The atalk_sum_skb function in AppleTalk for Linux kernel 2.6.x before 2.6.21, and possibly 2.4.x, allows remote attackers to cause a denial of service (crash) via an AppleTalk frame that is shorter than the specified length, which triggers a BUG_ON call when an attempt is made to perform a checksum.

Philipp Richter discovered that the AppleTalk protocol handler did not sufficiently verify the length of packets. By sending a crafted AppleTalk packet, a remote attacker could exploit this to crash the kernel. (CVE-2007-1357)

Gabriel Campana discovered that the do_ipv6_setsockopt() function did not sufficiently verifiy option values for IPV6_RTHDR. A local attacker could exploit this to trigger a kernel crash. (CVE-2007-1388)

A Denial of Service vulnerability was discovered in the nfnetlink_log() netfilter function. A remote attacker could exploit this to trigger a kernel crash. (CVE-2007-1496)

The connection tracking module for IPv6 did not properly handle the status field when reassembling fragmented packets, so that the final packet always had the 'established' state. A remote attacker could exploit this to bypass intended firewall rules. (CVE-2007-1497)

Masayuki Nakagawa discovered an error in the flowlabel handling of IPv6 network sockets. A local attacker could exploit this to crash the kernel. (CVE-2007-1592)

The do_dccp_getsockopt() function did not sufficiently verify the optlen argument. A local attacker could exploit this to read kernel memory (which might expose sensitive data) or cause a kernel crash.
This only affects Ubuntu 7.04. (CVE-2007-1730)

The IPv4 and DECnet network protocol handlers incorrectly declared an array variable so that it became smaller than intended. By sending crafted packets over a netlink socket, a local attacker could exploit this to crash the kernel. (CVE-2007-2172).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This kernel update fixes the following security problems :

  - CVE-2007-1000 A NULL pointer dereference in the IPv6     sockopt handling can be used by local attackers to read     arbitrary kernel memory and so gain access to private     information.

  - CVE-2007-1388 A NULL pointer dereference could be used     by local attackers to cause a Oops / crash of the     machine.

  - CVE-2007-1592 A possible double free in the     ipv6/flowlabel handling was fixed.

  - CVE-2007-1357 A remote denial of service attack in the     AppleTalk protocol handler was fixed. This attack is     only possible on the local subnet, and requires the     AppleTalk protocol module to be loaded (which is not     done by default).

and the following non security bugs :

  - patches.fixes/visor_write_race.patch: fix race allowing     overstepping memory limit in visor_write (Mainline:
    2.6.21)

  - patches.drivers/libata-ide-via-add-PCI-IDs:
    via82cxxx/pata_via: backport PCI IDs (254158).

  - libata: implement HDIO_GET_IDENTITY (255413).

  - sata_sil24: Add Adaptec 1220SA PCI ID. (Mainline:
    2.6.21)

  - ide: backport hpt366 from devel tree (244502).

  - mm: fix madvise infinine loop (248167).

  - libata: hardreset on SERR_INTERNAL (241334).

  - limited WPA support for prism54 (207944)

  - jmicron: match class instead of function number (224784,     207707)

  - ahci: RAID mode SATA patch for Intel ICH9M (Mainline:
    2.6.21)

  - libata: blacklist FUJITSU MHT2060BH for NCQ (Mainline:
    2.6.21)

  - libata: add missing PM callbacks. (Mainline: 2.6.20)

  - patches.fixes/nfs-readdir-timestamp: Set meaningful     value for fattr->time_start in readdirplus results.
    (244967).

  - patches.fixes/usb_volito.patch: wacom volito tablet not     working (#248832).

  - patches.fixes/965-fix: fix detection of aperture size     versus GTT size on G965 (#258013).

  - patches.fixes/sbp2-MODE_SENSE-fix.diff: use proper MODE     SENSE, fixes recognition of device properties (261086)

  - patches.fixes/ipt_CLUSTERIP_refcnt_fix:
    ipv4/netfilter/ipt_CLUSTERIP.c - refcnt fix (238646)

  - patches.fixes/reiserfs-fix-vs-13060.diff: reiserfs: fix     corruption with vs-13060 (257735).

  - patches.drivers/ati-rs400_200-480-disable-msi:
    pci-quirks: disable MSI on RS400-200 and RS480 (263893).

  - patches.drivers/libata-ahci-ignore-interr-on-SB600:
    ahci.c: walkaround for SB600 SATA internal error issue     (#264792).

