The nl_fib_lookup function in net/ipv4/fib_frontend.c in Linux Kernel before 2.6.20.8 allows attackers to cause a denial of service (kernel panic) via NETLINK_FIB_LOOKUP replies, which trigger infinite recursion and a stack overflow.

From Red Hat Security Advisory 2007:0347 :

Updated kernel packages that fix security issues and bugs in the Red Hat Enterprise Linux 5 kernel are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the following security issues :

* a flaw in the handling of IPv6 type 0 routing headers that allowed remote users to cause a denial of service that led to a network amplification between two routers (CVE-2007-2242, Important).

* a flaw in the nfnetlink_log netfilter module that allowed a local user to cause a denial of service (CVE-2007-1496, Important).

* a flaw in the flow list of listening IPv6 sockets that allowed a local user to cause a denial of service (CVE-2007-1592, Important).

* a flaw in the handling of netlink messages that allowed a local user to cause a denial of service (infinite recursion) (CVE-2007-1861, Important).

* a flaw in the IPv4 forwarding base that allowed a local user to cause an out-of-bounds access (CVE-2007-2172, Important).

* a flaw in the nf_conntrack netfilter module for IPv6 that allowed remote users to bypass certain netfilter rules using IPv6 fragments (CVE-2007-1497, Moderate).

In addition to the security issues described above, fixes for the following have been included :

* a regression in ipv6 routing.

* an error in memory initialization that caused gdb to output inaccurate backtraces on ia64.

* the nmi watchdog timeout was updated from 5 to 30 seconds.

* a flaw in distributed lock management that could result in errors during virtual machine migration.

* an omitted include in kernel-headers that led to compile failures for some packages.

Red Hat Enterprise Linux 5 users are advised to upgrade to these packages, which contain backported patches to correct these issues.

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

These new kernel packages contain fixes for the following security issues :

  - a flaw in the handling of IPv6 type 0 routing headers     that allowed remote users to cause a denial of service     that led to a network amplification between two routers     (CVE-2007-2242, Important).

  - a flaw in the nfnetlink_log netfilter module that     allowed a local user to cause a denial of service     (CVE-2007-1496, Important).

  - a flaw in the flow list of listening IPv6 sockets that     allowed a local user to cause a denial of service     (CVE-2007-1592, Important).

  - a flaw in the handling of netlink messages that allowed     a local user to cause a denial of service (infinite     recursion) (CVE-2007-1861, Important).

  - a flaw in the IPv4 forwarding base that allowed a local     user to cause an out-of-bounds access (CVE-2007-2172,     Important).

  - a flaw in the nf_conntrack netfilter module for IPv6     that allowed remote users to bypass certain netfilter     rules using IPv6 fragments (CVE-2007-1497, Moderate).

In addition to the security issues described above, fixes for the following have been included :

  - a regression in ipv6 routing.

  - an error in memory initialization that caused gdb to     output inaccurate backtraces on ia64.

  - the nmi watchdog timeout was updated from 5 to 30     seconds.

  - a flaw in distributed lock management that could result     in errors during virtual machine migration.

  - an omitted include in kernel-headers that led to compile     failures for some packages.

Updated kernel packages that fix security issues and bugs in the Red Hat Enterprise Linux 5 kernel are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the following security issues :

* a flaw in the handling of IPv6 type 0 routing headers that allowed remote users to cause a denial of service that led to a network amplification between two routers (CVE-2007-2242, Important).

* a flaw in the nfnetlink_log netfilter module that allowed a local user to cause a denial of service (CVE-2007-1496, Important).

* a flaw in the flow list of listening IPv6 sockets that allowed a local user to cause a denial of service (CVE-2007-1592, Important).

* a flaw in the handling of netlink messages that allowed a local user to cause a denial of service (infinite recursion) (CVE-2007-1861, Important).

* a flaw in the IPv4 forwarding base that allowed a local user to cause an out-of-bounds access (CVE-2007-2172, Important).

