Detections
Analytics

Ubuntu 5.10 / 6.06 LTS / 6.10 : linux-source-2.6.12/-2.6.15/-2.6.17 vulnerabilities (USN-395-1)

high Nessus Plugin ID 27981

Synopsis

The remote Ubuntu host is missing one or more security-related patches.

Description

Mark Dowd discovered that the netfilter iptables module did not correcly handle fragmented packets. By sending specially crafted packets, a remote attacker could exploit this to bypass firewall rules. This has only be fixed for Ubuntu 6.10; the corresponding fix for Ubuntu 5.10 and 6.06 will follow soon. (CVE-2006-4572)

Dmitriy Monakhov discovered an information leak in the
__block_prepare_write() function. During error recovery, this function did not properly clear memory buffers which could allow local users to read portions of unlinked files. This only affects Ubuntu 5.10.
(CVE-2006-4813)

ADLab Venustech Info Ltd discovered that the ATM network driver referenced an already released pointer in some circumstances. By sending specially crafted packets to a host over ATM, a remote attacker could exploit this to crash that host. This does not affect Ubuntu 6.10. (CVE-2006-4997)

Matthias Andree discovered that the NFS locking management daemon (lockd) did not correctly handle mixing of 'lock' and 'nolock' option mounts on the same client. A remote attacker could exploit this to crash lockd and thus rendering the NFS imports inaccessible. This only affects Ubuntu 5.10. (CVE-2006-5158)

The task switching code did not save and restore EFLAGS of processes.
By starting a specially crafted executable, a local attacker could exploit this to eventually crash many other running processes. This does not affect Ubuntu 6.10. (CVE-2006-5173)

James Morris discovered that the ip6fl_get_n() function incorrectly handled flow labels. A local attacker could exploit this to crash the kernel. (CVE-2006-5619)

Fabio Massimo Di Nitto discovered that the sys_get_robust_list and sys_set_robust_list system calls lacked proper lock handling on the powerpc platform. A local attacker could exploit this to create unkillable processes, drain all available CPU/memory, and render the machine unrebootable. This only affects Ubuntu 6.10. (CVE-2006-5648)

Fabio Massimo Di Nitto discovered a flaw in the alignment check exception handling on the powerpc platform. A local attacker could exploit this to cause a kernel panic and crash the machine.
(CVE-2006-5649)

Certain corrupted squashfs file system images caused a memory allocation to be freed twice. By mounting a specially crafted squashfs file system, a local attacker could exploit this to crash the kernel.
This does not affect Ubuntu 5.10. (CVE-2006-5701)

An integer overflow was found in the get_fdb_entries() function of the network bridging code. By executing a specially crafted ioctl, a local attacker could exploit this to execute arbitrary code with root privileges. (CVE-2006-5751).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Update the affected packages.

See Also

https://usn.ubuntu.com/395-1/

Plugin Details

Severity: High

ID: 27981

File Name: ubuntu_USN-395-1.nasl

Version: 1.21

Type: local

Agent: unix

Published: 11/10/2007

Updated: 1/19/2021

Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-amd64-server, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-amd64-generic, p-cpe:/a:canonical:ubuntu_linux:linux-patch-ubuntu-2.6.12, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-amd64-k8-smp, p-cpe:/a:canonical:ubuntu_linux:linux-source-2.6.12, p-cpe:/a:canonical:ubuntu_linux:linux-doc-2.6.17, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-generic, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-686, p-cpe:/a:canonical:ubuntu_linux:linux-doc-2.6.12, p-cpe:/a:canonical:ubuntu_linux:linux-image-kdump, p-cpe:/a:canonical:ubuntu_linux:linux-doc-2.6.15, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-386, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-386, p-cpe:/a:canonical:ubuntu_linux:linux-tree-2.6.12, cpe:/o:canonical:ubuntu_linux:5.10, cpe:/o:canonical:ubuntu_linux:6.06:-:lts, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-amd64-xeon, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-amd64-server, cpe:/o:canonical:ubuntu_linux:6.10, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-amd64-k8-smp, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-amd64-k8, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-amd64-k8, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-686-smp, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-amd64-xeon, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-686-smp, p-cpe:/a:canonical:ubuntu_linux:linux-image-debug-2.6-server, p-cpe:/a:canonical:ubuntu_linux:linux-libc-dev, p-cpe:/a:canonical:ubuntu_linux:linux-source-2.6.17, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-server, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-generic, p-cpe:/a:canonical:ubuntu_linux:linux-kernel-devel, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-amd64-generic, p-cpe:/a:canonical:ubuntu_linux:linux-image-debug-2.6-generic, p-cpe:/a:canonical:ubuntu_linux:linux-image-debug-2.6-386, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-686, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-server, p-cpe:/a:canonical:ubuntu_linux:linux-source-2.6.15, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6

Required KB Items: Host/cpu, Host/Ubuntu, Host/Ubuntu/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/13/2006

Vulnerability Publication Date: 10/5/2006

Reference Information

CVE: CVE-2006-4572, CVE-2006-4813, CVE-2006-4997, CVE-2006-5158, CVE-2006-5173, CVE-2006-5619, CVE-2006-5648, CVE-2006-5649, CVE-2006-5701, CVE-2006-5751, CVE-2006-5755, CVE-2006-5871

BID: 20363, 20847, 20955, 21353, 21522, 21523

USN: 395-1