ID CVE-2006-4572
Summary ip6_tables in netfilter in the Linux kernel before 2.6.16.31 allows remote attackers to (1) bypass a rule that disallows a protocol, via a packet with the protocol header not located immediately after the fragment header, aka "ip6_tables protocol bypass bug;" and (2) bypass a rule that looks for a certain extension header, via a packet with an extension header outside the first fragment, aka "ip6_tables extension header bypass bug."
References
Vulnerable Configurations
  • Linux Kernel 2.6.1 Release Candidate 3
    cpe:2.3:o:linux:linux_kernel:2.6.1:rc3
  • Linux Kernel 2.6.1 Release Candidate 2
    cpe:2.3:o:linux:linux_kernel:2.6.1:rc2
  • Linux Kernel 2.6.1 Release Candidate 1
    cpe:2.3:o:linux:linux_kernel:2.6.1:rc1
  • Linux Kernel 2.6.1
    cpe:2.3:o:linux:linux_kernel:2.6.1
  • Linux Kernel 2.6.2
    cpe:2.3:o:linux:linux_kernel:2.6.2
  • Linux Kernel 2.6.2 Release Candidate 1
    cpe:2.3:o:linux:linux_kernel:2.6.2:rc1
  • Linux Kernel 2.6.2 Release Candidate 2
    cpe:2.3:o:linux:linux_kernel:2.6.2:rc2
  • Linux Kernel 2.6.2 Release Candidate 3
    cpe:2.3:o:linux:linux_kernel:2.6.2:rc3
  • Linux Kernel 2.6.0
    cpe:2.3:o:linux:linux_kernel:2.6.0
  • Linux Kernel 2.6.3
    cpe:2.3:o:linux:linux_kernel:2.6.3
  • Linux Kernel 2.6.3 Release Candidate 1
    cpe:2.3:o:linux:linux_kernel:2.6.3:rc1
  • Linux Kernel 2.6.3 Release Candidate 2
    cpe:2.3:o:linux:linux_kernel:2.6.3:rc2
  • Linux Kernel 2.6.3 Release Candidate 3
    cpe:2.3:o:linux:linux_kernel:2.6.3:rc3
  • Linux Kernel 2.6.3 Release Candidate 4
    cpe:2.3:o:linux:linux_kernel:2.6.3:rc4
  • Linux Kernel 2.6.4
    cpe:2.3:o:linux:linux_kernel:2.6.4
  • Linux Kernel 2.6.4 Release Candidate 1
    cpe:2.3:o:linux:linux_kernel:2.6.4:rc1
  • Linux Kernel 2.6.4 Release Candidate 3
    cpe:2.3:o:linux:linux_kernel:2.6.4:rc3
  • Linux Kernel 2.6.4 Release Candidate 2
    cpe:2.3:o:linux:linux_kernel:2.6.4:rc2
  • Linux Kernel 2.6.5
    cpe:2.3:o:linux:linux_kernel:2.6.5
  • Linux Kernel 2.6.5 Release Candidate 2
    cpe:2.3:o:linux:linux_kernel:2.6.5:rc2
  • Linux Kernel 2.6.5 Release Candidate 1
    cpe:2.3:o:linux:linux_kernel:2.6.5:rc1
  • Linux Kernel 2.6.5 Release Candidate 3
    cpe:2.3:o:linux:linux_kernel:2.6.5:rc3
  • Linux Kernel 2.6.6
    cpe:2.3:o:linux:linux_kernel:2.6.6
  • Linux Kernel 2.6.6 Release Candidate 1
    cpe:2.3:o:linux:linux_kernel:2.6.6:rc1
  • Linux Kernel 2.6.6 Release Candidate 3
    cpe:2.3:o:linux:linux_kernel:2.6.6:rc3
  • Linux Kernel 2.6.6 Release Candidate 2
    cpe:2.3:o:linux:linux_kernel:2.6.6:rc2
  • Linux Kernel 2.6.7
    cpe:2.3:o:linux:linux_kernel:2.6.7
  • Linux Kernel 2.6.7 Release Candidate 2
    cpe:2.3:o:linux:linux_kernel:2.6.7:rc2
  • Linux Kernel 2.6.7 Release Candidate 1
    cpe:2.3:o:linux:linux_kernel:2.6.7:rc1
  • Linux Kernel 2.6.7 Release Candidate 3
    cpe:2.3:o:linux:linux_kernel:2.6.7:rc3
  • Linux Kernel 2.6.8
    cpe:2.3:o:linux:linux_kernel:2.6.8
  • Linux Kernel 2.6.8.1
    cpe:2.3:o:linux:linux_kernel:2.6.8.1
  • Linux Kernel 2.6.8 Release Candidate 1
    cpe:2.3:o:linux:linux_kernel:2.6.8:rc1
  • Linux Kernel 2.6.8 Release Candidate 2
    cpe:2.3:o:linux:linux_kernel:2.6.8:rc2
  • Linux Kernel 2.6.8 Release Candidate 3
    cpe:2.3:o:linux:linux_kernel:2.6.8:rc3
  • Linux Kernel 2.6.8 Release Candidate 4
    cpe:2.3:o:linux:linux_kernel:2.6.8:rc4
  • Linux Kernel 2.6.9
    cpe:2.3:o:linux:linux_kernel:2.6.9
  • Linux Kernel 2.6.9 Release Candidate 1
    cpe:2.3:o:linux:linux_kernel:2.6.9:rc1
  • Linux Kernel 2.6.9 Release Candidate 4
    cpe:2.3:o:linux:linux_kernel:2.6.9:rc4
  • Linux Kernel 2.6.9 Release Candidate 3
    cpe:2.3:o:linux:linux_kernel:2.6.9:rc3
  • Linux Kernel 2.6.9 Release Candidate 2
    cpe:2.3:o:linux:linux_kernel:2.6.9:rc2
  • Linux Kernel 2.6.10
    cpe:2.3:o:linux:linux_kernel:2.6.10
  • Linux Kernel 2.6.10 Release Candidate 1
    cpe:2.3:o:linux:linux_kernel:2.6.10:rc1
  • Linux Kernel 2.6.10 Release Candidate 2
    cpe:2.3:o:linux:linux_kernel:2.6.10:rc2
  • Linux Kernel 2.6.10 Release Candidate 3
    cpe:2.3:o:linux:linux_kernel:2.6.10:rc3
  • Linux Kernel 2.6.11.8
    cpe:2.3:o:linux:linux_kernel:2.6.11.8
  • Linux Kernel 2.6.11.7
    cpe:2.3:o:linux:linux_kernel:2.6.11.7
  • Linux Kernel 2.6.11.10
    cpe:2.3:o:linux:linux_kernel:2.6.11.10
  • Linux Kernel 2.6.11.9
    cpe:2.3:o:linux:linux_kernel:2.6.11.9
  • Linux Kernel 2.6.11.12
    cpe:2.3:o:linux:linux_kernel:2.6.11.12
  • Linux Kernel 2.6.11.11
    cpe:2.3:o:linux:linux_kernel:2.6.11.11
  • Linux Kernel 2.6.11
    cpe:2.3:o:linux:linux_kernel:2.6.11