* a flaw in the nf_conntrack netfilter module for IPv6 that allowed remote users to bypass certain netfilter rules using IPv6 fragments (CVE-2007-1497, Moderate).

In addition to the security issues described above, fixes for the following have been included :

* a regression in ipv6 routing.

* an error in memory initialization that caused gdb to output inaccurate backtraces on ia64.

* the nmi watchdog timeout was updated from 5 to 30 seconds.

* a flaw in distributed lock management that could result in errors during virtual machine migration.

* an omitted include in kernel-headers that led to compile failures for some packages.

Red Hat Enterprise Linux 5 users are advised to upgrade to these packages, which contain backported patches to correct these issues.

A flaw was discovered in dvb ULE decapsulation. A remote attacker could send a specially crafted message and cause a denial of service.
(CVE-2006-4623)

The compat_sys_mount function allowed local users to cause a denial of service when mounting a smbfs filesystem in compatibility mode.
(CVE-2006-7203)

The Omnikey CardMan 4040 driver (cm4040_cs) did not limit the size of buffers passed to read() and write(). A local attacker could exploit this to execute arbitrary code with kernel privileges. (CVE-2007-0005)

Due to an variable handling flaw in the ipv6_getsockopt_sticky() function a local attacker could exploit the getsockopt() calls to read arbitrary kernel memory. This could disclose sensitive data.
(CVE-2007-1000)

Ilja van Sprundel discovered that Bluetooth setsockopt calls could leak kernel memory contents via an uninitialized stack buffer. A local attacker could exploit this flaw to view sensitive kernel information.
(CVE-2007-1353)

A flaw was discovered in the handling of netlink messages. Local attackers could cause infinite recursion leading to a denial of service. (CVE-2007-1861)

The random number generator was hashing a subset of the available entropy, leading to slightly less random numbers. Additionally, systems without an entropy source would be seeded with the same inputs at boot time, leading to a repeatable series of random numbers.
(CVE-2007-2453)

A flaw was discovered in the PPP over Ethernet implementation. Local attackers could manipulate ioctls and cause kernel memory consumption leading to a denial of service. (CVE-2007-2525)

An integer underflow was discovered in the cpuset filesystem. If mounted, local attackers could obtain kernel memory using large file offsets while reading the tasks file. This could disclose sensitive data. (CVE-2007-2875)

Vilmos Nebehaj discovered that the SCTP netfilter code did not correctly validate certain states. A remote attacker could send a specially crafted packet causing a denial of service. (CVE-2007-2876)

Luca Tettamanti discovered a flaw in the VFAT compat ioctls on 64-bit systems. A local attacker could corrupt a kernel_dirent struct and cause a denial of service. (CVE-2007-2878)

A flaw was discovered in the cluster manager. A remote attacker could connect to the DLM port and block further DLM operations.
(CVE-2007-3380)

A flaw was discovered in the usblcd driver. A local attacker could cause large amounts of kernel memory consumption, leading to a denial of service. (CVE-2007-3513).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The compat_sys_mount function allowed local users to cause a denial of service when mounting a smbfs filesystem in compatibility mode.
(CVE-2006-7203)

The Omnikey CardMan 4040 driver (cm4040_cs) did not limit the size of buffers passed to read() and write(). A local attacker could exploit this to execute arbitrary code with kernel privileges. (CVE-2007-0005)

Due to a variable handling flaw in the ipv6_getsockopt_sticky() function a local attacker could exploit the getsockopt() calls to read arbitrary kernel memory. This could disclose sensitive data.
(CVE-2007-1000)

Ilja van Sprundel discovered that Bluetooth setsockopt calls could leak kernel memory contents via an uninitialized stack buffer. A local attacker could exploit this flaw to view sensitive kernel information.
(CVE-2007-1353)

A flaw was discovered in the handling of netlink messages. Local attackers could cause infinite recursion leading to a denial of service. (CVE-2007-1861)

A flaw was discovered in the IPv6 stack's handling of type 0 route headers. By sending a specially crafted IPv6 packet, a remote attacker could cause a denial of service between two IPv6 hosts.
(CVE-2007-2242)

The random number generator was hashing a subset of the available entropy, leading to slightly less random numbers. Additionally, systems without an entropy source would be seeded with the same inputs at boot time, leading to a repeatable series of random numbers.
(CVE-2007-2453)

A flaw was discovered in the PPP over Ethernet implementation. Local attackers could manipulate ioctls and cause kernel memory consumption leading to a denial of service. (CVE-2007-2525)

An integer underflow was discovered in the cpuset filesystem. If mounted, local attackers could obtain kernel memory using large file offsets while reading the tasks file. This could disclose sensitive data. (CVE-2007-2875)

Vilmos Nebehaj discovered that the SCTP netfilter code did not correctly validate certain states. A remote attacker could send a specially crafted packet causing a denial of service. (CVE-2007-2876)

Luca Tettamanti discovered a flaw in the VFAT compat ioctls on 64-bit systems. A local attacker could corrupt a kernel_dirent struct and cause a denial of service. (CVE-2007-2878).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This kernel update fixes the following security problems :

  - CVE-2007-1861: The nl_fib_lookup function in     net/ipv4/fib_frontend.c allows attackers to cause a     denial of service (kernel panic) via NETLINK_FIB_LOOKUP     replies, which trigger infinite recursion and a stack     overflow.

  - CVE-2007-1496: nfnetlink_log in netfilter allows     attackers to cause a denial of service (crash) via     unspecified vectors involving the (1) nfulnl_recv_config     function, (2) using 'multiple packets per netlink     message', and (3) bridged packets, which trigger a NULL     pointer dereference.

  - CVE-2007-1497: nf_conntrack in netfilter does not set     nfctinfo during reassembly of fragmented packets, which     leaves the default value as IP_CT_ESTABLISHED and might     allow remote attackers to bypass certain rulesets using     IPv6 fragments.

    Please note that the connection tracking option for IPv6     is not enabled in any currently shipping SUSE Linux     kernel, so it does not affect SUSE Linux default     kernels.

  - CVE-2007-2242: The IPv6 protocol allows remote attackers     to cause a denial of service via crafted IPv6 type 0     route headers (IPV6_RTHDR_TYPE_0) that create network     amplification between two routers.

    The behaviour has been disabled by default, and the     patch introduces a new sysctl with which the     administrator can reenable it again.

  - CVE-2006-7203: The compat_sys_mount function in     fs/compat.c allows local users to cause a denial of     service (NULL pointer dereference and oops) by mounting     a smbfs file system in compatibility mode ('mount -t     smbfs').

  - CVE-2007-2453: Seeding of the kernel random generator on     boot did not work correctly due to a programming mistake     and so the kernel might have more predictable random     numbers than assured.

  - CVE-2007-2876: A NULL pointer dereference in SCTP     connection tracking could be caused by a remote attacker     by sending specially crafted packets. Note that this     requires SCTP set-up and active to be exploitable.

and the following non security bugs :

    - patches.fixes/cpufreq_fix_limited_on_battery.patch:
      Fix limited freq when booted on battery. [#231107]

    - patches.fixes/usb-keyspan-regression-fix.patch: USB:
      keyspan regression fix [#240919]

  - -     patches.fixes/hpt366-dont-check-enablebits-for-hpt36x.pa     tch: hpt366: don't check enablebits for HPT36x [#278696]

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel :

The Linux kernel did not properly save or restore EFLAGS during a context switch, or reset the flags when creating new threads, which allowed local users to cause a denial of service (process crash) (CVE-2006-5755).

The compat_sys_mount function in fs/compat.c allowed local users to cause a denial of service (NULL pointer dereference and oops) by mounting a smbfs file system in compatibility mode (CVE-2006-7203).

The nfnetlink_log function in netfilter allowed an attacker to cause a denial of service (crash) via unspecified vectors which would trigger a NULL pointer dereference (CVE-2007-1496).

