Executive Summary
| Summary | |
|---|---|
| Title | Linux kernel vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | USN-231-1 | First vendor Publication | 2005-12-22 |
| Vendor | Ubuntu | Last vendor Modification | 2005-12-22 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 7.8 | Attack Range | Network |
| Cvss Impact Score | 6.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty Warthog) Ubuntu 5.04 (Hoary Hedgehog) Ubuntu 5.10 (Breezy Badger) The following packages are affected: linux-image-2.6.10-6-386 linux-image-2.6.10-6-686 linux-image-2.6.10-6-686-smp linux-image-2.6.10-6-amd64-generic linux-image-2.6.10-6-amd64-k8 linux-image-2.6.10-6-amd64-k8-smp linux-image-2.6.10-6-amd64-xeon linux-image-2.6.10-6-itanium linux-image-2.6.10-6-itanium-smp linux-image-2.6.10-6-k7 linux-image-2.6.10-6-k7-smp linux-image-2.6.10-6-mckinley linux-image-2.6.10-6-mckinley-smp linux-image-2.6.10-6-power3 linux-image-2.6.10-6-power3-smp linux-image-2.6.10-6-power4 linux-image-2.6.10-6-power4-smp linux-image-2.6.10-6-powerpc linux-image-2.6.10-6-powerpc-smp linux-image-2.6.12-10-386 linux-image-2.6.12-10-686 linux-image-2.6.12-10-686-smp linux-image-2.6.12-10-amd64-generic linux-image-2.6.12-10-amd64-k8 linux-image-2.6.12-10-amd64-k8-smp linux-image-2.6.12-10-amd64-xeon linux-image-2.6.12-10-iseries-smp linux-image-2.6.12-10-k7 linux-image-2.6.12-10-k7-smp linux-image-2.6.12-10-powerpc linux-image-2.6.12-10-powerpc-smp linux-image-2.6.12-10-powerpc64-smp linux-image-2.6.8.1-6-386 linux-image-2.6.8.1-6-686 linux-image-2.6.8.1-6-686-smp linux-image-2.6.8.1-6-amd64-generic linux-image-2.6.8.1-6-amd64-k8 linux-image-2.6.8.1-6-amd64-k8-smp linux-image-2.6.8.1-6-amd64-xeon linux-image-2.6.8.1-6-k7 linux-image-2.6.8.1-6-k7-smp linux-image-2.6.8.1-6-power3 linux-image-2.6.8.1-6-power3-smp linux-image-2.6.8.1-6-power4 linux-image-2.6.8.1-6-power4-smp linux-image-2.6.8.1-6-powerpc linux-image-2.6.8.1-6-powerpc-smp linux-patch-debian-2.6.8.1 linux-patch-ubuntu-2.6.10 linux-patch-ubuntu-2.6.12 The problem can be corrected by upgrading the affected package to version 2.6.8.1-16.26 (for Ubuntu 4.10), 2.6.10-34.9 (for Ubuntu 5.04), or 2.6.12-10.25 (for Ubuntu 5.10). After a standard system upgrade you need to reboot the computer to effect the necessary changes. Details follow: Rudolf Polzer reported an abuse of the 'loadkeys' command. By redefining one or more keys and tricking another user (like root) into logging in on a text console and typing something that involves the redefined keys, a local user could cause execution of arbitrary commands with the privileges of the target user. The updated kernel restricts the usage of 'loadkeys' to root. (CVE-2005-3257) The ptrace() system call did not correctly check whether a process tried to attach to itself. A local attacker could exploit this to cause a kernel crash. (CVE-2005-3783) A Denial of Service vulnerability was found in the handler that automatically cleans up and terminates child processes that are not correctly handled by their parent process ("auto-reaper"). The check did not correctly handle processes which were currently traced by another process. A local attacker could exploit this to cause a kernel crash. (CVE-2005-3784) A locking problem was discovered in the POSIX timer cleanup handling on process exit. A local attacker could exploit this to cause the machine to hang (Denial of Service). This flaw only affects multiprocessor (SMP) systems. (CVE-2005-3805) A Denial of Service vulnerability was discovered in the IPv6 flowlabel handling code. By invoking setsockopt(IPV6_FLOWLABEL_MGR) in a special way, a local attacker could cause memory corruption which eventually led to a kernel crash. (CVE-2005-3806) A memory leak was discovered in the VFS lease handling. These operations are commonly executed by the Samba server, which led to steady memory exhaustion. By repeatedly triggering the affected operations in quick succession, a local attacker could exploit this to drain all memory, which leads to a Denial of Service. (CVE-2005-3807) An integer overflow was discovered in the invalidate_inode_pages2_range() function. By issuing 64-bit mmap calls on a 32 bit system, a local user could exploit this to crash the machine, thereby causing Denial of Service. This flaw