Furthermore, CONFIG_USB_DEVICEFS has been re-enabled to allow use of USB in legacy applications like VMware. (#210899).

CVE-2006-6060 CVE-2006-6106 CVE-2006-6535 CVE-2007-0958 CVE-2007-1357  CVE-2007-1592

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. 

This update also fixes a regression in the smbfs subsystem which was introduced in DSA-1233which caused symlinks to be interpreted as regular files.

The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2005-4811     David Gibson reported an issue in the hugepage code     which could permit a local DoS (system crash) on     appropriately configured systems.

  - CVE-2006-4814     Doug Chapman discovered a potential local DoS (deadlock)     in the mincore function caused by improper lock     handling.

  - CVE-2006-4623     Ang Way Chuang reported a remote DoS (crash) in the dvb     driver which can be triggered by a ULE package with an     SNDU length of 0.

  - CVE-2006-5753     Eric Sandeen provided a fix for a local memory     corruption vulnerability resulting from a     misinterpretation of return values when operating on     inodes which have been marked bad.

  - CVE-2006-5754     Darrick Wong discovered a local DoS (crash)     vulnerability resulting from the incorrect     initialization of 'nr_pages' in aio_setup_ring().

  - CVE-2006-5757     LMH reported a potential local DoS which could be     exploited by a malicious user with the privileges to     mount and read a corrupted iso9660 filesystem.

  - CVE-2006-6053     LMH reported a potential local DoS which could be     exploited by a malicious user with the privileges to     mount and read a corrupted ext3 filesystem.

  - CVE-2006-6056     LMH reported a potential local DoS which could be     exploited by a malicious user with the privileges to     mount and read a corrupted hfs filesystem on systems     with SELinux hooks enabled (Debian does not enable     SELinux by default).

  - CVE-2006-6060     LMH reported a potential local DoS (infinite loop) which     could be exploited by a malicious user with the     privileges to mount and read a corrupted NTFS     filesystem.

  - CVE-2006-6106     Marcel Holtman discovered multiple buffer overflows in     the Bluetooth subsystem which can be used to trigger a     remote DoS (crash) and potentially execute arbitrary     code.

  - CVE-2006-6535     Kostantin Khorenko discovered an invalid error path in     dev_queue_xmit() which could be exploited by a local     user to cause data corruption.

  - CVE-2007-0958     Santosh Eraniose reported a vulnerability that allows     local users to read otherwise unreadable files by     triggering a core dump while using PT_INTERP. This is     related to CVE-2004-1073.

  - CVE-2007-1357     Jean Delvare reported a vulnerability in the appletalk     subsystem. Systems with the appletalk module loaded can     be triggered to crash by other systems on the local     network via a malformed frame.

  - CVE-2007-1592     Masayuki Nakagawa discovered that flow labels were     inadvertently being shared between listening sockets and     child sockets. This defect can be exploited by local     users to cause a DoS (Oops).

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-0005     Daniel Roethlisberger discovered two buffer overflows in     the cm4040 driver for the Omnikey CardMan 4040 device. A     local user or malicious device could exploit this to     execute arbitrary code in kernel space.

  - CVE-2007-0958     Santosh Eraniose reported a vulnerability that allows     local users to read otherwise unreadable files by     triggering a core dump while using PT_INTERP. This is     related to CVE-2004-1073.

  - CVE-2007-1357     Jean Delvare reported a vulnerability in the appletalk     subsystem. Systems with the appletalk module loaded can     be triggered to crash by other systems on the local     network via a malformed frame.

  - CVE-2007-1592     Masayuki Nakagawa discovered that flow labels were     inadvertently being shared between listening sockets and     child sockets. This defect can be exploited by local     users to cause a DoS (Oops).

ID	Name	Product	Family	Severity
28064	Ubuntu 6.06 LTS / 6.10 / 7.04 : linux-source-2.6.15/2.6.17/2.6.20 vulnerabilities (USN-464-1)	Nessus	Ubuntu Local Security Checks	high
27294	openSUSE 10 Security Update : kernel (kernel-3128)	Nessus	SuSE Local Security Checks	high
25529	Debian DSA-1304-1 : kernel-source-2.6.8 - several vulnerabilities	Nessus	Debian Local Security Checks	high
25153	Debian DSA-1286-1 : linux-2.6 - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2007-1357

high

Tenable Plugins

high

high

high

high