023-08-06 01:02:56
  • Multiple Updates
2023-08-04 12:09:57
  • Multiple Updates
2023-08-04 01:02:58
  • Multiple Updates
2023-07-14 12:09:55
  • Multiple Updates
2023-07-14 01:02:56
  • Multiple Updates
2023-03-29 01:11:24
  • Multiple Updates
2023-03-28 12:03:02
  • Multiple Updates
2022-10-11 12:08:49
  • Multiple Updates
2022-10-11 01:02:45
  • Multiple Updates
2021-05-04 12:09:22
  • Multiple Updates
2021-04-22 01:09:42
  • Multiple Updates
2020-08-01 12:04:17
  • Multiple Updates
2020-05-23 00:23:35
  • Multiple Updates
2016-04-26 18:44:23
  • Multiple Updates
2014-02-17 10:49:34
  • Multiple Updates
2013-05-10 23:47:57
  • Multiple Updates