Mandrake Linux Security Advisory : kernel (MDKSA-2006:182)

high Nessus Plugin ID 24567

Synopsis

The remote Mandrake Linux host is missing one or more security updates.

Description

A number of vulnerabilities were discovered and corrected in the Linux 2.6 kernel :

Stephane Eranian discovered an issue with permon2.0 where, under certain circumstances, the perfmonctl() system call may not correctly manage the file descriptor reference count, resulting in the system possibly running out of file structure (CVE-2006-3741).

Prior to and including 2.6.17, the Universal Disk Format (UDF) filesystem driver allowed local users to cause a DoS (hang and crash) via certain operations involving truncated files (CVE-2006-4145).

Various versions of the Linux kernel allowed local users to cause a DoS (crash) via an SCTP socket with a certain SO_LINGER value, which is possibly related to the patch used to correct CVE-2006-3745 (CVE-2006-4535).

The Unidirectional Lightweight Encapsulation (ULE) decapsulation component in the dvb driver allows remote attackers to cause a DoS (crash) via an SNDU length of 0 in a ULE packet (CVE-2006-4623).

The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels immediately and reboot to effect the fixes.

In addition to these security fixes, other fixes have been included such as :

- added support for new devices: o NetXtreme BCM5715 gigabit ethernet o NetXtreme II BCM5708 gigabit ethernet
- enabled the CISS driver for Xen kernels - updated ich8 support in ata_piix - enabled support for 1078 type controller in megaraid_sas - multiple fixes for RSBAC support

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 24567

File Name: mandrake_MDKSA-2006-182.nasl

Version: 1.18

Type: local

Family: Mandriva Local Security Checks

Published: 2/18/2007

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.2

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:kernel-xbox-2.6.12.27mdk, p-cpe:/a:mandriva:linux:kernel-xen0-2.6.12.27mdk, p-cpe:/a:mandriva:linux:kernel-xenu-2.6.12.27mdk, p-cpe:/a:mandriva:linux:lib64rsbac1, p-cpe:/a:mandriva:linux:lib64rsbac1-devel, p-cpe:/a:mandriva:linux:lib64rsbac1-static-devel, p-cpe:/a:mandriva:linux:librsbac1, p-cpe:/a:mandriva:linux:librsbac1-devel, p-cpe:/a:mandriva:linux:librsbac1-static-devel, p-cpe:/a:mandriva:linux:rsbac-admin, p-cpe:/a:mandriva:linux:rsbac-admin-doc, p-cpe:/a:mandriva:linux:xen, cpe:/o:mandriva:linux:2006, p-cpe:/a:mandriva:linux:kernel-2.6.12.27mdk, p-cpe:/a:mandriva:linux:kernel-boot-2.6.12.27mdk, p-cpe:/a:mandriva:linux:kernel-i586-up-1gb-2.6.12.27mdk, p-cpe:/a:mandriva:linux:kernel-i686-up-4gb-2.6.12.27mdk, p-cpe:/a:mandriva:linux:kernel-smp-2.6.12.27mdk, p-cpe:/a:mandriva:linux:kernel-source-2.6.12.27mdk, p-cpe:/a:mandriva:linux:kernel-source-stripped-2.6.12.27mdk

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 10/11/2006

Reference Information

CVE: CVE-2006-3741, CVE-2006-4145, CVE-2006-4535, CVE-2006-4623

BID: 19562, 19939, 20361

CWE: 399

MDKSA: 2006:182

Detections

Analytics