-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --------------------------------------------------------------------------
Debian Testing Security Advisory DTSA-16-1 September 15, 2005
secure-testing-team@lists.alioth.debian.org Joey Hess
http://secure-testing-master.debian.net/
- --------------------------------------------------------------------------
Package : linux-2.6
Vulnerability : several holes
Problem-Scope : remote
Debian-specific: No
CVE ID : CAN-2005-2098 CAN-2005-2099 CAN-2005-2456 CAN-2005-2617
CAN-2005-1913 CAN-2005-1761 CAN-2005-2457 CAN-2005-2458 CAN-2005-2459 CAN-2005-2548 CAN-2004-2302 CAN-2005-1765 CAN-2005-1762 CAN-2005-1761 CAN-2005-2555
Several security related problems have been found in version 2.6 of the
linux kernel. The Common Vulnerabilities and Exposures project identifies
the following problems:
CAN-2004-2302
Race condition in the sysfs_read_file and sysfs_write_file functions in
Linux kernel before 2.6.10 allows local users to read kernel memory and
cause a denial of service (crash) via large offsets in sysfs files.
CAN-2005-1761
Vulnerability in the Linux kernel allows local users to cause a
denial of service (kernel crash) via ptrace.
CAN-2005-1762
The ptrace call in the Linux kernel 2.6.8.1 and 2.6.10 for the AMD64
platform allows local users to cause a denial of service (kernel crash) via
a "non-canonical" address.
CAN-2005-1765
syscall in the Linux kernel 2.6.8.1 and 2.6.10 for the AMD64 platform, when
running in 32-bit compatibility mode, allows local users to cause a denial
of service (kernel hang) via crafted arguments.
CAN-2005-1913
When a non group-leader thread called exec() to execute a different program
while an itimer was pending, the timer expiry would signal the old group
leader task, which did not exist any more. This caused a kernel panic.
CAN-2005-2098
The KEYCTL_JOIN_SESSION_KEYRING operation in the Linux kernel before
2.6.12.5 contains an error path that does not properly release the session
management semaphore, which allows local users or remote attackers to cause
a denial of service (semaphore hang) via a new session keyring (1) with an
empty name string, (2) with a long name string, (3) with the key quota
reached, or (4) ENOMEM.
CAN-2005-2099
The Linux kernel before 2.6.12.5 does not properly destroy a keyring that
is not instantiated properly, which allows local users or remote attackers
to cause a denial of service (kernel oops) via a keyring with a payload
that is not empty, which causes the creation to fail, leading to a null
dereference in the keyring destructor.
CAN-2005-2456
Array index overflow in the xfrm_sk_policy_insert function in xfrm_user.c
in Linux kernel 2.6 allows local users to cause a denial of service (oops
or deadlock) and possibly execute arbitrary code via a p->dir value that
is
larger than XFRM_POLICY_OUT, which is used as an index in the
sock->sk_policy array.
CAN-2005-2457
The driver for compressed ISO file systems (zisofs) in the Linux kernel
before 2.6.12.5 allows local users and remote attackers to cause a denial
of service (kernel crash) via a crafted compressed ISO file system.
CAN-2005-2458
inflate.c in the zlib routines in the Linux kernel before 2.6.12.5 allows
remote attackers to cause a denial of service (kernel crash) via a
compressed file with "improper tables".
CAN-2005-2459
The huft_build function in inflate.c in the zlib routines in the Linux
kernel before 2.6.12.5 returns the wrong value, which allows remote
attackers to cause a denial of service (kernel crash) via a certain
compressed file that leads to a null pointer dereference, a different
vulnerbility than CAN-2005-2458.
CAN-2005-2548
vlan_dev.c in Linux kernel 2.6.8 allows remote attackers to cause a denial
of service (kernel oops from null dereference) via certain UDP packets that
lead to a function call with the wrong argument, as demonstrated using
snmpwalk on snmpd.
CAN-2005-2555
Linux kernel 2.6.x does not properly restrict socket policy access to users
with the CAP_NET_ADMIN capability, which could allow local users to conduct
unauthorized activities via (1) ipv4/ip_sockglue.c and (2)
ipv6/ipv6_sockglue.c.
CAN-2005-2617
The syscall32_setup_pages function in syscall32.c for Linux kernel 2.6.12
and later, on the amd64 architecture, does not check the return value of
the insert_vm_struct function, which allows local users to trigger a memory
leak via a 32-bit application with crafted ELF headers.