does not affect the amd64 platform, and does only affect Ubuntu 5.10. (CVE-2005-3808) Ollie Wild discovered a memory leak in the icmp_push_reply() function. By sending a large amount of specially crafted packets, a remote attacker could exploit this to drain all memory, which eventually leads to a Denial of Service. (CVE-2005-3848) Chris Wrigth found a Denial of Service vulnerability in the time_out_leases() function. By allocating a large number of VFS file lock leases and having them timeout at the same time, a large number of 'printk' debugging statements was generated at the same time, which could exhaust kernel memory. (CVE-2005-3857) Patrick McHardy discovered a memory leak in the ip6_input_finish() function. A remote attacker could exploit this by sending specially crafted IPv6 packets, which would eventually drain all available kernel memory, thus causing a Denial of Service. (CVE-2005-3858) |
Original Source
| Url : http://www.ubuntu.com/usn/USN-231-1 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 75 % | CWE-399 | Resource Management Errors |
| 25 % | CWE-264 | Permissions, Privileges, and Access Controls |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10615 | |||
| Oval ID: | oval:org.mitre.oval:def:10615 | ||
| Title: | The VT implementation (vt_ioctl.c) in Linux kernel 2.6.12, and possibly other versions including 2.6.14.4, allows local users to use the KDSKBSENT ioctl on terminals of other users and gain privileges, as demonstrated by modifying key bindings using loadkeys. | ||
| Description: | The VT implementation (vt_ioctl.c) in Linux kernel 2.6.12, and possibly other versions including 2.6.14.4, allows local users to use the KDSKBSENT ioctl on terminals of other users and gain privileges, as demonstrated by modifying key bindings using loadkeys. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-3257 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:11346 | |||
| Oval ID: | oval:org.mitre.oval:def:11346 | ||
| Title: | Memory leak in the icmp_push_reply function in Linux 2.6 before 2.6.12.6 and 2.6.13 allows remote attackers to cause a denial of service (memory consumption) via a large number of crafted packets that cause the ip_append_data function to fail, aka "DST leak in icmp_push_reply." | ||
| Description: | Memory leak in the icmp_push_reply function in Linux 2.6 before 2.6.12.6 and 2.6.13 allows remote attackers to cause a denial of service (memory consumption) via a large number of crafted packets that cause the ip_append_data function to fail, aka "DST leak in icmp_push_reply." | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-3848 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:9080 | |||
| Oval ID: | oval:org.mitre.oval:def:9080 | ||
| Title: | The auto-reap of child processes in Linux kernel 2.6 before 2.6.15 includes processes with ptrace attached, which leads to a dangling ptrace reference and allows local users to cause a denial of service (crash) and gain root privileges. | ||
| Description: | The auto-reap of child processes in Linux kernel 2.6 before 2.6.15 includes processes with ptrace attached, which leads to a dangling ptrace reference and allows local users to cause a denial of service (crash) and gain root privileges. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-3784 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:9396 | |||
| Oval ID: | oval:org.mitre.oval:def:9396 | ||
| Title: | Memory leak in the ip6_input_finish function in ip6_input.c in Linux kernel 2.6.12 and earlier might allow attackers to cause a denial of service via malformed IPv6 packets with unspecified parameter problems, which prevents the SKB from being freed. | ||
| Description: | Memory leak in the ip6_input_finish function in ip6_input.c in Linux kernel 2.6.12 and earlier might allow attackers to cause a denial of service via malformed IPv6 packets with unspecified parameter problems, which prevents the SKB from being freed. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-3858 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:9727 | |||
| Oval ID: | oval:org.mitre.oval:def:9727 | ||
| Title: | The time_out_leases function in locks.c for Linux kernel before 2.6.15-rc3 allows local users to cause a denial of service (kernel log message consumption) by causing a large number of broken leases, which is recorded to the log using the printk function. | ||
