Buffer overflow in the bufprint function in capiutil.c in libcapi, as used in Linux kernel 2.6.9 to 2.6.20 and isdn4k-utils, allows local users to cause a denial of service (crash) and possibly gain privileges via a crafted CAPI packet.

From Red Hat Security Advisory 2007:0774 :

Updated kernel packages that fix several security issues and bugs in the Red Hat Enterprise Linux 4 kernel are now available.

This security advisory has been rated as having moderate security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the security issues described below :

* a flaw in the ISDN CAPI subsystem that allowed a remote user to cause a denial of service or potential remote access. Exploitation would require the attacker to be able to send arbitrary frames over the ISDN network to the victim's machine. (CVE-2007-1217, Moderate)

* a flaw in the perfmon subsystem on ia64 platforms that allowed a local user to cause a denial of service. (CVE-2006-0558, Moderate)

In addition, the following bugs were addressed :

* a panic after reloading of the LSI Fusion driver.

* a vm performance problem was corrected by balancing inactive page lists.

* added a nodirplus option to address NFSv3 performance issues with large directories.

* changed the personality handling to disallow personality changes of setuid and setgid binaries. This ensures they keep any randomization and Exec-shield protection.

All Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-0705 advisory.

    [2.6.18-8.1.10.0.1.el5]
     - Fix bonding primary=ethX (Bert Barbe) [IT 101532] [ORA 5136660]
     - Add entropy module option to e1000/bnx2 (John Sobecki) [ORA 6045759]

     [2.6.18-8.1.10.el5]
     - [mm] Prevent the stack growth into hugetlb reserved regions (Konrad      Rzeszutek) [253313] {CVE-2007-3739}

     [2.6.18-8.1.9.el5]
     - [misc] cpuset information leak (Prarit Bhargava ) [245773] {CVE-2007-2875}
     - [net] ip_conntrack_sctp: fix remotely triggerable panic (Don Howard )      [245774] {CVE-2007-2876}
     - [misc] Overflow in CAPI subsystem (Anton Arapov ) [232260] {CVE-2007-1217}
     - [CIFS] fix signing sec= mount options (Jeff Layton ) [253315]      {CVE-2007-3843}
     - [CIFS] respect umask when unix extensions are enabled (Jeff Layton )      [253314] {CVE-2007-3740}
     - [misc] i915_dma: fix batch buffer security bit for i965 chipsets      (Aristeu Rozanski ) [252305] {CVE-2007-3851}
     - [fs] - Move msdos compat ioctl to msdos dir (Eric Sandeen ) [253317]
     - [fs] - fix VFAT compat ioctls on 64-bit systems (Eric Sandeen )      [253317] {CVE-2007-2878}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2007:0671 :

Updated kernel packages that fix several security issues and bugs in the Red Hat Enterprise Linux 3 kernel are now available.

This security advisory has been rated as having moderate security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the security issues described below :

* a flaw in the ISDN CAPI subsystem that allowed a remote user to cause a denial of service or potential privilege escalation.
(CVE-2007-1217, Moderate)

* a flaw in the Bluetooth subsystem that allowed a local user to trigger an information leak. (CVE-2007-1353, Low)

In addition to the security issues described above, fixes for the following have been included :

* a race condition in the e1000 network driver that could cause ESB2 systems to be started without the RX unit being turned on.

* a related e1000 bug on ESB2 systems that could cause rlogin to fail.

Red Hat would like to thank Ilja van Sprundel for reporting an issue fixed in this erratum.

Note: The kernel-unsupported package contains various drivers and modules that are unsupported and therefore might contain security problems that have not been addressed.

All Red Hat Enterprise Linux 3 users are advised to upgrade their kernels to the packages associated with their machine architecture and configurations as listed in this erratum.

- a flaw in the ISDN CAPI subsystem that allowed a remote     user to cause a denial of service or potential remote     access. Exploitation would require the attacker to be     able to send arbitrary frames over the ISDN network to     the victim's machine. (CVE-2007-1217, Moderate)

  - a flaw in the perfmon subsystem on ia64 platforms that     allowed a local user to cause a denial of service.
    (CVE-2006-0558, Moderate)

In addition, the following bugs were addressed :

  - a panic after reloading of the LSI Fusion driver.