The nf_conntrack function in netfilter did not set nfctinfo during reassembly of fragmented packets, which left the default value as IP_CT_ESTABLISHED and could allow remote attackers to bypass certain rulesets using IPv6 fragments (CVE-2007-1497).

The netlink functionality did not properly handle NETLINK_FIB_LOOKUP replies, which allowed a remote attacker to cause a denial of service (resource consumption) via unspecified vectors, probably related to infinite recursion (CVE-2007-1861).

A typo in the Linux kernel caused RTA_MAX to be used as an array size instead of RTN_MAX, which lead to an out of bounds access by certain functions (CVE-2007-2172).

The IPv6 protocol allowed remote attackers to cause a denial of service via crafted IPv6 type 0 route headers that create network amplification between two routers (CVE-2007-2242).

The random number feature did not properly seed pools when there was no entropy, or used an incorrect cast when extracting entropy, which could cause the random number generator to provide the same values after reboots on systems without an entropy source (CVE-2007-2453).

A memory leak in the PPPoE socket implementation allowed local users to cause a denial of service (memory consumption) by creating a socket using connect, and releasing it before the PPPIOCGCHAN ioctl is initialized (CVE-2007-2525).

An integer underflow in the cpuset_tasks_read function, when the cpuset filesystem is mounted, allowed local users to obtain kernel memory contents by using a large offset when reading the /dev/cpuset/tasks file (CVE-2007-2875).

The sctp_new function in netfilter allowed remote attackers to cause a denial of service by causing certain invalid states that triggered a NULL pointer dereference (CVE-2007-2876).

In addition to these security fixes, other fixes have been included such as :

  - Fix crash on netfilter when nfnetlink_log is used on     certain hooks on packets forwarded to or from a bridge

  - Fixed busy sleep on IPVS which caused high load averages

    - Fixed possible race condition on ext[34]_link

    - Fixed missing braces in condition block that led to       wrong behaviour in NFS

  - Fixed XFS lock deallocation that resulted in oops when     unmounting

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-1496     Michal Miroslaw reported a DoS vulnerability (crash) in     netfilter. A remote attacker can cause a NULL pointer     dereference in the nfnetlink_log function.

  - CVE-2007-1497     Patrick McHardy reported an vulnerability in netfilter     that may allow attackers to bypass certain firewall     rules. The nfctinfo value of reassembled IPv6 packet     fragments were incorrectly initialized to 0 which     allowed these packets to become tracked as ESTABLISHED.

  - CVE-2007-1861     Jaco Kroon reported a bug in which NETLINK_FIB_LOOKUP     packages were incorrectly routed back to the kernel     resulting in an infinite recursion condition. Local     users can exploit this behavior to cause a DoS (crash).

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2007-0347.

ID	Name	Product	Family	Severity
67495	Oracle Linux 5 : kernel (ELSA-2007-0347)	Nessus	Oracle Linux Local Security Checks	high
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	critical
60181	Scientific Linux Security Update : kernel on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
43641	CentOS 5 : kernel (CESA-2007:0347)	Nessus	CentOS Local Security Checks	high
28090	Ubuntu 6.06 LTS : linux-source-2.6.15 vulnerability (USN-489-1)	Nessus	Ubuntu Local Security Checks	high
28087	Ubuntu 6.10 : linux-source-2.6.17 vulnerabilities (USN-486-1)	Nessus	Ubuntu Local Security Checks	high
27295	openSUSE 10 Security Update : kernel (kernel-3760)	Nessus	SuSE Local Security Checks	high
25968	Mandrake Linux Security Advisory : kernel (MDKSA-2007:171)	Nessus	Mandriva Local Security Checks	high
25333	RHEL 5 : kernel (RHSA-2007:0347)	Nessus	Red Hat Local Security Checks	high
25226	Debian DSA-1289-1 : linux-2.6 - several vulnerabilities	Nessus	Debian Local Security Checks	medium
801427	CentOS RHSA-2007-0347 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2007-1861

medium

Tenable Plugins

high

critical

high

high

high

high

high

high

high

medium

high