| Description: | The time_out_leases function in locks.c for Linux kernel before 2.6.15-rc3 allows local users to cause a denial of service (kernel log message consumption) by causing a large number of broken leases, which is recorded to the log using the printk function. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-3857 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:9903 | |||
| Oval ID: | oval:org.mitre.oval:def:9903 | ||
| Title: | The IPv6 flow label handling code (ip6_flowlabel.c) in Linux kernels 2.4 up to 2.4.32 and 2.6 before 2.6.14 modifies the wrong variable in certain circumstances, which allows local users to corrupt kernel memory or cause a denial of service (crash) by triggering a free of non-allocated memory. | ||
| Description: | The IPv6 flow label handling code (ip6_flowlabel.c) in Linux kernels 2.4 up to 2.4.32 and 2.6 before 2.6.14 modifies the wrong variable in certain circumstances, which allows local users to corrupt kernel memory or cause a denial of service (crash) by triggering a free of non-allocated memory. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-3806 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-10-10 | Name : SLES9: Security update for Linux kernel File : nvt/sles9p5010939.nasl |
| 2009-10-10 | Name : SLES9: Security update for Linux kernel File : nvt/sles9p5015723.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 1017-1 (kernel-source-2.6.8) File : nvt/deb_1017_1.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 1018-1 (kernel-source-2.4.27) File : nvt/deb_1018_1.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 1018-2 (kernel-source-2.4.27) File : nvt/deb_1018_2.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 22508 | Linux Kernel mm/truncate.c invalidate_inode_pages2_range Function Local Overflow |
| 22507 | Linux Kernel ip6_input_finish Function Crafted IPv6 Packet DoS |
| 22506 | Linux Kernel icmp_push_reply Function Crafted Packet Remote DoS |
| 21518 | Linux Kernel on SMP POSIX Timer Handling Local DoS |
| 21517 | Linux Kernel VFS Lease Handling Memory Exhaustion Local DoS |
| 21516 | Linux Kernel IPv6 Flow Label Handling Local DoS |
| 21285 | Linux Kernel time_out_leases Function Broken Lease Saturation Local DoS |
| 21284 | Linux Kernel Child Process auto-reap Dangling ptrace Local DoS |
| 21283 | Linux Kernel ptrace CLONE_THREAD Local DoS |
| 20061 | Linux Kernel loadkeys Console Keyboard Mapping Local Privilege Escalation |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2006-10-14 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1017.nasl - Type : ACT_GATHER_INFO |
| 2006-10-14 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1018.nasl - Type : ACT_GATHER_INFO |
| 2006-07-05 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2006-0101.nasl - Type : ACT_GATHER_INFO |
| 2006-07-03 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2006-0140.nasl - Type : ACT_GATHER_INFO |
| 2006-02-10 | Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2006_006.nasl - Type : ACT_GATHER_INFO |
| 2006-02-05 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0191.nasl - Type : ACT_GATHER_INFO |
| 2006-01-22 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-018.nasl - Type : ACT_GATHER_INFO |
| 2006-01-21 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-231-1.nasl - Type : ACT_GATHER_INFO |
| 2006-01-20 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0140.nasl - Type : ACT_GATHER_INFO |
| 2006-01-17 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0101.nasl - Type : ACT_GATHER_INFO |
| 2006-01-15 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2005-219.nasl - Type : ACT_GATHER_INFO |
| 2006-01-15 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2005-235.nasl - Type : ACT_GATHER_INFO |
| 2005-12-20 | Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2005_068.nasl - Type : ACT_GATHER_INFO |
| 2005-12-15 | Name : The remote Fedora Core host is missing a security update. File : fedora_2005-1138.nasl - Type : ACT_GATHER_INFO |
| 2005-12-08 | Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2005_067.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 12:03:12 |
|
