Ubuntu 4.10 / 5.04 : linux-source-2.6.8.1, linux-source-2.6.10 vulnerabilities (USN-169-1)

medium Nessus Plugin ID 20575

Synopsis

The remote Ubuntu host is missing one or more security-related patches.

Description

David Howells discovered a local Denial of Service vulnerability in the key session joining function. Under certain user-triggerable conditions, a semaphore was not released properly, which caused processes which also attempted to join a key session to hang forever.
This only affects Ubuntu 5.04 (Hoary Hedgehog). (CAN-2005-2098)

David Howells discovered a local Denial of Service vulnerability in the keyring allocator. A local attacker could exploit this to crash the kernel by attempting to add a specially crafted invalid keyring.
This only affects Ubuntu 5.04 (Hoary Hedgehog). (CAN-2005-2099)

Balazs Scheidler discovered a local Denial of Service vulnerability in the xfrm_compile_policy() function. By calling setsockopt() with an invalid xfrm_user policy message, a local attacker could cause the kernel to write to an array beyond its boundaries, thus causing a kernel crash. (CAN-2005-2456)

Tim Yamin discovered that the driver for compressed ISO file systems did not sufficiently validate the iput data. By tricking an user into mounting a malicious CD-ROM with a specially crafted compressed ISO file system, he could cause a kernel crash. (CAN-2005-2457)

It was discovered that the kernel's embedded zlib compression library was still vulnerable to two old vulnerabilities of the standalone zlib library. This library is used by various drivers and can also be used by third-party modules, so the impact varies. (CAN-2005-2458, CAN-2005-2459)

Peter Sandstrom discovered a remote Denial of Service vulnerability in the SNMP handler. Certain UDP packages lead to a function call with the wrong argument, which resulted in a crash of the network stack.
This only affects Ubuntu 4.10 (Warty Warthog). (CAN-2005-2548)

Herbert Xu discovered that the setsockopt() function was not restricted to privileged users. This allowed a local attacker to bypass intended IPSec policies, set invalid policies to exploit flaws like CAN-2005-2456, or cause a Denial of Service by adding policies until kernel memory is exhausted. Now the call is restricted to processes with the CAP_NET_ADMIN capability. (CAN-2005-2555)

The Ubuntu 5.04 kernel update also fixes a memory leak in the 'md' (Software RAID) driver which eventually lead to kernel memory exhaustion. Ubuntu 4.10 is not affected by this.
(http://bugs.debian.org/317787)

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Update the affected packages.

Plugin Details

Severity: Medium

ID: 20575

File Name: ubuntu_USN-169-1.nasl

Version: 1.16

Type: local

Agent: unix

Family: Ubuntu Local Security Checks

Published: 1/15/2006

Updated: 1/19/2021

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.5

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Information

CPE: p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-686, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6.8.1-5-amd64-k8-smp, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6.8.1-5-amd64-k8-smp, cpe:/o:canonical:ubuntu_linux:5.04, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6.8.1-5-amd64-k8, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6, p-cpe:/a:canonical:ubuntu_linux:linux-source-2.6.10, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6.8.1-5-686-smp, p-cpe:/a:canonical:ubuntu_linux:linux-doc-2.6.8.1, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6.8.1-5-386, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-amd64-generic, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-amd64-k8-smp, p-cpe:/a:canonical:ubuntu_linux:linux-tree-2.6.8.1, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-686, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6.8.1-5-686, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6.8.1-5-amd64-xeon, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6.8.1-5-amd64-xeon, p-cpe:/a:canonical:ubuntu_linux:linux-tree-2.6.10, p-cpe:/a:canonical:ubuntu_linux:linux-patch-ubuntu-2.6.10, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-386, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6.8.1-5-amd64-k8, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-386, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6.8.1-5-686-smp, p-cpe:/a:canonical:ubuntu_linux:linux-source-2.6.8.1, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6.8.1-5-686, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-amd64-xeon, p-cpe:/a:canonical:ubuntu_linux:linux-doc-2.6.10, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-amd64-k8-smp, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6.8.1-5-amd64-generic, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-amd64-k8, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-amd64-k8, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-686-smp, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-amd64-xeon, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-686-smp, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6.8.1-5-386, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6.8.1-5, p-cpe:/a:canonical:ubuntu_linux:linux-patch-debian-2.6.8.1, cpe:/o:canonical:ubuntu_linux:4.10, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6.8.1-5-amd64-generic, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-amd64-generic

Required KB Items: Host/cpu, Host/Ubuntu, Host/Ubuntu/release, Host/Debian/dpkg-l

Patch Publication Date: 8/19/2005

Reference Information

CVE: CVE-2005-2098, CVE-2005-2099, CVE-2005-2456, CVE-2005-2457, CVE-2005-2458, CVE-2005-2459, CVE-2005-2548, CVE-2005-2555

USN: 169-1

Detections

Analytics