  • Linux Kernel 2.6.11.1
    cpe:2.3:o:linux:linux_kernel:2.6.11.1
  • Linux Kernel 2.6.11.2
    cpe:2.3:o:linux:linux_kernel:2.6.11.2
  • Linux Kernel 2.6.11.3
    cpe:2.3:o:linux:linux_kernel:2.6.11.3
  • Linux Kernel 2.6.11.4
    cpe:2.3:o:linux:linux_kernel:2.6.11.4
  • Linux Kernel 2.6.11.5
    cpe:2.3:o:linux:linux_kernel:2.6.11.5
  • Linux Kernel 2.6.11.6
    cpe:2.3:o:linux:linux_kernel:2.6.11.6
  • Linux Kernel 2.6.11 Release Candidate 1
    cpe:2.3:o:linux:linux_kernel:2.6.11:rc1
  • Linux Kernel 2.6.11 Release Candidate 2
    cpe:2.3:o:linux:linux_kernel:2.6.11:rc2
  • Linux Kernel 2.6.11 Release Candidate 3
    cpe:2.3:o:linux:linux_kernel:2.6.11:rc3
  • Linux Kernel 2.6.11 Release Candidate 4
    cpe:2.3:o:linux:linux_kernel:2.6.11:rc4
  • Linux Kernel 2.6.11 Release Candidate 5
    cpe:2.3:o:linux:linux_kernel:2.6.11:rc5
  • Linux Kernel 2.6.12.3
    cpe:2.3:o:linux:linux_kernel:2.6.12.3
  • Linux Kernel 2.6.12.2
    cpe:2.3:o:linux:linux_kernel:2.6.12.2
  • Linux Kernel 2.6.12.5
    cpe:2.3:o:linux:linux_kernel:2.6.12.5
  • Linux Kernel 2.6.12.4
    cpe:2.3:o:linux:linux_kernel:2.6.12.4
  • Linux Kernel 2.6.12.6
    cpe:2.3:o:linux:linux_kernel:2.6.12.6
  • Linux Kernel 2.6.12.1
    cpe:2.3:o:linux:linux_kernel:2.6.12.1
  • Linux Kernel 2.6.12
    cpe:2.3:o:linux:linux_kernel:2.6.12
  • Linux Kernel 2.6.12 Release Candidate 6
    cpe:2.3:o:linux:linux_kernel:2.6.12:rc6
  • Linux Kernel 2.6.12 Release Candidate 4
    cpe:2.3:o:linux:linux_kernel:2.6.12:rc4
  • Linux Kernel 2.6.12 Release Candidate 5
    cpe:2.3:o:linux:linux_kernel:2.6.12:rc5
  • Linux Kernel 2.6.12 Release Candidate 1
    cpe:2.3:o:linux:linux_kernel:2.6.12:rc1
  • Linux Kernel 2.6.12 Release Candidate 2
    cpe:2.3:o:linux:linux_kernel:2.6.12:rc2
  • Linux Kernel 2.6.12 Release Candidate 3
    cpe:2.3:o:linux:linux_kernel:2.6.12:rc3
  • Linux Kernel 2.6.13.5
    cpe:2.3:o:linux:linux_kernel:2.6.13.5
  • Linux Kernel 2.6.13.3
    cpe:2.3:o:linux:linux_kernel:2.6.13.3
  • Linux Kernel 2.6.13.4
    cpe:2.3:o:linux:linux_kernel:2.6.13.4
  • Linux Kernel 2.6.13
    cpe:2.3:o:linux:linux_kernel:2.6.13
  • Linux Kernel 2.6.13.2
    cpe:2.3:o:linux:linux_kernel:2.6.13.2
  • Linux Kernel 2.6.13.1
    cpe:2.3:o:linux:linux_kernel:2.6.13.1
  • Linux Kernel 2.6.13 Release Candidate 6
    cpe:2.3:o:linux:linux_kernel:2.6.13:rc6
  • Linux Kernel 2.6.13 Release Candidate 7
    cpe:2.3:o:linux:linux_kernel:2.6.13:rc7
  • Linux Kernel 2.6.13 Release Candidate 4
    cpe:2.3:o:linux:linux_kernel:2.6.13:rc4
  • Linux Kernel 2.6.13 Release Candidate 5
    cpe:2.3:o:linux:linux_kernel:2.6.13:rc5
  • Linux Kernel 2.6.13 Release Candidate 2
    cpe:2.3:o:linux:linux_kernel:2.6.13:rc2
  • Linux Kernel 2.6.13 Release Candidate 3
    cpe:2.3:o:linux:linux_kernel:2.6.13:rc3
  • Linux Kernel 2.6.13 Release Candidate 1
    cpe:2.3:o:linux:linux_kernel:2.6.13:rc1
  • Linux Kernel 2.6.14.7
    cpe:2.3:o:linux:linux_kernel:2.6.14.7
  • Linux Kernel 2.6.14.5
    cpe:2.3:o:linux:linux_kernel:2.6.14.5
  • Linux Kernel 2.6.14.6
    cpe:2.3:o:linux:linux_kernel:2.6.14.6
  • Linux Kernel 2.6.14
    cpe:2.3:o:linux:linux_kernel:2.6.14
  • Linux Kernel 2.6.14.3
    cpe:2.3:o:linux:linux_kernel:2.6.14.3
  • Linux Kernel 2.6.14.4
    cpe:2.3:o:linux:linux_kernel:2.6.14.4
  • Linux Kernel 2.6.14.1
    cpe:2.3:o:linux:linux_kernel:2.6.14.1
  • Linux Kernel 2.6.14.2
    cpe:2.3:o:linux:linux_kernel:2.6.14.2
  • Linux Kernel 2.6.14 Release Candidate 5
    cpe:2.3:o:linux:linux_kernel:2.6.14:rc5
  • Linux Kernel 2.6.14 Release Candidate 3
    cpe:2.3:o:linux:linux_kernel:2.6.14:rc3
  • Linux Kernel 2.6.14 Release Candidate 4
    cpe:2.3:o:linux:linux_kernel:2.6.14:rc4
  • Linux Kernel 2.6.14 Release Candidate 1
    cpe:2.3:o:linux:linux_kernel:2.6.14:rc1
  • Linux Kernel 2.6.14 Release Candidate 2
    cpe:2.3:o:linux:linux_kernel:2.6.14:rc2
  • Linux Kernel 2.6.15.7
    cpe:2.3:o:linux:linux_kernel:2.6.15.7
  • Linux Kernel 2.6.15.6
    cpe:2.3:o:linux:linux_kernel:2.6.15.6
  • Linux Kernel 2.6.15.5
    cpe:2.3:o:linux:linux_kernel:2.6.15.5
  • Linux Kernel 2.6.15
    cpe:2.3:o:linux:linux_kernel:2.6.15
  • Linux Kernel 2.6.15.3
    cpe:2.3:o:linux:linux_kernel:2.6.15.3
  • Linux Kernel 2.6.15.4
    cpe:2.3:o:linux:linux_kernel:2.6.15.4
  • Linux Kernel 2.6.15.1
    cpe:2.3:o:linux:linux_kernel:2.6.15.1
  • Linux Kernel 2.6.15.2
    cpe:2.3:o:linux:linux_kernel:2.6.15.2
  • Linux Kernel 2.6.15 Release Candidate 1
    cpe:2.3:o:linux:linux_kernel:2.6.15:rc1
  • Linux Kernel 2.6.15 Release Candidate 7
    cpe:2.3:o:linux:linux_kernel:2.6.15:rc7
