The suid_dumpable support in Linux kernel 2.6.13 up to versions before 2.6.17.4, and 2.6.16 before 2.6.16.24, allows a local user to cause a denial of service (disk consumption) and possibly gain privileges via the PR_SET_DUMPABLE argument of the prctl function and a program that causes a core dump file to be created in a directory for which the user does not have permissions.

This kernel update fixes the following security problems :

  - A race condition allows local users to gain root     privileges by changing the file mode of /proc/self/     files in a way that causes those files (for instance     /proc/self/environ) to become setuid root. [#192688].
    (CVE-2006-3626)

  - A stack-based buffer overflow in CDROM / DVD handling     was fixed which could be used by a physical local     attacker to crash the kernel or execute code within     kernel context, depending on presence of automatic DVD     handling in the system. [#190396]. (CVE-2006-2935)

  - Due to an argument validation error in     prctl(PR_SET_DUMPABLE) a local attacker can easily gain     administrator (root) privileges. [#186980].
    (CVE-2006-2451)

and the following non security bugs :

  - Limit the maximum number of LUNs to 16384 [#185164]

  - LSI 1030/MPT Fusion driver hang during error recovery --     Optionally disable QAS [#180100]

  - advance buffer pointers in h_copy_rdma() to avoid data     corruption [#186444]

A race condition was discovered in the do_add_counters() functions.
Processes which do not run with full root privileges, but have the CAP_NET_ADMIN capability can exploit this to crash the machine or read a random piece of kernel memory. In Ubuntu there are no packages that are affected by this, so this can only be an issue for you if you use third-party software that uses Linux capabilities. (CVE-2006-0039)

John Stultz discovered a faulty BUG_ON trigger in the handling of POSIX timers. A local attacker could exploit this to trigger a kernel oops and crash the machine. (CVE-2006-2445)

Dave Jones discovered that the PowerPC kernel did not perform certain required access_ok() checks. A local user could exploit this to read arbitrary kernel memory and crash the kernel on 64-bit systems, and possibly read arbitrary kernel memory on 32-bit systems.
(CVE-2006-2448)

A design flaw was discovered in the prctl(PR_SET_DUMPABLE, ...) system call, which allowed a local user to have core dumps created in a directory he could not normally write to. This could be exploited to drain available disk space on system partitions, or, under some circumstances, to execute arbitrary code with full root privileges.
This flaw only affects Ubuntu 6.06 LTS. (CVE-2006-2451)

In addition, the Ubuntu 6.06 LTS update fixes a range of bugs.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated kernel packages that fix a privilege escalation security issue in the Red Hat Enterprise Linux 4 kernel are now available.

This security advisory has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

During security research, Red Hat discovered a behavioral flaw in core dump handling. A local user could create a program that would cause a core file to be dumped into a directory they would not normally have permissions to write to. This could lead to a denial of service (disk consumption), or allow the local user to gain root privileges.
(CVE-2006-2451)

Prior to applying this update, users can remove the ability to escalate privileges using this flaw by configuring core files to dump to an absolute location. By default, core files are created in the working directory of the faulting application, but this can be overridden by specifying an absolute location for core files in /proc/sys/kernel/core_pattern. To avoid a potential denial of service, a separate partition for the core files should be used.

All Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2006-0574.

ID	Name	Product	Family	Severity
59120	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 1900)	Nessus	SuSE Local Security Checks	medium
29484	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 1896)	Nessus	SuSE Local Security Checks	medium
27886	Ubuntu 5.04 / 5.10 / 6.06 LTS : linux-source-2.6.10/-2.6.12/-2.6.15 vulnerabilities (USN-311-1)	Nessus	Ubuntu Local Security Checks	medium
22038	CentOS 4 : kernel (CESA-2006:0574)	Nessus	CentOS Local Security Checks	medium
22015	RHEL 4 : kernel (RHSA-2006:0574)	Nessus	Red Hat Local Security Checks	medium
801419	CentOS RHSA-2006-0574 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2006-2451

critical

Tenable Plugins

medium

medium

medium

medium

medium

high