  - a vm performance problem was corrected by balancing     inactive page lists.

  - added a nodirplus option to address NFSv3 performance     issues with large directories.

  - changed the personality handling to disallow personality     changes of setuid and setgid binaries. This ensures they     keep any randomization and Exec-shield protection.

These new kernel packages contain fixes for the security issues described below :

  - a flaw in the ISDN CAPI subsystem that allowed a remote     user to cause a denial of service or potential remote     access. Exploitation would require the attacker to be     able to send arbitrary frames over the ISDN network to     the victim's machine. (CVE-2007-1217, Moderate)

  - a flaw in the perfmon subsystem on ia64 platforms that     allowed a local user to cause a denial of service.
    (CVE-2006-0558, Moderate)

In addition, the following bugs were addressed :

  - a panic after reloading of the LSI Fusion driver.

  - a vm performance problem was corrected by balancing     inactive page lists.

  - added a nodirplus option to address NFSv3 performance     issues with large directories.

  - changed the personality handling to disallow personality     changes of setuid and setgid binaries. This ensures they     keep any randomization and Exec-shield protection.

- a flaw in the ISDN CAPI subsystem that allowed a remote     user to cause a denial of service or potential privilege     escalation. (CVE-2007-1217, Moderate)

  - a flaw in the Bluetooth subsystem that allowed a local     user to trigger an information leak. (CVE-2007-1353,     Low)

In addition to the security issues described above, fixes for the following have been included :

  - a race condition in the e1000 network driver that could     cause ESB2 systems to be started without the RX unit     being turned on.

  - a related e1000 bug on ESB2 systems that could cause     rlogin to fail.

Updated kernel packages that fix various security issues in the Red Hat Enterprise Linux 5 kernel are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the following security issues :

* a flaw in the DRM driver for Intel graphics cards that allowed a local user to access any part of the main memory. To access the DRM functionality a user must have access to the X server which is granted through the graphical login. This also only affected systems with an Intel 965 or later graphic chipset. (CVE-2007-3851, Important)

* a flaw in the VFAT compat ioctl handling on 64-bit systems that allowed a local user to corrupt a kernel_dirent struct and cause a denial of service (system crash). (CVE-2007-2878, Important)

* a flaw in the connection tracking support for SCTP that allowed a remote user to cause a denial of service by dereferencing a NULL pointer. (CVE-2007-2876, Important)

* flaw in the CIFS filesystem which could cause the umask values of a process to not be honored. This affected CIFS filesystems where the Unix extensions are supported. (CVE-2007-3740, Important)

* a flaw in the stack expansion when using the hugetlb kernel on PowerPC systems that allowed a local user to cause a denial of service. (CVE-2007-3739, Moderate)

* a flaw in the ISDN CAPI subsystem that allowed a remote user to cause a denial of service or potential remote access. Exploitation would require the attacker to be able to send arbitrary frames over the ISDN network to the victim's machine. (CVE-2007-1217, Moderate)

* a flaw in the cpuset support that allowed a local user to obtain sensitive information from kernel memory. To exploit this the cpuset filesystem would have to already be mounted. (CVE-2007-2875, Moderate)

* a flaw in the CIFS handling of the mount option 'sec=' that didn't enable integrity checking and didn't produce any error message.
(CVE-2007-3843, Low)

Red Hat Enterprise Linux 5 users are advised to upgrade to these packages, which contain backported patches to correct these issues.

Updated kernel packages that fix several security issues and bugs in the Red Hat Enterprise Linux 4 kernel are now available.

This security advisory has been rated as having moderate security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the security issues described below :

* a flaw in the ISDN CAPI subsystem that allowed a remote user to cause a denial of service or potential remote access. Exploitation would require the attacker to be able to send arbitrary frames over the ISDN network to the victim's machine. (CVE-2007-1217, Moderate)

* a flaw in the perfmon subsystem on ia64 platforms that allowed a local user to cause a denial of service. (CVE-2006-0558, Moderate)

In addition, the following bugs were addressed :

* a panic after reloading of the LSI Fusion driver.

* a vm performance problem was corrected by balancing inactive page lists.

* added a nodirplus option to address NFSv3 performance issues with large directories.

* changed the personality handling to disallow personality changes of setuid and setgid binaries. This ensures they keep any randomization and Exec-shield protection.

All Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

Updated kernel packages that fix several security issues and bugs in the Red Hat Enterprise Linux 3 kernel are now available.

This security advisory has been rated as having moderate security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the security issues described below :

* a flaw in the ISDN CAPI subsystem that allowed a remote user to cause a denial of service or potential privilege escalation.
(CVE-2007-1217, Moderate)

* a flaw in the Bluetooth subsystem that allowed a local user to trigger an information leak. (CVE-2007-1353, Low)

In addition to the security issues described above, fixes for the following have been included :

* a race condition in the e1000 network driver that could cause ESB2 systems to be started without the RX unit being turned on.

* a related e1000 bug on ESB2 systems that could cause rlogin to fail.

Red Hat would like to thank Ilja van Sprundel for reporting an issue fixed in this erratum.

Note: The kernel-unsupported package contains various drivers and modules that are unsupported and therefore might contain security problems that have not been addressed.

All Red Hat Enterprise Linux 3 users are advised to upgrade their kernels to the packages associated with their machine architecture and configurations as listed in this erratum.

Updated kernel packages that fix a number of security issues are now available for Red Hat Enterprise Linux 2.1 (32-bit architectures).

This security advisory has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the security issues described below :

* a flaw in IPv6 flow label handling that allowed a local user to cause a denial of service (crash). (CVE-2007-1592, Important)

* a flaw in the ISDN CAPI subsystem that allowed a remote user to cause a denial of service or potential privilege escalation.
(CVE-2007-1217, Moderate)

* a flaw in the Bluetooth subsystem that allowed a local user to trigger an information leak. (CVE-2007-1353, Low)

* various flaws in the supported filesystems that allowed a local privileged user to cause a denial of service. (CVE-2006-6054, CVE-2006-6058, Low)

Red Hat would like to thank Ilja van Sprundel for reporting an issue fixed in this erratum.

All Red Hat Enterprise Linux 2.1 users are advised to upgrade their kernels to these updated packages, which contain backported fixes to correct these issues.

The remote host is affected by the vulnerability described in GLSA-200704-23 (capi4k-utils: Buffer overflow)

    The bufprint() function in capi4k-utils fails to properly check     boundaries of data coming from CAPI packets.
  Impact :

    A local attacker could possibly escalate privileges or cause a Denial     of Service by sending a crafted CAPI packet.
  Workaround :

    There is no known workaround at this time.

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel :

When SELinux hooks are enabled, the kernel could allow a local user to cause a DoS (crash) via a malformed file stream that triggers a NULL pointer derefernece (CVE-2006-6056).

Multiple buffer overflows in the (1) read and (2) write handlers in the Omnikey CardMan 4040 driver in the Linux kernel before 2.6.21-rc3 allow local users to gain privileges. (CVE-2007-0005)

The Linux kernel version 2.6.13 to 2.6.20.1 allowed a remote attacker to cause a DoS (oops) via a crafted NFSACL2 ACCESS request that triggered a free of an incorrect pointer (CVE-2007-0772).

A local user could read unreadable binaries by using the interpreter (PT_INTERP) functionality and triggering a core dump; a variant of CVE-2004-1073 (CVE-2007-0958).

The ipv6_getsockopt_sticky function in net/ipv6/ipv6_sockglue.c in the Linux kernel before 2.6.20.2 allows local users to read arbitrary kernel memory via certain getsockopt calls that trigger a NULL dereference. (CVE-2007-1000)

Buffer overflow in the bufprint function in capiutil.c in libcapi, as used in Linux kernel 2.6.9 to 2.6.20 and isdn4k-utils, allows local users to cause a denial of service (crash) and possibly gain privileges via a crafted CAPI packet. (CVE-2007-1217)

The do_ipv6_setsockopt function in net/ipv6/ipv6_sockglue.c in Linux kernel 2.6.17, and possibly other versions, allows local users to cause a denial of service (oops) by calling setsockopt with the IPV6_RTHDR option name and possibly a zero option length or invalid option value, which triggers a NULL pointer dereference.
(CVE-2007-1388)

net/ipv6/tcp_ipv6.c in Linux kernel 2.4 and 2.6.x up to 2.6.21-rc3 inadvertently copies the ipv6_fl_socklist from a listening TCP socket to child sockets, which allows local users to cause a denial of service (OOPS) or double-free by opening a listeing IPv6 socket, attaching a flow label, and connecting to that socket. (CVE-2007-1592)

The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels immediately and reboot to effect the fixes.

In addition to these security fixes, other fixes have been included such as :

  - Suspend to disk speed improvements

    - Add nmi watchdog support for core2

    - Add atl1 driver

    - Update KVM

    - Add acer_acpi

    - Update asus_acpi

    - Fix suspend on r8169, i8259A

    - Fix suspend when using ondemand governor

    - Add ide acpi support

    - Add suspend/resume support for sata_nv chipsets.

    - USB: Let USB-Serial option driver handle anydata       devices (#29066)

    - USB: Add PlayStation 2 Trance Vibrator driver

    - Fix bogus delay loop in video/aty/mach64_ct.c

    - Add MCP61 support (#29398)

    - USB: fix floppy drive SAMSUNG SFD-321U/EP detected 8       times bug

    - Improve keyboard handling on Apple MacBooks

    - Add -latest patch

    - Workaround a possible binutils bug in smp alternatives

    - Add forcedeth support

    - Fix potential deadlock in driver core (USB hangs at       boot time #24683)

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2007-0774.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2007-0705.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2007-0671.

ID	Name	Product	Family	Severity
67556	Oracle Linux 4 : kernel (ELSA-2007-0774)	Nessus	Oracle Linux Local Security Checks	medium
67543	Oracle Linux 5 : Important: / kernel (ELSA-2007-0705)	Nessus	Oracle Linux Local Security Checks	medium
67540	Oracle Linux 3 : kernel (ELSA-2007-0671)	Nessus	Oracle Linux Local Security Checks	medium
60247	Scientific Linux Security Update : kernel on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
60246	Scientific Linux Security Update : kernel on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
60241	Scientific Linux Security Update : kernel on SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
43648	CentOS 5 : kernel (CESA-2007:0705)	Nessus	CentOS Local Security Checks	medium
26050	RHEL 5 : kernel (RHSA-2007:0705)	Nessus	Red Hat Local Security Checks	medium
26003	CentOS 4 : kernel (CESA-2007:0774)	Nessus	CentOS Local Security Checks	medium
25985	RHEL 4 : kernel (RHSA-2007:0774)	Nessus	Red Hat Local Security Checks	medium
25924	RHEL 3 : kernel (RHSA-2007:0671)	Nessus	Red Hat Local Security Checks	medium
25908	CentOS 3 : kernel (CESA-2007:0671)	Nessus	CentOS Local Security Checks	medium
25876	RHEL 2.1 : kernel (RHSA-2007:0672)	Nessus	Red Hat Local Security Checks	medium
25111	GLSA-200704-23 : capi4k-utils: Buffer overflow	Nessus	Gentoo Local Security Checks	medium
24944	Mandrake Linux Security Advisory : kernel (MDKSA-2007:078)	Nessus	Mandriva Local Security Checks	high
801435	CentOS RHSA-2007-0774 Security Check	Log Correlation Engine	Generic	high
801434	CentOS RHSA-2007-0705 Security Check	Log Correlation Engine	Generic	high
801433	CentOS RHSA-2007-0671 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2007-1217

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

high

high

high