Detections
Analytics
Ubuntu 6.10 / 7.04 / 7.10 : linux-source-2.6.17/20/22 vulnerabilities (USN-558-1)
high Nessus Plugin ID 29740
Synopsis
The remote Ubuntu host is missing one or more security-related patches.Description
The minix filesystem did not properly validate certain filesystem values. If a local attacker could trick the system into attempting to mount a corrupted minix filesystem, the kernel could be made to hang for long periods of time, resulting in a denial of service.(CVE-2006-6058)
Certain calculations in the hugetlb code were not correct. A local attacker could exploit this to cause a kernel panic, leading to a denial of service. (CVE-2007-4133)
Eric Sesterhenn and Victor Julien discovered that the hop-by-hop IPv6 extended header was not correctly validated. If a system was configured for IPv6, a remote attacker could send a specially crafted IPv6 packet and cause the kernel to panic, leading to a denial of service. This was only vulnerable in Ubuntu 7.04. (CVE-2007-4567)
Permissions were not correctly stored on JFFS2 ACLs. For systems using ACLs on JFFS2, a local attacker may gain access to private files.
(CVE-2007-4849)
Chris Evans discovered that the 802.11 network stack did not correctly handle certain QOS frames. A remote attacker on the local wireless network could send specially crafted packets that would panic the kernel, resulting in a denial of service. (CVE-2007-4997)
The Philips USB Webcam driver did not correctly handle disconnects. If a local attacker tricked another user into disconnecting a webcam unsafely, the kernel could hang or consume CPU resources, leading to a denial of service. (CVE-2007-5093)
Scott James Remnant discovered that the waitid function could be made to hang the system. A local attacker could execute a specially crafted program which would leave the system unresponsive, resulting in a denial of service. (CVE-2007-5500)
Ilpo Jarvinen discovered that it might be possible for the TCP stack to panic the kernel when receiving a crafted ACK response. Only Ubuntu 7.10 contained the vulnerable code, and it is believed not to have been exploitable. (CVE-2007-5501)
When mounting the same remote NFS share to separate local locations, the first location's mount options would apply to all subsequent mounts of the same NFS share. In some configurations, this could lead to incorrectly configured permissions, allowing local users to gain additional access to the mounted share.
(https://launchpad.net/bugs/164231)
Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
Solution
Update the affected packages.See Also
Plugin Details
Severity: High
ID: 29740
File Name: ubuntu_USN-558-1.nasl
Version: 1.21
Type: local
Agent: unix
Family: Ubuntu Local Security Checks
Published: 12/19/2007
Updated: 1/19/2021
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.6
CVSS v2
Risk Factor: High
Base Score: 7.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
Vulnerability Information
CPE: p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-lowlatency, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-xen, p-cpe:/a:canonical:ubuntu_linux:linux-doc-2.6.17, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-rt, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-generic, p-cpe:/a:canonical:ubuntu_linux:linux-image-debug-2.6-lowlatency, p-cpe:/a:canonical:ubuntu_linux:linux-source-2.6.22, cpe:/o:canonical:ubuntu_linux:7.04, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-cell, p-cpe:/a:canonical:ubuntu_linux:linux-image-kdump, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-386, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-386, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-rt, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-ume, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-virtual, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-lowlatency, cpe:/o:canonical:ubuntu_linux:6.10, p-cpe:/a:canonical:ubuntu_linux:linux-doc-2.6.22, p-cpe:/a:canonical:ubuntu_linux:linux-doc-2.6.20, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-lpiacompat, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-lpia, cpe:/o:canonical:ubuntu_linux:7.10, p-cpe:/a:canonical:ubuntu_linux:linux-image-debug-2.6-virtual, p-cpe:/a:canonical:ubuntu_linux:linux-libc-dev, p-cpe:/a:canonical:ubuntu_linux:linux-image-debug-2.6-server, p-cpe:/a:canonical:ubuntu_linux:linux-source-2.6.17, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-server, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-generic, p-cpe:/a:canonical:ubuntu_linux:linux-kernel-devel, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-virtual, p-cpe:/a:canonical:ubuntu_linux:linux-source-2.6.20, p-cpe:/a:canonical:ubuntu_linux:linux-image-debug-2.6-generic, p-cpe:/a:canonical:ubuntu_linux:linux-image-debug-2.6-386, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-server, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-ume, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-xen
Required KB Items: Host/cpu, Host/Ubuntu, Host/Ubuntu/release, Host/Debian/dpkg-l
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 12/18/2007
Vulnerability Publication Date: 11/21/2006
Reference Information
CVE: CVE-2006-6058, CVE-2007-4133, CVE-2007-4567, CVE-2007-4849, CVE-2007-4997, CVE-2007-5093, CVE-2007-5500, CVE-2007-5501