Detections
Analytics
Debian DSA-1111-2 : kernel-source-2.6.8 - race condition
medium Nessus Plugin ID 22653
Synopsis
The remote Debian host is missing a security-related update.Description
It was discovered that a race condition in the process filesystem can lead to privilege escalation.The following matrix explains which kernel version for which architecture fixes the problem mentioned above :
Debian 3.1 (sarge) Source 2.6.8-16sarge4 Alpha architecture 2.6.8-16sarge4 AMD64 architecture 2.6.8-16sarge4 Intel IA-32 architecture 2.6.8-16sarge4 Intel IA-64 architecture 2.6.8-14sarge4 PowerPC architecture 2.6.8-12sarge4 Sun Sparc architecture 2.6.8-15sarge4 IBM S/390 2.6.8-5sarge4 Motorola 680x0 2.6.8-4sarge4 HP Precision 2.6.8-6sarge3 FAI 1.9.1sarge3 The initial advisory lacked builds for the IBM S/390, Motorola 680x0 and HP Precision architectures, which are now provided. Also, the kernels for the FAI installer have been updated.
Solution
Upgrade the kernel package immediately and reboot the machine. If you have built a custom kernel from the kernel source package, you will need to rebuild to take advantage of these fixes.See Also
Plugin Details
Severity: Medium
ID: 22653
File Name: debian_DSA-1111.nasl
Version: 1.15
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 10/14/2006
Updated: 1/4/2021
Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus
Risk Information
VPR
Risk Factor: High
Score: 7.4
CVSS v2
Risk Factor: Medium
Base Score: 6.2
Vector: CVSS2#AV:L/AC:H/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:kernel-source-2.6.8, cpe:/o:debian:debian_linux:3.1
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 7/26/2006
Vulnerability Publication Date: 7/17/2006
Exploitable With
CANVAS (CANVAS)
Reference Information
CVE: CVE-2006-3626
DSA: 1111