The asn1 implementation in (a) the Linux kernel 2.4 before 2.4.36.6 and 2.6 before 2.6.25.5, as used in the cifs and ip_nat_snmp_basic modules; and (b) the gxsnmp package; does not properly validate length values during decoding of ASN.1 BER data, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) a length greater than the working buffer, which can lead to an unspecified overflow; (2) an oid length of zero, which can lead to an off-by-one error; or (3) an indefinite length for a primitive encoding.

This update of the SUSE Linux Enterprise 10 Service Pack 1 kernel contains lots of bugfixes and several security fixes :

  - Added missing capability checks in sbni_ioctl().
    (CVE-2008-3525)

  - On AMD64 some string operations could leak kernel     information into userspace. (CVE-2008-0598)

  - Added range checking in ASN.1 handling for the CIFS and     SNMP NAT netfilter modules. (CVE-2008-1673)

  - Fixed range checking in the snd_seq OSS ioctl, which     could be used to leak information from the kernel.
    (CVE-2008-3272)

  - Fixed a memory leak when looking up deleted directories     which could be used to run the system out of memory.
    (CVE-2008-3275)

  - The do_change_type function in fs/namespace.c did not     verify that the caller has the CAP_SYS_ADMIN capability,     which allows local users to gain privileges or cause a     denial of service by modifying the properties of a     mountpoint. (CVE-2008-2931)

  - Various NULL ptr checks have been added to the tty ops     functions, which might have been used by local attackers     to execute code. We think that this affects only devices     openable by root, so the impact is limited.
    (CVE-2008-2812)

This kernel security update fixes lots of bugs and some

This is a respin of the previous kernel update, which got retracted due to an IDE-CDROM regression, where any IDE CDROM access would hang or crash the system. Only this problem was fixed additionally.

This kernel update fixes the following security problems :

  - On x86_64 a denial of service attack could be used by     local attackers to immediately panic / crash the     machine. (CVE-2008-1615)

  - Fixed a SMP ordering problem in fcntl_setlk could     potentially allow local attackers to execute code by     timing file locking. (CVE-2008-1669)

  - Fixed a resource starvation problem in the handling of     ZERO mmap pages. (CVE-2008-2372)

  - The asn1 implementation in (a) the Linux kernel, as used     in the cifs and ip_nat_snmp_basic modules does not     properly validate length values during decoding of ASN.1     BER data, which allows remote attackers to cause a     denial of service (crash) or execute arbitrary code via     (1) a length greater than the working buffer, which can     lead to an unspecified overflow; (2) an oid length of     zero, which can lead to an off-by-one error; or (3) an     indefinite length for a primitive encoding.
    (CVE-2008-1673)

  - Various tty / serial devices did not check     functionpointers for NULL before calling them, leading     to potential crashes or code execution. The devices     affected are usually only accessible by the root user     though. (CVE-2008-2812)

  - A missing permission check in mount changing was added     which could have been used by local attackers to change     the mountdirectory. (CVE-2008-2931)

Additionally a very large number of bugs was fixed. Details can be found in the RPM changelog of the included packages.

OCFS2 has been upgraded to the 1.4.1 release :

  - Endian fixes

  - Use slab caches for DLM objects

  - Export DLM state info to debugfs

  - Avoid ENOSPC in rare conditions when free inodes are     reserved by other nodes

  - Error handling fix in ocfs2_start_walk_page_trans()

  - Cleanup lockres printing

  - Allow merging of extents

  - Fix to allow changing permissions of symlinks

  - Merged local fixes upstream (no code change)

The openSUSE 11.0 kernel was updated to 2.6.25.16.

It fixes various stability bugs and also security bugs.

CVE-2008-1673: Fixed the range checking in the ASN.1 decoder in NAT for SNMP and CIFS, which could have been used by a remote attacker to crash the machine.

CVE-2008-3276: An integer overflow flaw was found in the Linux kernel dccp_setsockopt_change() function. An attacker may leverage this vulnerability to trigger a kernel panic on a victim's machine remotely.

CVE-2008-3272: The snd_seq_oss_synth_make_info function in sound/core/seq/oss/seq_oss_synth.c in the sound subsystem does not verify that the device number is within the range defined by max_synthdev before returning certain data to the caller, which allows local users to obtain sensitive information.

CVE-2008-3275: The (1) real_lookup and (2) __lookup_hash functions in fs/namei.c in the vfs implementation do not prevent creation of a child dentry for a deleted (aka S_DEAD) directory, which allows local users to cause a denial of service ('overflow' of the UBIFS orphan area) via a series of attempted file creations within deleted directories.

Also lots of bugs were fixed.