In addition this update fixes some security issues that have not been
assigned CVE ids:
- Fix DST leak in icmp_push_reply(). Possible remote DoS?
- NPTL signal delivery deadlock fix; possible local DoS.
- fix a memory leak in devices seq_file implementation; local DoS.
- Fix SKB leak in ip6_input_finish(); local DoS.
For the testing distribution (etch) this is fixed in version
2.6.12-6
For the unstable distribution (sid) this is fixed in version
2.6.12-6
This upgrade is recommended for users of version 2.6 of the linux kernel.
Users of version 2.4 of the linux kernel can also upgrade if desired, but
be warned that a major kernel upgrade is a complex process that is beyond
the scope of this advisory.
The Debian testing security team does not track security issues for the
stable (sarge) and oldstable (woody) distributions. If stable is vulnerable,
the Debian security team will make an announcement once a fix is ready.
Upgrade Instructions
- --------------------
Your system does not need to be configured to use the Debian testing security
archive to install this update. The fixed kernel packages are available
in the regular Debian testing archive.
To install the update, first run this command as root:
apt-get update
Next, install an appropriate kernel package for your architecture and
machine. The following kernel will work for all i386 machines:
apt-get install linux-image-2.6-386
However, you may prefer to install an optimised kernel for your machine:
apt-get install linux-image-2.6-686
apt-get install linux-image-2.6-686-smp
apt-get install linux-image-2.6-k7
apt-get install linux-image-2.6-k7-smp
For the amd64 architecture, chose one of these kernels:
apt-get install linux-image-2.6-amd64-generic
apt-get install linux-image-2.6-amd64-k8
apt-get install linux-image-2.6-amd64-k8-smp
For the powerpc architecture, choose one of these kernels:
apt-get install linux-image-2.6-powerpc
apt-get install linux-image-2.6-powerpc-smp
apt-get install linux-image-2.6-powerpc64
For the sparc architecture, choose one of these kernels:
apt-get install linux-image-2.6-sparc64
apt-get install linux-image-2.6-sparc64-smp
(Note that users of 32 bit sparc systems are no longer supported by the
2.6 kernel.)
For the alpha architecture, choose one of these kernels:
apt-get install linux-image-2.6-alpha-generic
apt-get install linux-image-2.6-alpha-smp
For the ia64 architecture, choose one of these kernels:
apt-get install linux-image-2.6-itanium
apt-get install linux-image-2.6-itanium-smp
apt-get install linux-image-2.6-mckinley
apt-get install linux-image-2.6-mckinley-smp
For the hppa architecture, choose one of these kernels:
apt-get install linux-image-2.6-parisc
apt-get install linux-image-2.6-parisc-smp
apt-get install linux-image-2.6-parisc64
apt-get install linux-image-2.6-parisc64-smp
For the s390 architecture, choose one of these kernels:
apt-get install linux-image-2.6-s390
apt-get install linux-image-2.6-s390x
For the arm architecture, choose one of these kernels:
apt-get install linux-image-2.6-footbridge
apt-get install linux-image-2.6-ixp4xx
apt-get install linux-image-2.6-rpc
apt-get install linux-image-2.6-s3c2410
For the m68k architecture, choose one of these kernels:
apt-get install linux-image-2.6-amiga
apt-get install linux-image-2.6-atari
apt-get install linux-image-2.6-bvme6000
apt-get install linux-image-2.6-hp
apt-get install linux-image-2.6-mac
apt-get install linux-image-2.6-mvme147
apt-get install linux-image-2.6-mvme16x
apt-get install linux-image-2.6-q40
apt-get install linux-image-2.6-sun3
Updated kernels are not yet available for the mips and mipsel
architectures.
Note that you may also need to upgrade third-party modules that are not
included in the kernel package.
Finally, reboot the system, taking care to boot the new 2.6.12 kernel with
your bootloader.
For further information about the Debian testing security team, please refer
to http://secure-testing-master.debian.net/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
iD8DBQFDKZt72tp5zXiKP0wRAr+UAJ0SvHLSEBWH7uUOu8u53ZMroqWIegCeJjae
u0d3/TG0l7Q9escyUecSrr4=
=g+ZX
-----END PGP SIGNATURE-----
_______________________________________________
secure-testing-announce mailing list
secure-testing-announce@lists.alioth.debian.org
http://lists.alioth.debian.org/mailman/listinfo/secure-testing-announce
|