  • Linux Kernel 2.6.15 Release Candidate 6
    cpe:2.3:o:linux:linux_kernel:2.6.15:rc6
  • Linux Kernel 2.6.15 Release Candidate 5
    cpe:2.3:o:linux:linux_kernel:2.6.15:rc5
  • Linux Kernel 2.6.15 Release Candidate 4
    cpe:2.3:o:linux:linux_kernel:2.6.15:rc4
  • Linux Kernel 2.6.15 Release Candidate 3
    cpe:2.3:o:linux:linux_kernel:2.6.15:rc3
  • Linux Kernel 2.6.15 Release Candidate 2
    cpe:2.3:o:linux:linux_kernel:2.6.15:rc2
  • Linux Kernel 2.6.16.8
    cpe:2.3:o:linux:linux_kernel:2.6.16.8
  • Linux Kernel 2.6.16.7
    cpe:2.3:o:linux:linux_kernel:2.6.16.7
  • Linux Kernel 2.6.16.6
    cpe:2.3:o:linux:linux_kernel:2.6.16.6
  • Linux Kernel 2.6.16.5
    cpe:2.3:o:linux:linux_kernel:2.6.16.5
  • Linux Kernel 2.6.16.12
    cpe:2.3:o:linux:linux_kernel:2.6.16.12
  • Linux Kernel 2.6.16.11
    cpe:2.3:o:linux:linux_kernel:2.6.16.11
  • Linux Kernel 2.6.16.10
    cpe:2.3:o:linux:linux_kernel:2.6.16.10
  • Linux Kernel 2.6.16.9
    cpe:2.3:o:linux:linux_kernel:2.6.16.9
  • Linux Kernel 2.6.16
    cpe:2.3:o:linux:linux_kernel:2.6.16
  • Linux Kernel 2.6.16.4
    cpe:2.3:o:linux:linux_kernel:2.6.16.4
  • Linux Kernel 2.6.16.3
    cpe:2.3:o:linux:linux_kernel:2.6.16.3
  • Linux Kernel 2.6.16.2
    cpe:2.3:o:linux:linux_kernel:2.6.16.2
  • Linux Kernel 2.6.16.1
    cpe:2.3:o:linux:linux_kernel:2.6.16.1
  • Linux Kernel 2.6.16.29
    cpe:2.3:o:linux:linux_kernel:2.6.16.29
  • Linux Kernel 2.6.16.18
    cpe:2.3:o:linux:linux_kernel:2.6.16.18
  • Linux Kernel 2.6.16.17
    cpe:2.3:o:linux:linux_kernel:2.6.16.17
  • Linux Kernel 2.6.16.20
    cpe:2.3:o:linux:linux_kernel:2.6.16.20
  • Linux Kernel 2.6.16.19
    cpe:2.3:o:linux:linux_kernel:2.6.16.19
  • Linux Kernel 2.6.16.14
    cpe:2.3:o:linux:linux_kernel:2.6.16.14
  • Linux Kernel 2.6.16.13
    cpe:2.3:o:linux:linux_kernel:2.6.16.13
  • Linux Kernel 2.6.16.16
    cpe:2.3:o:linux:linux_kernel:2.6.16.16
  • Linux Kernel 2.6.16.15
    cpe:2.3:o:linux:linux_kernel:2.6.16.15
  • Linux Kernel 2.6.16.26
    cpe:2.3:o:linux:linux_kernel:2.6.16.26
  • Linux Kernel 2.6.16.25
    cpe:2.3:o:linux:linux_kernel:2.6.16.25
  • Linux Kernel 2.6.16.28
    cpe:2.3:o:linux:linux_kernel:2.6.16.28
  • Linux Kernel 2.6.16.27
    cpe:2.3:o:linux:linux_kernel:2.6.16.27
  • Linux Kernel 2.6.16.22
    cpe:2.3:o:linux:linux_kernel:2.6.16.22
  • Linux Kernel 2.6.16.21
    cpe:2.3:o:linux:linux_kernel:2.6.16.21
  • Linux Kernel 2.6.16.24
    cpe:2.3:o:linux:linux_kernel:2.6.16.24
  • Linux Kernel 2.6.16.23
    cpe:2.3:o:linux:linux_kernel:2.6.16.23
  • Linux Kernel 2.6.16.30
    cpe:2.3:o:linux:linux_kernel:2.6.16.30
  • Linux Kernel 2.6.16 Release Candidate 1
    cpe:2.3:o:linux:linux_kernel:2.6.16:rc1
  • Linux Kernel 2.6.16 Release Candidate 2
    cpe:2.3:o:linux:linux_kernel:2.6.16:rc2
  • Linux Kernel 2.6.16 Release Candidate 3
    cpe:2.3:o:linux:linux_kernel:2.6.16:rc3
  • Linux Kernel 2.6.16 Release Candidate 4
    cpe:2.3:o:linux:linux_kernel:2.6.16:rc4
  • Linux Kernel 2.6.16 Release Candidate 5
    cpe:2.3:o:linux:linux_kernel:2.6.16:rc5
  • Linux Kernel 2.6.16 Release Candidate 6
    cpe:2.3:o:linux:linux_kernel:2.6.16:rc6
CVSS
Base: 7.5 (as of 09-11-2006 - 10:24)
Impact:
Exploitability:
CWE CWE-264
CAPEC
  • Accessing, Modifying or Executing Executable Files
    An attack of this type exploits a system's configuration that allows an attacker to either directly access an executable file, for example through shell access; or in a possible worst case allows an attacker to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
  • Leverage Executable Code in Non-Executable Files
    An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
  • Blue Boxing
    This type of attack against older telephone switches and trunks has been around for decades. A tone is sent by an adversary to impersonate a supervisor signal which has the effect of rerouting or usurping command of the line. While the US infrastructure proper may not contain widespread vulnerabilities to this type of attack, many companies are connected globally through call centers and business process outsourcing. These international systems may be operated in countries which have not upgraded Telco infrastructure and so are vulnerable to Blue boxing. Blue boxing is a result of failure on the part of the system to enforce strong authorization for administrative functions. While the infrastructure is different than standard current applications like web applications, there are historical lessons to be learned to upgrade the access control for administrative functions.
