Detections
Analytics
Ubuntu 7.10 / 8.04 LTS / 8.10 : linux, linux-source-2.6.22 vulnerabilities (USN-751-1)
critical Nessus Plugin ID 37337
Synopsis
The remote Ubuntu host is missing one or more security-related patches.Description
NFS did not correctly handle races between fcntl and interrupts. A local attacker on an NFS mount could consume unlimited kernel memory, leading to a denial of service. Ubuntu 8.10 was not affected.(CVE-2008-4307)
Sparc syscalls did not correctly check mmap regions. A local attacker could cause a system panic, leading to a denial of service. Ubuntu 8.10 was not affected. (CVE-2008-6107)
In certain situations, cloned processes were able to send signals to parent processes, crossing privilege boundaries. A local attacker could send arbitrary signals to parent processes, leading to a denial of service. (CVE-2009-0028)
The kernel keyring did not free memory correctly. A local attacker could consume unlimited kernel memory, leading to a denial of service.
(CVE-2009-0031)
The SCTP stack did not correctly validate FORWARD-TSN packets. A remote attacker could send specially crafted SCTP traffic causing a system crash, leading to a denial of service. (CVE-2009-0065)
The eCryptfs filesystem did not correctly handle certain VFS return codes. A local attacker with write-access to an eCryptfs filesystem could cause a system crash, leading to a denial of service.
(CVE-2009-0269)
The Dell platform device did not correctly validate user parameters. A local attacker could perform specially crafted reads to crash the system, leading to a denial of service. (CVE-2009-0322)
The page fault handler could consume stack memory. A local attacker could exploit this to crash the system or gain root privileges with a Kprobe registered. Only Ubuntu 8.10 was affected. (CVE-2009-0605)
Network interfaces statistics for the SysKonnect FDDI driver did not check capabilities. A local user could reset statistics, potentially interfering with packet accounting systems. (CVE-2009-0675)
The getsockopt function did not correctly clear certain parameters. A local attacker could read leaked kernel memory, leading to a loss of privacy. (CVE-2009-0676)
The ext4 filesystem did not correctly clear group descriptors when resizing. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2009-0745)
The ext4 filesystem did not correctly validate certain fields. A local attacker could mount a malicious ext4 filesystem, causing a system crash, leading to a denial of service. (CVE-2009-0746, CVE-2009-0747, CVE-2009-0748)
The syscall interface did not correctly validate parameters when crossing the 64-bit/32-bit boundary. A local attacker could bypass certain syscall restricts via crafted syscalls. (CVE-2009-0834, CVE-2009-0835)
The shared memory subsystem did not correctly handle certain shmctl calls when CONFIG_SHMEM was disabled. Ubuntu kernels were not vulnerable, since CONFIG_SHMEM is enabled by default. (CVE-2009-0859)
The virtual consoles did not correctly handle certain UTF-8 sequences.
A local attacker on the physical console could exploit this to cause a system crash, leading to a denial of service. (CVE-2009-1046).
Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
Solution
Update the affected packages.See Also
Plugin Details
Severity: Critical
ID: 37337
File Name: ubuntu_USN-751-1.nasl
Version: 1.20
Type: local
Agent: unix
Family: Ubuntu Local Security Checks
Published: 4/23/2009
Updated: 1/19/2021
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-openvz, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-xen, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-rt, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-generic, p-cpe:/a:canonical:ubuntu_linux:linux-source-2.6.22, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-openvz, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-cell, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-386, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-386, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-rt, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-ume, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-virtual, cpe:/o:canonical:ubuntu_linux:8.04:-:lts, p-cpe:/a:canonical:ubuntu_linux:linux-doc-2.6.22, p-cpe:/a:canonical:ubuntu_linux:linux-source-2.6.27, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-lpiacompat, p-cpe:/a:canonical:ubuntu_linux:linux-doc-2.6.27, p-cpe:/a:canonical:ubuntu_linux:linux-doc-2.6.24, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-lpia, cpe:/o:canonical:ubuntu_linux:7.10, p-cpe:/a:canonical:ubuntu_linux:linux-image-debug-2.6-virtual, p-cpe:/a:canonical:ubuntu_linux:linux-libc-dev, p-cpe:/a:canonical:ubuntu_linux:linux-image-debug-2.6-server, p-cpe:/a:canonical:ubuntu_linux:linux-source-2.6.24, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-server, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-generic, p-cpe:/a:canonical:ubuntu_linux:linux-kernel-devel, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-virtual, p-cpe:/a:canonical:ubuntu_linux:linux-image-debug-2.6-generic, p-cpe:/a:canonical:ubuntu_linux:linux-image-debug-2.6-386, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-server, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-ume, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-xen, cpe:/o:canonical:ubuntu_linux:8.10
Required KB Items: Host/cpu, Host/Ubuntu, Host/Ubuntu/release, Host/Debian/dpkg-l
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 4/6/2009
Vulnerability Publication Date: 1/7/2009
Reference Information
CVE: CVE-2008-4307, CVE-2008-6107, CVE-2009-0028, CVE-2009-0031, CVE-2009-0065, CVE-2009-0269, CVE-2009-0322, CVE-2009-0605, CVE-2009-0675, CVE-2009-0676, CVE-2009-0745, CVE-2009-0746, CVE-2009-0747, CVE-2009-0748, CVE-2009-0834, CVE-2009-0835, CVE-2009-0859, CVE-2009-1046