A vulnerability was discovered and corrected in the Linux 2.6 kernel :

The asn1 implementation in (a) the Linux kernel 2.4 before 2.4.36.6 and 2.6 before 2.6.25.5, as used in the cifs and ip_nat_snmp_basic modules; and (b) the gxsnmp package; does not properly validate length values during decoding of ASN.1 BER data, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) a length greater than the working buffer, which can lead to an unspecified overflow; (2) an oid length of zero, which can lead to an off-by-one error; or (3) an indefinite length for a primitive encoding.

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

This kernel update fixes various bugs and also several security issues :

CVE-2008-4576: Fixed a crash in SCTP INIT-ACK, on mismatch between SCTP AUTH availability. This might be exploited remotely for a denial of service (crash) attack.

CVE-2008-3833: The generic_file_splice_write function in fs/splice.c in the Linux kernel does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by splicing into an inode in order to create an executable file in a setgid directory.

CVE-2008-4210: fs/open.c in the Linux kernel before 2.6.22 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by creating an executable file in a setgid directory through the (1) truncate or (2) ftruncate function in conjunction with memory-mapped I/O.

CVE-2008-4302: fs/splice.c in the splice subsystem in the Linux kernel before 2.6.22.2 does not properly handle a failure of the add_to_page_cache_lru function, and subsequently attempts to unlock a page that was not locked, which allows local users to cause a denial of service (kernel BUG and system crash), as demonstrated by the fio I/O tool.

CVE-2008-3528: The ext[234] filesystem code fails to properly handle corrupted data structures. With a mounted filesystem image or partition that have corrupted dir->i_size and dir->i_blocks, a user performing either a read or write operation on the mounted image or partition can lead to a possible denial of service by spamming the logfile.

CVE-2007-6716: fs/direct-io.c in the dio subsystem in the Linux kernel did not properly zero out the dio struct, which allows local users to cause a denial of service (OOPS), as demonstrated by a certain fio test.

CVE-2008-3525: Added missing capability checks in sbni_ioctl().

CVE-2008-3272: Fixed range checking in the snd_seq OSS ioctl, which could be used to leak information from the kernel.

CVE-2008-2931: The do_change_type function in fs/namespace.c did not verify that the caller has the CAP_SYS_ADMIN capability, which allows local users to gain privileges or cause a denial of service by modifying the properties of a mountpoint.

CVE-2008-2812: Various NULL ptr checks have been added to tty op functions, which might have been used by local attackers to execute code. We think that this affects only devices openable by root, so the impact is limited.

CVE-2008-1673: Added range checking in ASN.1 handling for the CIFS and SNMP NAT netfilter modules.

CVE-2008-3527: arch/i386/kernel/sysenter.c in the Virtual Dynamic Shared Objects (vDSO) implementation in the Linux kernel before 2.6.21 did not properly check boundaries, which allows local users to gain privileges or cause a denial of service via unspecified vectors, related to the install_special_mapping, syscall, and syscall32_nopage functions.

The openSUSE 10.3 kernel was update to 2.6.22.19. This includes bugs and security fixes.

CVE-2008-4576: Fixed a crash in SCTP INIT-ACK, on mismatch between SCTP AUTH availability. This might be exploited remotely for a denial of service (crash) attack.

CVE-2008-3528: The ext[234] filesystem code fails to properly handle corrupted data structures. With a mounted filesystem image or partition that have corrupted dir->i_size and dir->i_blocks, a user performing either a read or write operation on the mounted image or partition can lead to a possible denial of service by spamming the logfile.

CVE-2007-6716: fs/direct-io.c in the dio subsystem in the Linux kernel did not properly zero out the dio struct, which allows local users to cause a denial of service (OOPS), as demonstrated by a certain fio test.

CVE-2008-3525: Added missing capability checks in sbni_ioctl().

CVE-2008-3272: Fixed range checking in the snd_seq OSS ioctl, which could be used to leak information from the kernel.

CVE-2008-3276: An integer overflow flaw was found in the Linux kernel dccp_setsockopt_change() function. An attacker may leverage this vulnerability to trigger a kernel panic on a victim's machine remotely.

CVE-2008-1673: Added range checking in ASN.1 handling for the CIFS and SNMP NAT netfilter modules.

CVE-2008-2826: A integer overflow in SCTP was fixed, which might have been used by remote attackers to crash the machine or potentially execute code.

CVE-2008-2812: Various NULL ptr checks have been added to tty op functions, which might have been used by local attackers to execute code. We think that this affects only devices openable by root, so the impact is limited.