  • Restful Privilege Elevation
    Rest uses standard HTTP (Get, Put, Delete) style permissions methods, but these are not necessarily correlated generally with back end programs. Strict interpretation of HTTP get methods means that these HTTP Get services should not be used to delete information on the server, but there is no access control mechanism to back up this logic. This means that unless the services are properly ACL'd and the application's service implementation are following these guidelines then an HTTP request can easily execute a delete or update on the server side. The attacker identifies a HTTP Get URL such as http://victimsite/updateOrder, which calls out to a program to update orders on a database or other resource. The URL is not idempotent so the request can be submitted multiple times by the attacker, additionally, the attacker may be able to exploit the URL published as a Get method that actually performs updates (instead of merely retrieving data). This may result in malicious or inadvertent altering of data on the server.
  • Target Programs with Elevated Privileges
    This attack targets programs running with elevated privileges. The attacker would try to leverage a bug in the running program and get arbitrary code to execute with elevated privileges. For instance an attacker would look for programs that write to the system directories or registry keys (such as HKLM, which stores a number of critical Windows environment variables). These programs are typically running with elevated privileges and have usually not been designed with security in mind. Such programs are excellent exploit targets because they yield lots of power when they break. The malicious user try to execute its code at the same level as a privileged system call.
  • Manipulating Input to File System Calls
    An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
nessus via4
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-395-1.NASL
    description Mark Dowd discovered that the netfilter iptables module did not correcly handle fragmented packets. By sending specially crafted packets, a remote attacker could exploit this to bypass firewall rules. This has only be fixed for Ubuntu 6.10; the corresponding fix for Ubuntu 5.10 and 6.06 will follow soon. (CVE-2006-4572) Dmitriy Monakhov discovered an information leak in the __block_prepare_write() function. During error recovery, this function did not properly clear memory buffers which could allow local users to read portions of unlinked files. This only affects Ubuntu 5.10. (CVE-2006-4813) ADLab Venustech Info Ltd discovered that the ATM network driver referenced an already released pointer in some circumstances. By sending specially crafted packets to a host over ATM, a remote attacker could exploit this to crash that host. This does not affect Ubuntu 6.10. (CVE-2006-4997) Matthias Andree discovered that the NFS locking management daemon (lockd) did not correctly handle mixing of 'lock' and 'nolock' option mounts on the same client. A remote attacker could exploit this to crash lockd and thus rendering the NFS imports inaccessible. This only affects Ubuntu 5.10. (CVE-2006-5158) The task switching code did not save and restore EFLAGS of processes. By starting a specially crafted executable, a local attacker could exploit this to eventually crash many other running processes. This does not affect Ubuntu 6.10. (CVE-2006-5173) James Morris discovered that the ip6fl_get_n() function incorrectly handled flow labels. A local attacker could exploit this to crash the kernel. (CVE-2006-5619) Fabio Massimo Di Nitto discovered that the sys_get_robust_list and sys_set_robust_list system calls lacked proper lock handling on the powerpc platform. A local attacker could exploit this to create unkillable processes, drain all available CPU/memory, and render the machine unrebootable. This only affects Ubuntu 6.10. (CVE-2006-5648) Fabio Massimo Di Nitto discovered a flaw in the alignment check exception handling on the powerpc platform. A local attacker could exploit this to cause a kernel panic and crash the machine. (CVE-2006-5649) Certain corrupted squashfs file system images caused a memory allocation to be freed twice. By mounting a specially crafted squashfs file system, a local attacker could exploit this to crash the kernel. This does not affect Ubuntu 5.10. (CVE-2006-5701) An integer overflow was found in the get_fdb_entries() function of the network bridging code. By executing a specially crafted ioctl, a local attacker could exploit this to execute arbitrary code with root privileges. (CVE-2006-5751). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-13
    plugin id 27981
    published 2007-11-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=27981
    title Ubuntu 5.10 / 6.06 LTS / 6.10 : linux-source-2.6.12/-2.6.15/-2.6.17 vulnerabilities (USN-395-1)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRAKE_MDKSA-2006-197.NASL
    description Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel : Bugs in the netfilter for IPv6 code, as reported by Mark Dowd, were fixed (CVE-2006-4572). The ATM subsystem of the Linux kernel could allow a remote attacker to cause a Denial of Service (panic) via unknown vectors that cause the ATM subsystem to access the memory of socket buffers after they are freed (CVE-2006-4997). The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels immediately and reboot to effect the fixes. In addition to these security fixes, other fixes have been included such as : - updated to 2.6.17.14 - fix wrong error handling in pccard_store_cis - add NX mask for PTE entry on x86_64 - fix snd-hda-intel OOPS - backported support r8169-related (r8168/r8169SC) network chipsets - explicitly initialize some members of the drm_driver structure, otherwise NULL init will have bad side effects (mach64) - support for building a nosrc.rpm package - fixed unplug/eject on pcmcia cards with r8169 chipsets - fix libata resource conflicts - fix xenU crash and re-enable domU boot logs - fix refcount error triggered by software using /proc/[pid]/auxv To update your kernel, please follow the directions located at : http://www.mandriva.com/en/security/kernelupdate
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 24582
    published 2007-02-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=24582
    title Mandrake Linux Security Advisory : kernel (MDKSA-2006:197)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_KERNEL-2397.NASL
