Executive Summary
| Summary | |
|---|---|
| Title | Ubuntu kernel modules vulnerability |
| Informations | |||
|---|---|---|---|
| Name | USN-662-2 | First vendor Publication | 2008-11-06 |
| Vendor | Ubuntu | Last vendor Modification | 2008-11-06 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:A/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 8.3 | Attack Range | Adjacent network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 6.5 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A security issue affects the following Ubuntu releases: Ubuntu 7.10 Ubuntu 8.04 LTS This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 7.10: Ubuntu 8.04 LTS: After a standard system upgrade you need to reboot your computer to effect the necessary changes. Details follow: USN-662-1 fixed vulnerabilities in ndiswrapper in Ubuntu 8.10. This update provides the corresponding updates for Ubuntu 8.04 and 7.10. Original advisory details: Anders Kaseorg discovered that ndiswrapper did not correctly handle long |
Original Source
| Url : http://www.ubuntu.com/usn/USN-662-2 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:13632 | |||
| Oval ID: | oval:org.mitre.oval:def:13632 | ||
| Title: | DSA-1731-1 ndiswrapper -- buffer overflow | ||
| Description: | Anders Kaseorg discovered that ndiswrapper suffers from buffer overflows via specially crafted wireless network traffic, due to incorrectly handling long ESSIDs. This could lead to the execution of arbitrary code. For the oldstable distribution, this problem has been fixed in version 1.28-1+etch1. For the stable distribution, this problem has been fixed in version 1.53-2, which was already included in the lenny release. For the testing distribution and the unstable distribution , this problem has been fixed in version 1.53-2. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1731-1 CVE-2008-4395 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | ndiswrapper |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:17633 | |||
| Oval ID: | oval:org.mitre.oval:def:17633 | ||
| Title: | USN-662-2 -- linux-ubuntu-modules-2.6.22/24 vulnerability | ||
| Description: | USN-662-1 fixed vulnerabilities in ndiswrapper in Ubuntu 8.10. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-662-2 CVE-2008-4395 | Version: | 7 |
| Platform(s): | Ubuntu 7.10 Ubuntu 8.04 | Product(s): | linux-ubuntu-modules-2.6.22 linux-ubuntu-modules-2.6.24 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:17666 | |||
| Oval ID: | oval:org.mitre.oval:def:17666 | ||
| Title: | USN-662-1 -- linux vulnerability | ||
| Description: | It was discovered that the Linux kernel could be made to hang temporarily when mounting corrupted ext2/3 filesystems. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-662-1 CVE-2008-3528 CVE-2008-4395 | Version: | 7 |
| Platform(s): | Ubuntu 8.10 | Product(s): | linux |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:8321 | |||
| Oval ID: | oval:org.mitre.oval:def:8321 | ||
| Title: | DSA-1731 ndiswrapper -- buffer overflow | ||
| Description: | Anders Kaseorg discovered that ndiswrapper suffers from buffer overflows via specially crafted wireless network traffic, due to incorrectly handling long ESSIDs. This could lead to the execution of arbitrary code. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1731 CVE-2008-4395 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | ndiswrapper |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Os | 1 | |
| Os | 1 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-10-10 | Name : SLES9: Security update for ndiswrapper File : nvt/sles9p5039260.nasl |
| 2009-03-23 | Name : Ubuntu Update for linux vulnerability USN-662-1 File : nvt/gb_ubuntu_USN_662_1.nasl |
| 2009-03-23 | Name : Ubuntu Update for linux-ubuntu-modules-2.6.22/24 vulnerability USN-662-2 File : nvt/gb_ubuntu_USN_662_2.nasl |
| 2009-03-07 | Name : Debian Security Advisory DSA 1731-1 (ndiswrapper) File : nvt/deb_1731_1.nasl |
| 2009-01-13 | Name : Gentoo Security Advisory GLSA 200901-01 (ndiswrapper) File : nvt/glsa_200901_01.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 49726 | Linux Kernel ndiswrapper Module ESSID Handling Multiple Remote Overflows |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2011-01-27 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_ndiswrapper-5834.nasl - Type : ACT_GATHER_INFO |
| 2009-09-24 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12315.nasl - Type : ACT_GATHER_INFO |
| 2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_ndiswrapper-081107.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-662-1.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-662-2.nasl - Type : ACT_GATHER_INFO |
| 2009-03-04 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1731.nasl - Type : ACT_GATHER_INFO |
| 2009-01-12 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200901-01.nasl - Type : ACT_GATHER_INFO |
| 2008-12-05 | Name : The remote openSUSE host is missing a security update. File : suse_ndiswrapper-5833.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 12:05:23 |
|
