Linux kernel before 2.6.15.3 down to 2.6.12, while constructing an ICMP response in icmp_send, does not properly handle when the ip_options_echo function in icmp.c fails, which allows remote attackers to cause a denial of service (crash) via vectors such as (1) record-route and (2) timestamp IP options with the needaddr bit set and a truncated value.

Herbert Xu discovered a remote Denial of Service vulnerability in the ICMP packet handler. In some situations a memory allocation was released twice, which led to memory corruption. A remote attacker could exploit this to crash the machine.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A number of vulnerabilities were discovered and corrected in the Linux 2.6 kernel :

The udp_v6_get_port function in udp.c, when running IPv6, allows local users to cause a Denial of Service (infinite loop and crash) (CVE-2005-2973).

The mq_open system call in certain situations can decrement a counter twice as a result of multiple calls to the mntput function when the dentry_open function call fails, allowing a local user to cause a DoS (panic) via unspecified attack vectors (CVE-2005-3356).

The procfs code allows attackers to read sensitive kernel memory via unspecified vectors in which a signed value is added to an unsigned value (CVE-2005-4605).

A buffer overflow in sysctl allows local users to cause a DoS and possibly execute arbitrary code via a long string, which causes sysctl to write a zero byte outside the buffer (CVE-2005-4618).

A buffer overflow in the CA-driver for TwinHan DST Frontend/Card allows local users to cause a DoS (crash) and possibly execute arbitrary code by reading more than eight bytes into an eight byte long array (CVE-2005-4639).

dm-crypt does not clear a structure before it is freed, which leads to a memory disclosure that could allow local users to obtain sensitive information about a cryptographic key (CVE-2006-0095).

Remote attackers can cause a DoS via unknown attack vectors related to an 'extra dst release when ip_options_echo fails' in icmp.c (CVE-2006-0454).

In addition to these security fixes, other fixes have been included such as :

  - support for mptsas

    - fix for IPv6 with sis190

    - a problem with the time progressing twice as fast

    - a fix for Audigy 2 ZS Video Editor sample rates

    - a fix for a supermount crash when accessing a       supermount-ed CD/DVD drive

  - a fix for improperly unloading sbp2 module

The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels.

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

This update fixes a remotely exploitable denial of service attack in the icmp networking code (CVE-2006-0454). An information leak has also been fixed (CVE-2006-0095), and some debugging patches that had accidentally been left applied in the previous update have been removed, restoring the functionality of the 'quiet' argument.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
21059	Ubuntu 5.10 : linux-source-2.6.12 vulnerability (USN-250-1)	Nessus	Ubuntu Local Security Checks	medium
20939	Mandrake Linux Security Advisory : kernel (MDKSA-2006:040)	Nessus	Mandriva Local Security Checks	medium
20872	Fedora Core 4 : kernel-2.6.15-1.1831_FC4 (2006-102)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2006-0454

high

Tenable Plugins

medium

medium

medium