This update of the SUSE Linux Enterprise 10 Service Pack 1 kernel contains lots of bugfixes and several security fixes :

  - Added missing capability checks in sbni_ioctl().
    (CVE-2008-3525)

  - On AMD64 some string operations could leak kernel     information into userspace. (CVE-2008-0598)

  - Added range checking in ASN.1 handling for the CIFS and     SNMP NAT netfilter modules. (CVE-2008-1673)

  - Fixed range checking in the snd_seq OSS ioctl, which     could be used to leak information from the kernel.
    (CVE-2008-3272)

  - Fixed a memory leak when looking up deleted directories     which could be used to run the system out of memory.
    (CVE-2008-3275)

  - The do_change_type function in fs/namespace.c did not     verify that the caller has the CAP_SYS_ADMIN capability,     which allows local users to gain privileges or cause a     denial of service by modifying the properties of a     mountpoint. (CVE-2008-2931)

  - Various NULL ptr checks have been added to tty op     functions, which might have been used by local attackers     to execute code. We think that this affects only devices     openable by root, so the impact is limited.
    (CVE-2008-2812)

Dirk Nehring discovered that the IPsec protocol stack did not correctly handle fragmented ESP packets. A remote attacker could exploit this to crash the system, leading to a denial of service.
(CVE-2007-6282)

Johannes Bauer discovered that the 64bit kernel did not correctly handle hrtimer updates. A local attacker could request a large expiration value and cause the system to hang, leading to a denial of service. (CVE-2007-6712)

Tavis Ormandy discovered that the ia32 emulation under 64bit kernels did not fully clear uninitialized data. A local attacker could read private kernel memory, leading to a loss of privacy. (CVE-2008-0598)

Jan Kratochvil discovered that PTRACE did not correctly handle certain calls when running under 64bit kernels. A local attacker could exploit this to crash the system, leading to a denial of service.
(CVE-2008-1615)

Wei Wang discovered that the ASN.1 decoding routines in CIFS and SNMP NAT did not correctly handle certain length values. Remote attackers could exploit this to execute arbitrary code or crash the system.
(CVE-2008-1673)

Paul Marks discovered that the SIT interfaces did not correctly manage allocated memory. A remote attacker could exploit this to fill all available memory, leading to a denial of service. (CVE-2008-2136)

David Miller and Jan Lieskovsky discovered that the Sparc kernel did not correctly range-check memory regions allocated with mmap. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2008-2137)

The sys_utimensat system call did not correctly check file permissions in certain situations. A local attacker could exploit this to modify the file times of arbitrary files which could lead to a denial of service. (CVE-2008-2148)

Brandon Edwards discovered that the DCCP system in the kernel did not correctly check feature lengths. A remote attacker could exploit this to execute arbitrary code. (CVE-2008-2358)

A race condition was discovered between ptrace and utrace in the kernel. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2008-2365)

The copy_to_user routine in the kernel did not correctly clear memory destination addresses when running on 64bit kernels. A local attacker could exploit this to gain access to sensitive kernel memory, leading to a loss of privacy. (CVE-2008-2729)

The PPP over L2TP routines in the kernel did not correctly handle certain messages. A remote attacker could send a specially crafted packet that could crash the system or execute arbitrary code.
(CVE-2008-2750)

Gabriel Campana discovered that SCTP routines did not correctly check for large addresses. A local user could exploit this to allocate all available memory, leading to a denial of service. (CVE-2008-2826).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to kernel 2.6.25.6:
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.5 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.6 CVE-2008-1673: The asn1 implementation in (a) the Linux kernel 2.4 before 2.4.36.6 and 2.6 before 2.6.25.5, as used in the cifs and ip_nat_snmp_basic modules; and (b) the gxsnmp package; does not properly validate length values during decoding of ASN.1 BER data, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) a length greater than the working buffer, which can lead to an unspecified overflow; (2) an oid length of zero, which can lead to an off-by-one error; or (3) an indefinite length for a primitive encoding. Bugs fixed: 224005 - pata_pcmcia fails 326411 - Freeze On Boot w/ Audigy PCMCIA 450332 - F8 - System Lockup after kernel 2.6.25.4-10 450499 - kernel-2.6.25.4-10.fc8 breaks setkey -m tunnel options in ipsec 450501