    description This kernel update fixes the following security problems : - CVE-2006-4145: A bug within the UDF filesystem that caused machine hangs when truncating files on the filesystem was fixed. [#186226] - A potential crash when receiving IPX packets was fixed. This problem is thought not to be exploitable. [#197809] - CVE-2006-4623: A problem in DVB packet handling could be used to crash the machine when receiving DVB net packages is active. [#201429] - CVE-2006-3741: A struct file leak was fixed in the perfmon(2) system call on the Itanium architecture. [#202269] - CVE-2006-4538: A malformed ELF image can be used on the Itanium architecture to trigger a kernel crash (denial of service) when a local attacker can supply it to be started. [#203822] - CVE-2006-4997: A problem in the ATM protocol handling clip_mkip function could be used by remote attackers to potentially crash the machine. [#205383] CVE-2006-5757/ - CVE-2006-6060: A problem in the grow_buffers function could be used to crash or hang the machine using a corrupted filesystem. This affects filesystem types ISO9660 and NTFS. [#205384] - CVE-2006-5173: On the i386 architecture the ELFAGS content was not correctly saved, which could be used by local attackers to crash other programs using the AC and NT flag or to escalate privileges by waiting for iopl privileges to be leaked. [#209386] - CVE-2006-5174: On the S/390 architecture copy_from_user() could be used by local attackers to read kernel memory. [#209880] - CVE-2006-5619: A problem in IPv6 flowlabel handling can be used by local attackers to hang the machine. [#216590] - CVE-2006-5648: On the PowerPC architecture a syscall has been wired without the proper futex implementation that can be exploited by a local attacker to hang the machine. [#217295] - CVE-2006-5649: On the PowerPC architecture the proper futex implementation was missing a fix for alignment check which could be used by a local attacker to crash the machine. [#217295] - CVE-2006-5823: A problem in cramfs could be used to crash the machine during mounting a crafted cramfs image. This requires an attacker to supply such a crafted image and have a user mount it. [#218237] - CVE-2006-6053: A problem in the ext3 filesystem could be used by attackers able to supply a crafted ext3 image to cause a denial of service or further data corruption if a user mounts this image. [#220288] - CVE-2006-6056: Missing return code checking in the HFS could be used to crash machine when a user complicit attacker is able to supply a specially crafted HFS image. [#221230] - CVE-2006-4572: Multiple unspecified vulnerabilities in netfilter for IPv6 code allow remote attackers to bypass intended restrictions via fragmentation attack vectors, aka (1) 'ip6_tables protocol bypass bug' and (2) 'ip6_tables extension header bypass bug'. [#221313] - CVE-2006-5751: An integer overflow in the networking bridge ioctl starting with Kernel 2.6.7 could be used by local attackers to overflow kernel memory buffers and potentially escalate privileges [#222656] Additionaly this kernel catches up to the SLE 10 state of the kernel, with massive additional fixes.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 27291
    published 2007-10-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=27291
    title openSUSE 10 Security Update : kernel (kernel-2397)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_KERNEL-DEBUG-2393.NASL
    description This kernel update fixes the following security problems : - A bug within the UDF filesystem that caused machine hangs when truncating files on the filesystem was fixed. [#186226]. (CVE-2006-4145) - A potential crash when receiving IPX packets was fixed. This problem is thought not to be exploitable. [#197809] - A problem in DVB packet handling could be used to crash the machine when receiving DVB net packages is active. [#201429]. (CVE-2006-4623) - A struct file leak was fixed in the perfmon(2) system call on the Itanium architecture. [#202269]. (CVE-2006-3741) - A malformed ELF image can be used on the Itanium architecture to trigger a kernel crash (denial of service) when a local attacker can supply it to be started. [#203822]. (CVE-2006-4538) - A problem in the ATM protocol handling clip_mkip function could be used by remote attackers to potentially crash the machine. [#205383]. (CVE-2006-4997) CVE-2006-5757/ - A problem in the grow_buffers function could be used to crash or hang the machine using a corrupted filesystem. This affects filesystem types ISO9660 and NTFS. [#205384]. (CVE-2006-6060) - On the i386 architecture the ELFAGS content was not correctly saved, which could be used by local attackers to crash other programs using the AC and NT flag or to escalate privileges by waiting for iopl privileges to be leaked. [#209386]. (CVE-2006-5173) - On the S/390 architecture copy_from_user() could be used by local attackers to read kernel memory. [#209880]. (CVE-2006-5174) - A problem in IPv6 flowlabel handling can be used by local attackers to hang the machine. [#216590]. (CVE-2006-5619) - On the PowerPC architecture a syscall has been wired without the proper futex implementation that can be exploited by a local attacker to hang the machine. [#217295]. (CVE-2006-5648) - On the PowerPC architecture the proper futex implementation was missing a fix for alignment check which could be used by a local attacker to crash the machine. [#217295]. (CVE-2006-5649) - A problem in cramfs could be used to crash the machine during mounting a crafted cramfs image. This requires an attacker to supply such a crafted image and have a user mount it. [#218237]. (CVE-2006-5823) - A problem in the ext3 filesystem could be used by attackers able to supply a crafted ext3 image to cause a denial of service or further data corruption if a user mounts this image. [#220288]. (CVE-2006-6053) - Missing return code checking in the HFS could be used to crash machine when a user complicit attacker is able to supply a specially crafted HFS image. [#221230]. (CVE-2006-6056) - Multiple unspecified vulnerabilities in netfilter for IPv6 code allow remote attackers to bypass intended restrictions via fragmentation attack vectors, aka (1) 'ip6_tables protocol bypass bug' and (2) 'ip6_tables extension header bypass bug'. [#221313]. (CVE-2006-4572) - An integer overflow in the networking bridge ioctl starting with Kernel 2.6.7 could be used by local attackers to overflow kernel memory buffers and potentially escalate privileges [#222656]. (CVE-2006-5751) and the following non security bugs : - patches.fixes/dm-bio_list_merge-fix.diff: device-mapper snapshot: bio_list fix [#117435] - patches.fixes/statd-refcount-fix: Fix refcounting problems in host management in lockd. [#148009] - patches.fixes/i8042-reentry: Prevents i8042_interrupt() from being reentered. [#167187] - patches.suse/bonding-workqueue: Replace system timer with work queue in monitor functions. Remove rtnl_lock calls in monitor functions added in original version. [#174843] [#205196] - patches.arch/i386-profile-pc: i386: Account spinlocks to the caller during profiling for !FP kernels [#176770] - patches.arch/add-user-mode: i386/x86-64: Add user_mode checks to profile_pc for oprofile [#176770] - patches.drivers/aic7xxx-max-sectors-adjust: Adjust .max_sectors to 8192 for aic7xxx [#177059] - patches.xen/xen-x86-dcr-fallback: Add fallback when XENMEM_exchange fails to replace contiguous region [#181869] - patches.suse/lkcd-support-large-minor-number: LKCD should support minor numbers > 256 [#185125] - patches.fixes/scsi-scan-limit-luns-seqscan-16k: Limit sequential scan to 16k LUNs [#185164] - patches.drivers/powernow-ext-mask: Handle extended powernow vid mask properly [#185654] - patches.fixes/xfs-unlink-recovery-fix: [XFS] unlink recovery fix. ([#185796] - patches.suse/lkcd-dont-lose-one-page: Fix incorrect dumps on machines with memory holes [#186169] - patches.fixes/ieee80211-orinoco_ap_workaround.diff: ieee80211: workaround for broken Orinoco access points [#186879] - patches.fixes/sched-group-exclusive: Fix scheduler crash with exclusive cpusets [#188921] - patches.fixes/bdev-imapping-race.diff: Fix race between sync_single_inode() and iput() [#188950] - patches.fixes/scsi-scan-blist-update: Update blacklist entries for EMC Symmetrix and HP EVA [#191648] - patches.arch/ia64-mce-output: Save/restore oops_in_progress around printing machine checks [#191901] - patches.fixes/scsi-add-device-oops-during-eh: Fix Oops in scsi_add_device during EH [#195050] - Included a set of fixes for [#195940] - patches.fixes/dm-fix-alloc_dev-error_path.patch: call free_minor in alloc_dev error path. patches.fixes/dm-snapshot-fix-origin_write-pe-submission .patch: fix origin_write pending_exception submission. - patches.fixes/dm-snapshot-replace-sibling-list.patch: replace sibling list. - patches.fixes/dm-snapshot-fix-pending-pe-ref.patch: fix references to pending pe. - patches.fixes/dm-snapshot-fix-invalidation.patch: fix invalidation. - patches.fixes/dm-kcopyd-error-accumulation-fix.patch: kcopyd should accumulate errors. patches.fixes/dm-snapshot-fix-metadata-error-handling.patch: fix read_metadata error handling. patches.fixes/dm-snapshot-fix-metadata-writing-when-suspending.patch: fix metadata writing when suspending. - patches.fixes/nat-t-pskb-pull.patch: Fix NAT-T VPN with certain ethernet chips, in particular recent e1000 chips. [#196747] - patches.drivers/e1000-update: Update so that we no longer break the 'Disable Packet Split for PCI express adapters' driver option. - patches.fixes/e1000-no-packet-split: Discard, no longer needed. - patches.arch/acpi_T60_ultrabay.patch: Add T60 ACPI dock station path to ibm_acpi module [#196884] - patches.fixes/acpi_battery_hotplug_fix.patch: Workaround ACPI misdesign to recon dock station when booting undocked. - patches.fixes/acpi_ibm_dock_fix_not_present.patch: Workaround ACPI misdesign to recon dock station when booting undocked [#196884] - patches.arch/x86_64-monotonic-clock: Fix monotonic clock on x86-64 [#197548] - patches.fixes/nfs-truncate-race: Fix a race when truncating over NFS and writing via mmap [#198023] - patches.drivers/libata-no-spindown-on-shutdown: Don't spindown SCSI disks when rebooting [#198687] - patches.drivers/qla2xxx-reset-fix: allow reset for qla2xxx via sg_reset [#200325] - kabi/s390/symvers-default: Update kABI symbols [#202134] - patches.suse/bond_alb_deadlock_fix: bonding: fix deadlock on high loads in bond_alb_monitor(). [#202512] - patches.arch/i386-fix-tsc-selection: Fix TSC timer selection on i386 [#203713] - patches.drivers/aic94xx-remove-flash-manfid-reliance: Remove reliance on the FLASH MANFID [#203768] - patches.fixes/xfs-kern-205110-xfs_dio_locking: Fix ABBA deadlock between i_mutex and iolock [#205110] - patches.suse/bonding-workqueue: Replace system timer with work queue in monitor functions. Remove rtnl_lock calls in monitor functions added in original version. [#174843] [#205196] - add patches.fixes/fix-incorrect-hugepage-interleaving.patch fix NUMA interleaving for huge pages [#205268] - patches.suse/bondalb-hashtbl.patch: fix hang in bonding ALB driver. [#206629] patches.drivers/usb-add-raritan-kvm-usb-dongle-to-the-hi d_quirk_noget-blacklist.patch: USB: add Raritan KVM USB Dongle to the HID_QUIRK_NOGET blacklist [#206932] - patches.arch/ia64-mca_asm-set_kernel_registers: [IA64] set ar.fpsr on MCA/INIT kernel entry. [#206967] - patches.fixes/md-bitmap-ffz: Use ffz instead of find_first_set to convert multiplier to shift. [#207679] - patches.fixes/md-bitmap-compat-ioctl: Allow SET_BITMAP_FILE to work on 64bit kernel with 32bit userspace. [#207688] - patches.drivers/mpt-rport-stall: Fix MPT oops during aborting commands [#207768] - patches.drivers/libata-jmicron-update: Fix handling of JMicron controller [#207939] - patches.arch/i386-mmconfig-flush: arch/i386/pci/mmconfig.c tlb flush fix [#208414] - patches.fixes/scsi-fix-req-page-count: scsi_lib.c: properly count the number of pages in scsi_req_map_sg() [#208782] - patches.fixes/fix-processor-placement.diff: sched: Fix longstanding load balancing bug in the scheduler [#209460]. - patches.arch/x86_64-fpu-corruption: Fix FPU corruption [#209903] - patches.drivers/qla1280-bus-reset-handling: performance slowdown after bus reset on qla12160 HBA [#213717] - patches.drivers/qla1280-scb-timeout: qla1280 times out on long operations such as tape rewind [#214695] - patches.fixes/slab-per-cpu-data: Make slab initialization use per cpu data of correction CPU [#216316] - patches.fixes/ocfs2-network-send-lock.diff: ocfs2: introduce sc->sc_send_lock to protect outbound network messages [#216912] - marked module megaraid_sas as supported - marked module jsm as supported [#218969] - patches.suse/ocfs2-13-fix-quorum-work.diff: ocfs2: outstanding scheduled work can oops when quorum is shut down [#220694] - patches.xen/xen-x86_64-agp: add missing header [#222174] [#224170] - patches.fixes/md-rebuild-fix: md: Fix bug where a rebuild of spares, when interrupted by a rebuild, doesn't always get properly completed once the system is back up, leading to filesystem corruption. [#224960]. - patches.fixes/scsi-sdev-initialisation-block-race: SCSI midlayer race: scan vs block/unblock deadlocks sdev [#225770]
    last seen 2019-02-21
    modified 2012-05-17
    plugin id 59162
    published 2012-05-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=59162
    title SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 2393)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_KERNEL-BIGSMP-2399.NASL
    description This kernel update fixes the following security problems : - A bug within the UDF filesystem that caused machine hangs when truncating files on the filesystem was fixed. [#186226]. (CVE-2006-4145) - A potential crash when receiving IPX packets was fixed. This problem is thought not to be exploitable. [#197809] - A problem in DVB packet handling could be used to crash the machine when receiving DVB net packages is active. [#201429]. (CVE-2006-4623) - A struct file leak was fixed in the perfmon(2) system call on the Itanium architecture. [#202269]. (CVE-2006-3741) - A malformed ELF image can be used on the Itanium architecture to trigger a kernel crash (denial of service) when a local attacker can supply it to be started. [#203822]. (CVE-2006-4538) - A problem in the ATM protocol handling clip_mkip function could be used by remote attackers to potentially crash the machine. [#205383]. (CVE-2006-4997) CVE-2006-5757/ - A problem in the grow_buffers function could be used to crash or hang the machine using a corrupted filesystem. This affects filesystem types ISO9660 and NTFS. [#205384]. (CVE-2006-6060) - On the i386 architecture the ELFAGS content was not correctly saved, which could be used by local attackers to crash other programs using the AC and NT flag or to escalate privileges by waiting for iopl privileges to be leaked. [#209386]. (CVE-2006-5173) - On the S/390 architecture copy_from_user() could be used by local attackers to read kernel memory. [#209880]. (CVE-2006-5174) - A problem in IPv6 flowlabel handling can be used by local attackers to hang the machine. [#216590]. (CVE-2006-5619) - On the PowerPC architecture a syscall has been wired without the proper futex implementation that can be exploited by a local attacker to hang the machine. [#217295]. (CVE-2006-5648) - On the PowerPC architecture the proper futex implementation was missing a fix for alignment check which could be used by a local attacker to crash the machine. [#217295]. (CVE-2006-5649) - A problem in cramfs could be used to crash the machine during mounting a crafted cramfs image. This requires an attacker to supply such a crafted image and have a user mount it. [#218237]. (CVE-2006-5823) - A problem in the ext3 filesystem could be used by attackers able to supply a crafted ext3 image to cause a denial of service or further data corruption if a user mounts this image. [#220288]. (CVE-2006-6053) - Missing return code checking in the HFS could be used to crash machine when a user complicit attacker is able to supply a specially crafted HFS image. [#221230]. (CVE-2006-6056) - Multiple unspecified vulnerabilities in netfilter for IPv6 code allow remote attackers to bypass intended restrictions via fragmentation attack vectors, aka (1) 'ip6_tables protocol bypass bug' and (2) 'ip6_tables extension header bypass bug'. [#221313]. (CVE-2006-4572) - An integer overflow in the networking bridge ioctl starting with Kernel 2.6.7 could be used by local attackers to overflow kernel memory buffers and potentially escalate privileges [#222656]. (CVE-2006-5751) and the following non security bugs : - patches.fixes/dm-bio_list_merge-fix.diff: device-mapper snapshot: bio_list fix [#117435] - patches.fixes/statd-refcount-fix: Fix refcounting problems in host management in lockd. [#148009] - patches.fixes/i8042-reentry: Prevents i8042_interrupt() from being reentered. [#167187] - patches.suse/bonding-workqueue: Replace system timer with work queue in monitor functions. Remove rtnl_lock calls in monitor functions added in original version. [#174843] [#205196] - patches.arch/i386-profile-pc: i386: Account spinlocks to the caller during profiling for !FP kernels [#176770] - patches.arch/add-user-mode: i386/x86-64: Add user_mode checks to profile_pc for oprofile [#176770] - patches.drivers/aic7xxx-max-sectors-adjust: Adjust .max_sectors to 8192 for aic7xxx [#177059] - patches.xen/xen-x86-dcr-fallback: Add fallback when XENMEM_exchange fails to replace contiguous region [#181869] - patches.suse/lkcd-support-large-minor-number: LKCD should support minor numbers > 256 [#185125] - patches.fixes/scsi-scan-limit-luns-seqscan-16k: Limit sequential scan to 16k LUNs [#185164] - patches.drivers/powernow-ext-mask: Handle extended powernow vid mask properly [#185654] - patches.fixes/xfs-unlink-recovery-fix: [XFS] unlink recovery fix. ([#185796] - patches.suse/lkcd-dont-lose-one-page: Fix incorrect dumps on machines with memory holes [#186169] - patches.fixes/ieee80211-orinoco_ap_workaround.diff: ieee80211: workaround for broken Orinoco access points [#186879] - patches.fixes/sched-group-exclusive: Fix scheduler crash with exclusive cpusets [#188921] - patches.fixes/bdev-imapping-race.diff: Fix race between sync_single_inode() and iput() [#188950] - patches.fixes/scsi-scan-blist-update: Update blacklist entries for EMC Symmetrix and HP EVA [#191648] - patches.arch/ia64-mce-output: Save/restore oops_in_progress around printing machine checks [#191901] - patches.fixes/scsi-add-device-oops-during-eh: Fix Oops in scsi_add_device during EH [#195050] - Included a set of fixes for [#195940] - patches.fixes/dm-fix-alloc_dev-error_path.patch: call free_minor in alloc_dev error path. patches.fixes/dm-snapshot-fix-origin_write-pe-submission .patch: fix origin_write pending_exception submission. - patches.fixes/dm-snapshot-replace-sibling-list.patch: replace sibling list. - patches.fixes/dm-snapshot-fix-pending-pe-ref.patch: fix references to pending pe. - patches.fixes/dm-snapshot-fix-invalidation.patch: fix invalidation. - patches.fixes/dm-kcopyd-error-accumulation-fix.patch: kcopyd should accumulate errors. patches.fixes/dm-snapshot-fix-metadata-error-handling.patch: fix read_metadata error handling. patches.fixes/dm-snapshot-fix-metadata-writing-when-suspending.patch: fix metadata writing when suspending. - patches.fixes/nat-t-pskb-pull.patch: Fix NAT-T VPN with certain ethernet chips, in particular recent e1000 chips. [#196747] - patches.drivers/e1000-update: Update so that we no longer break the 'Disable Packet Split for PCI express adapters' driver option. - patches.fixes/e1000-no-packet-split: Discard, no longer needed. - patches.arch/acpi_T60_ultrabay.patch: Add T60 ACPI dock station path to ibm_acpi module [#196884] - patches.fixes/acpi_battery_hotplug_fix.patch: Workaround ACPI misdesign to recon dock station when booting undocked. - patches.fixes/acpi_ibm_dock_fix_not_present.patch: Workaround ACPI misdesign to recon dock station when booting undocked [#196884] - patches.arch/x86_64-monotonic-clock: Fix monotonic clock on x86-64 [#197548] - patches.fixes/nfs-truncate-race: Fix a race when truncating over NFS and writing via mmap [#198023] - patches.drivers/libata-no-spindown-on-shutdown: Don't spindown SCSI disks when rebooting [#198687] - patches.drivers/qla2xxx-reset-fix: allow reset for qla2xxx via sg_reset [#200325] - kabi/s390/symvers-default: Update kABI symbols [#202134] - patches.suse/bond_alb_deadlock_fix: bonding: fix deadlock on high loads in bond_alb_monitor(). [#202512] - patches.arch/i386-fix-tsc-selection: Fix TSC timer selection on i386 [#203713] - patches.drivers/aic94xx-remove-flash-manfid-reliance: Remove reliance on the FLASH MANFID [#203768] - patches.fixes/xfs-kern-205110-xfs_dio_locking: Fix ABBA deadlock between i_mutex and iolock [#205110] - patches.suse/bonding-workqueue: Replace system timer with work queue in monitor functions. Remove rtnl_lock calls in monitor functions added in original version. [#174843] [#205196] - add patches.fixes/fix-incorrect-hugepage-interleaving.patch fix NUMA interleaving for huge pages [#205268] - patches.suse/bondalb-hashtbl.patch: fix hang in bonding ALB driver. [#206629] patches.drivers/usb-add-raritan-kvm-usb-dongle-to-the-hi d_quirk_noget-blacklist.patch: USB: add Raritan KVM USB Dongle to the HID_QUIRK_NOGET blacklist [#206932] - patches.arch/ia64-mca_asm-set_kernel_registers: [IA64] set ar.fpsr on MCA/INIT kernel entry. [#206967] - patches.fixes/md-bitmap-ffz: Use ffz instead of find_first_set to convert multiplier to shift. [#207679] - patches.fixes/md-bitmap-compat-ioctl: Allow SET_BITMAP_FILE to work on 64bit kernel with 32bit userspace. [#207688] - patches.drivers/mpt-rport-stall: Fix MPT oops during aborting commands [#207768] - patches.drivers/libata-jmicron-update: Fix handling of JMicron controller [#207939] - patches.arch/i386-mmconfig-flush: arch/i386/pci/mmconfig.c tlb flush fix [#208414] - patches.fixes/scsi-fix-req-page-count: scsi_lib.c: properly count the number of pages in scsi_req_map_sg() [#208782] - patches.fixes/fix-processor-placement.diff: sched: Fix longstanding load balancing bug in the scheduler [#209460]. - patches.arch/x86_64-fpu-corruption: Fix FPU corruption [#209903] - patches.drivers/qla1280-bus-reset-handling: performance slowdown after bus reset on qla12160 HBA [#213717] - patches.drivers/qla1280-scb-timeout: qla1280 times out on long operations such as tape rewind [#214695] - patches.fixes/slab-per-cpu-data: Make slab initialization use per cpu data of correction CPU [#216316] - patches.fixes/ocfs2-network-send-lock.diff: ocfs2: introduce sc->sc_send_lock to protect outbound network messages [#216912] - marked module megaraid_sas as supported - marked module jsm as supported [#218969] - patches.suse/ocfs2-13-fix-quorum-work.diff: ocfs2: outstanding scheduled work can oops when quorum is shut down [#220694] - patches.xen/xen-x86_64-agp: add missing header [#222174] [#224170] - patches.fixes/md-rebuild-fix: md: Fix bug where a rebuild of spares, when interrupted by a rebuild, doesn't always get properly completed once the system is back up, leading to filesystem corruption. [#224960]. - patches.fixes/scsi-sdev-initialisation-block-race: SCSI midlayer race: scan vs block/unblock deadlocks sdev [#225770]
    last seen 2019-02-21
    modified 2012-05-17
    plugin id 29490
    published 2007-12-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=29490
    title SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 2399)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-416-1.NASL
    description Mark Dowd discovered that the netfilter iptables module did not correcly handle fragmented IPv6 packets. By sending specially crafted packets, a remote attacker could exploit this to bypass firewall rules. This has has already been fixed for Ubuntu 6.10 in USN-395-1; this is the corresponding fix for Ubuntu 6.06.(CVE-2006-4572) Doug Chapman discovered an improper lock handling in the mincore() function. A local attacker could exploit this to cause an eternal hang in the kernel, rendering the machine unusable. (CVE-2006-4814) Al Viro reported that the ISDN PPP module did not initialize the reset state timer. By sending specially crafted ISDN packets, a remote attacker could exploit this to crash the kernel. (CVE-2006-5749) Various syscalls (like listxattr()) misinterpreted the return value of return_EIO() when encountering bad inodes. By issuing particular system calls on a malformed file system, a local attacker could exploit this to crash the kernel. (CVE-2006-5753) The task switching code did not save and restore EFLAGS of processes. By starting a specially crafted executable, a local attacker could exploit this to eventually crash many other running processes. This only affects the amd64 platform. (CVE-2006-5755) A race condition was found in the grow_buffers() function. By mounting a specially crafted ISO9660 or NTFS file system, a local attacker could exploit this to trigger an infinite loop in the kernel, rendering the machine unusable. (CVE-2006-5757) A buffer overread was found in the zlib_inflate() function. By tricking an user into mounting a specially crafted file system which uses zlib compression (such as cramfs), this could be exploited to crash the kernel. (CVE-2006-5823) The ext3 file system driver did not properly handle corrupted data structures. By mounting a specially crafted ext3 file system, a local attacker could exploit this to crash the kernel. (CVE-2006-6053) The ext2 file system driver did not properly handle corrupted data structures. By mounting a specially crafted ext2 file system, a local attacker could exploit this to crash the kernel. (CVE-2006-6054) The hfs file system driver did not properly handle corrupted data structures. By mounting a specially crafted hfs file system, a local attacker could exploit this to crash the kernel. This only affects systems which enable SELinux (Ubuntu disables SELinux by default). (CVE-2006-6056) Several vulnerabilities have been found in the GFS2 file system driver. Since this driver has never actually worked in Ubuntu 6.10, it has been disabled. This only affects Ubuntu 6.10. (CVE-2006-6057) Marcel Holtman discovered several buffer overflows in the Bluetooth driver. By sending Bluetooth packets with specially crafted CAPI messages, a remote attacker could exploit these to crash the kernel. (CVE-2006-6106). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-28
    plugin id 28005
    published 2007-11-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=28005
    title Ubuntu 5.10 / 6.06 LTS / 6.10 : linux-source-2.6.12/2.6.15/2.6.17 vulnerabilities (USN-416-1)
refmap via4
bid 20955
bugtraq 20070615 rPSA-2007-0124-1 kernel xen
confirm
mandriva MDKSA-2006:197
mlist [linux-kernel] 20061105 Linux 2.6.16.31-rc1
secunia
  • 22731
  • 22762
  • 23384
  • 23474
  • 24098
  • 25691
suse SUSE-SA:2006:079
ubuntu
  • USN-395-1
  • USN-416-1
vupen ADV-2006-4386
statements via4
contributor Mark J Cox
lastmodified 2007-03-14
organization Red Hat
statement Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.
Last major update 19-03-2012 - 00:00
Published 06-11-2006 - 19:07
Back to Top