The Distributed Lock Manager (DLM) in the cluster manager for Linux kernel 2.6.15 allows remote attackers to cause a denial of service (loss of lock services) by connecting to the DLM port, which probably prevents other processes from accessing the service.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-0940 advisory.

    [2.6.18-8.1.15.0.1.el5]
     - Fix bonding primary=ethX (Bert Barbe) [IT 101532] [ORA 5136660]
     - Add entropy module option to e1000/bnx2 (John Sobecki) [ORA 6045759]

     [2.6.18-8.1.15.el5]
     - [dlm] A TCP connection to DLM port blocks DLM operations (Patrick      Caulfield ) [245922] {CVE-2007-3380}
     - [ppc] 4k page mapping support for userspace in 64k kernels (Scott      Moser ) [275841] {CVE-2007-3850}
     - [ptrace] NULL pointer dereference triggered by ptrace (Anton Arapov )      [275981] {CVE-2007-3731}
     - [fs] hugetlb: fix prio_tree unit (Konrad Rzeszutek ) [253929]      {CVE-2007-4133}
     - [x86_64] Don't leak NT bit into next task (Dave Anderson ) [298151]      {CVE-2007-4574}
     - [fs] Reset current->pdeath_signal on SUID binary execution (Peter      Zijlstra ) [252307] {CVE-2007-3848}
     - [misc] Bounds check ordering issue in random driver (Anton Arapov )      [275961] {CVE-2007-3105}
     - [usb] usblcd: Locally triggerable memory consumption (Anton Arapov )      [276001] {CVE-2007-3513}
     - [net] igmp: check for NULL when allocating GFP_ATOMIC skbs (Neil      Horman ) [303281]
     - [scsi] aacraid: Missing ioctl() permission checks (Vitaly Mayatskikh )      [298371] {CVE-2007-4308}
     - [xen] Guest access to MSR may cause system crash/data corruption      (Bhavana Nagendra ) [253312] {CVE-2007-3733}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

These new kernel packages contain fixes for the following security issues :

  - A flaw was found in the backported stack unwinder fixes     in Red Hat Enterprise Linux 5. On AMD64 and Intel 64     platforms, a local user could trigger this flaw and     cause a denial of service. (CVE-2007-4574, Important)

  - A flaw was found in the handling of process death     signals. This allowed a local user to send arbitrary     signals to the suid-process executed by that user. A     successful exploitation of this flaw depends on the     structure of the suid-program and its signal handling.
    (CVE-2007-3848, Important)

  - A flaw was found in the Distributed Lock Manager (DLM)     in the cluster manager. This allowed a remote user who     is able to connect to the DLM port to cause a denial of     service. (CVE-2007-3380, Important)

  - A flaw was found in the aacraid SCSI driver. This     allowed a local user to make ioctl calls to the driver     which should otherwise be restricted to privileged     users. (CVE-2007-4308, Moderate)

  - A flaw was found in the prio_tree handling of the     hugetlb support that allowed a local user to cause a     denial of service. This only affected kernels with     hugetlb support. (CVE-2007-4133, Moderate)

  - A flaw was found in the eHCA driver on PowerPC     architectures that allowed a local user to access 60k of     physical address space. This address space could contain     sensitive information. (CVE-2007-3850, Moderate)

  - A flaw was found in ptrace support that allowed a local     user to cause a denial of service via a NULL pointer     dereference. (CVE-2007-3731, Moderate)

  - A flaw was found in the usblcd driver that allowed a     local user to cause a denial of service by writing data     to the device node. To exploit this issue, write access     to the device node was needed. (CVE-2007-3513, Moderate)

  - A flaw was found in the random number generator     implementation that allowed a local user to cause a     denial of service or possibly gain privileges. If the     root user raised the default wakeup threshold over the     size of the output pool, this flaw could be exploited.
    (CVE-2007-3105, Low)

In addition to the security issues described above, several bug fixes preventing possible system crashes and data corruption were also included.

Updated kernel packages that fix various security issues in the Red Hat Enterprise Linux 5 kernel are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the following security issues :

* A flaw was found in the backported stack unwinder fixes in Red Hat Enterprise Linux 5. On AMD64 and Intel 64 platforms, a local user could trigger this flaw and cause a denial of service. (CVE-2007-4574, Important)

* A flaw was found in the handling of process death signals. This allowed a local user to send arbitrary signals to the suid-process executed by that user. A successful exploitation of this flaw depends on the structure of the suid-program and its signal handling.
(CVE-2007-3848, Important)

* A flaw was found in the Distributed Lock Manager (DLM) in the cluster manager. This allowed a remote user who is able to connect to the DLM port to cause a denial of service. (CVE-2007-3380, Important)

* A flaw was found in the aacraid SCSI driver. This allowed a local user to make ioctl calls to the driver which should otherwise be restricted to privileged users. (CVE-2007-4308, Moderate)

* A flaw was found in the prio_tree handling of the hugetlb support that allowed a local user to cause a denial of service. This only affected kernels with hugetlb support. (CVE-2007-4133, Moderate)

* A flaw was found in the eHCA driver on PowerPC architectures that allowed a local user to access 60k of physical address space. This address space could contain sensitive information. (CVE-2007-3850, Moderate)

* A flaw was found in ptrace support that allowed a local user to cause a denial of service via a NULL pointer dereference.
(CVE-2007-3731, Moderate)

* A flaw was found in the usblcd driver that allowed a local user to cause a denial of service by writing data to the device node. To exploit this issue, write access to the device node was needed.
(CVE-2007-3513, Moderate)

* A flaw was found in the random number generator implementation that allowed a local user to cause a denial of service or possibly gain privileges. If the root user raised the default wakeup threshold over the size of the output pool, this flaw could be exploited.
(CVE-2007-3105, Low)

In addition to the security issues described above, several bug fixes preventing possible system crashes and data corruption were also included.

Red Hat Enterprise Linux 5 users are advised to upgrade to these packages, which contain backported patches to resolve these issues.

USN-489-1 fixed vulnerabilities in the Linux kernel. This update provides the corresponding fixes for the redhat cluster suite kernel sources.

A flaw was discovered in the cluster manager. A remote attacker could connect to the DLM port and block further DLM operations.
(CVE-2007-3380).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was discovered in dvb ULE decapsulation. A remote attacker could send a specially crafted message and cause a denial of service.
(CVE-2006-4623)

The compat_sys_mount function allowed local users to cause a denial of service when mounting a smbfs filesystem in compatibility mode.
(CVE-2006-7203)

The Omnikey CardMan 4040 driver (cm4040_cs) did not limit the size of buffers passed to read() and write(). A local attacker could exploit this to execute arbitrary code with kernel privileges. (CVE-2007-0005)

Due to an variable handling flaw in the ipv6_getsockopt_sticky() function a local attacker could exploit the getsockopt() calls to read arbitrary kernel memory. This could disclose sensitive data.
(CVE-2007-1000)

Ilja van Sprundel discovered that Bluetooth setsockopt calls could leak kernel memory contents via an uninitialized stack buffer. A local attacker could exploit this flaw to view sensitive kernel information.
(CVE-2007-1353)

A flaw was discovered in the handling of netlink messages. Local attackers could cause infinite recursion leading to a denial of service. (CVE-2007-1861)

The random number generator was hashing a subset of the available entropy, leading to slightly less random numbers. Additionally, systems without an entropy source would be seeded with the same inputs at boot time, leading to a repeatable series of random numbers.
(CVE-2007-2453)

A flaw was discovered in the PPP over Ethernet implementation. Local attackers could manipulate ioctls and cause kernel memory consumption leading to a denial of service. (CVE-2007-2525)

An integer underflow was discovered in the cpuset filesystem. If mounted, local attackers could obtain kernel memory using large file offsets while reading the tasks file. This could disclose sensitive data. (CVE-2007-2875)

Vilmos Nebehaj discovered that the SCTP netfilter code did not correctly validate certain states. A remote attacker could send a specially crafted packet causing a denial of service. (CVE-2007-2876)

Luca Tettamanti discovered a flaw in the VFAT compat ioctls on 64-bit systems. A local attacker could corrupt a kernel_dirent struct and cause a denial of service. (CVE-2007-2878)

A flaw was discovered in the cluster manager. A remote attacker could connect to the DLM port and block further DLM operations.
(CVE-2007-3380)

A flaw was discovered in the usblcd driver. A local attacker could cause large amounts of kernel memory consumption, leading to a denial of service. (CVE-2007-3513).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2007-0940.

ID	Name	Product	Family	Severity
67581	Oracle Linux 5 : Important:kernel (ELSA-2007-0940)	Nessus	Oracle Linux Local Security Checks	medium
60272	Scientific Linux Security Update : kernel on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
43654	CentOS 5 : kernel (CESA-2007:0940)	Nessus	CentOS Local Security Checks	medium
28091	Ubuntu 6.06 LTS : redhat-cluster-suite vulnerability (USN-489-2)	Nessus	Ubuntu Local Security Checks	medium
28090	Ubuntu 6.06 LTS : linux-source-2.6.15 vulnerability (USN-489-1)	Nessus	Ubuntu Local Security Checks	high
27565	RHEL 5 : kernel (RHSA-2007:0940)	Nessus	Red Hat Local Security Checks	medium
801440	CentOS RHSA-2007-0940 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2007-3380

high

Tenable Plugins

medium

medium

medium

medium

high

medium

high