  - User Mode Linux (UML) broken on Fedora 9 (and now F8,     too) Additional bugs fixed: F9#447518 - Call to capget()     overflows buffers F9#450191 - DMA mode disabled for DVD     drive, reverts to PIO4 F9#439197 - thinkpad x61t crash     when undocking F9#447812 - Netlink messages from 'tc' to     sch_netem module are not interpreted correctly F9#449817
    - SD card reader causes kernel panic during startup if     card inserted Additional updates/fixes: - Fix oops in     lirc_i2c module - Add lirc support for additional MCE     receivers - Upstream wireless updates from 2008-05-22     (http://marc.info/?l=linux-     wireless&m=121146112404515&w=2) - Upstream wireless     fixes from 2008-05-28     (http://marc.info/?l=linux-wireless&m=121201250110162&w=     2) - Upstream wireless fixes from 2008-06-03     (http://marc.info/?l=linux-     wireless&m=121252137324941&w=2) - Upstream wireless     fixes from 2008-06-09     (http://marc.info/?l=linux-kernel&m=121304710726632&w=2)
    - Upstream wireless updates from 2008-06-09     (http://marc.info/?l=linux-     netdev&m=121304710526613&w=2)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to kernel 2.6.25.6:
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.5 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.6 CVE-2008-1673: The asn1 implementation in (a) the Linux kernel 2.4 before 2.4.36.6 and 2.6 before 2.6.25.5, as used in the cifs and ip_nat_snmp_basic modules; and (b) the gxsnmp package; does not properly validate length values during decoding of ASN.1 BER data, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) a length greater than the working buffer, which can lead to an unspecified overflow; (2) an oid length of zero, which can lead to an off-by-one error; or (3) an indefinite length for a primitive encoding. Bugs fixed: 447518 - Call to capget() overflows buffers 448056 - applesmc filling log file 450191 - DMA mode disabled for DVD drive, reverts to PIO4 439197 - thinkpad x61t crash when undocking 445761 - MacBook4,1 keyboard and trackpad do not work properly 447812 - Netlink messages from 'tc' to sch_netem module are not interpreted correctly 449817 - SD card reader causes kernel panic during startup if card inserted 242208 - Freeze On Boot w/ Audigy PCMCIA 443552 - Kernel 2.6.25 + Wine = hang Additional bugs fixed:
F8#224005 - pata_pcmcia fails F8#450499 - kernel-2.6.25.4-10.fc8 breaks setkey -m tunnel options in ipsec F8#445553 - DMAR (intel_iommu) broken on yet another machine Additional updates/fixes:
- Upstream wireless updates from 2008-05-22 (http://marc.info/?l=linux-wireless&m=121146112404515&w=2) - Upstream wireless fixes from 2008-05-28 (http://marc.info/?l=linux- wireless&m=121201250110162&w=2) - Fix oops in lirc_i2c module - Add lirc support for additional MCE receivers - Upstream wireless fixes from 2008-06-03 (http://marc.info/?l=linux-wireless&m=121252137324941&w=2) - Add kernel 3D support for ATI Radeon R500 (X1300-X1950)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or arbitrary code execution. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-1673     Wei Wang from McAfee reported a potential heap overflow     in the ASN.1 decode code that is used by the SNMP NAT     and CIFS subsystem. Exploitation of this issue may lead     to arbitrary code execution. This issue is not believed     to be exploitable with the pre-built kernel images     provided by Debian, but it might be an issue for custom     images built from the Debian-provided source package.

  - CVE-2008-2358     Brandon Edwards of McAfee Avert labs discovered an issue     in the DCCP subsystem. Due to missing feature length     checks it is possible to cause an overflow that may     result in remote arbitrary code execution.

ID	Name	Product	Family	Severity
59131	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 5608)	Nessus	SuSE Local Security Checks	critical
59130	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 5605)	Nessus	SuSE Local Security Checks	critical
59129	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 5477)	Nessus	SuSE Local Security Checks	critical
41534	SuSE 10 Security Update : Linux Kernel (x86) (ZYPP Patch Number 5565)	Nessus	SuSE Local Security Checks	critical
41533	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 5473)	Nessus	SuSE Local Security Checks	critical
40009	openSUSE Security Update : kernel (kernel-171)	Nessus	SuSE Local Security Checks	critical
36625	Mandriva Linux Security Advisory : kernel (MDVSA-2008:113)	Nessus	Mandriva Local Security Checks	critical
34755	openSUSE 10 Security Update : kernel (kernel-5751)	Nessus	SuSE Local Security Checks	critical
34457	openSUSE 10 Security Update : kernel (kernel-5700)	Nessus	SuSE Local Security Checks	critical
34331	SuSE 10 Security Update : the Linux Kernel (x86) (ZYPP Patch Number 5566)	Nessus	SuSE Local Security Checks	critical
33531	Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : linux, linux-source-2.6.15/20/22 vulnerabilities (USN-625-1)	Nessus	Ubuntu Local Security Checks	critical
33234	Fedora 8 : kernel-2.6.25.6-27.fc8 (2008-5454)	Nessus	Fedora Local Security Checks	critical
33182	Fedora 9 : kernel-2.6.25.6-55.fc9 (2008-5308)	Nessus	Fedora Local Security Checks	critical
33173	Debian DSA-1592-1 : linux-2.6 - heap overflow	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2008-1673

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical