Security World: [SECURITY] [DSA 1787-1] New Linux 2.6.24 packages fix several vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ----------------------------------------------------------------------
Debian Security Advisory DSA-1787-1 security@debian.org
http://www.debian.org/security/ Dann Frazier
May 2, 2009 http://www.debian.org/security/faq
- ----------------------------------------------------------------------

Package : linux-2.6.24
Vulnerability : denial of service/privilege escalation/information leak
Problem type : local/remote
Debian-specific: no
CVE Id(s) : CVE-2008-4307 CVE-2008-5079 CVE-2008-5395 CVE-2008-5700
CVE-2008-5701 CVE-2008-5702 CVE-2009-0028 CVE-2009-0029
CVE-2009-0031 CVE-2009-0065 CVE-2009-0269 CVE-2009-0322
CVE-2009-0675 CVE-2009-0676 CVE-2009-0745 CVE-2009-0834
CVE-2009-0859 CVE-2009-1046 CVE-2009-1192 CVE-2009-1242
CVE-2009-1265 CVE-2009-1337 CVE-2009-1338 CVE-2009-1439

Several vulnerabilities have been discovered in the Linux kernel that
may lead to a denial of service or privilege escalation. The Common
Vulnerabilities and Exposures project identifies the following
problems:

CVE-2008-4307

Bryn M. Reeves reported a denial of service in the NFS filesystem.
Local users can trigger a kernel BUG() due to a race condition in
the do_setlk function.

CVE-2008-5079

Hugo Dias reported a DoS condition in the ATM subsystem that can
be triggered by a local user by calling the svc_listen function
twice on the same socket and reading /proc/net/atm/*vc.

CVE-2008-5395

Helge Deller discovered a denial of service condition that allows
local users on PA-RISC systems to crash a system by attempting to
unwind a stack contiaining userspace addresses.

CVE-2008-5700

Alan Cox discovered a lack of minimum timeouts on SG_IO requests,
which allows local users of systems using ATA to cause a denial of
service by forcing drives into PIO mode.

CVE-2008-5701

Vlad Malov reported an issue on 64-bit MIPS systems where a local
user could cause a system crash by crafing a malicious binary
which makes o32 syscalls with a number less than 4000.

CVE-2008-5702

Zvonimir Rakamaric reported an off-by-one error in the ib700wdt
watchdog driver which allows local users to cause a buffer
underflow by making a specially crafted WDIOC_SETTIMEOUT ioctl
call.

CVE-2009-0028

Chris Evans discovered a situation in which a child process can
send an arbitrary signal to its parent.

CVE-2009-0029

Christian Borntraeger discovered an issue effecting the alpha,
mips, powerpc, s390 and sparc64 architectures that allows local
users to cause a denial of service or potentially gain elevated
privileges.

CVE-2009-0031

Vegard Nossum discovered a memory leak in the keyctl subsystem
that allows local users to cause a denial of service by consuming
all of kernel memory.

CVE-2009-0065

Wei Yongjun discovered a memory overflow in the SCTP
implementation that can be triggered by remote users, permitting
remote code execution.

CVE-2009-0269

Duane Griffin provided a fix for an issue in the eCryptfs
subsystem which allows local users to cause a denial of service
(fault or memory corruption).

CVE-2009-0322

Pavel Roskin provided a fix for an issue in the dell_rbu driver
that allows a local user to cause a denial of service (oops) by
reading 0 byts from a sysfs entry.

CVE-2009-0675

Roel Kluin discovered inverted logic in the skfddi driver that
permits local, unprivileged users to reset the driver statistics.

CVE-2009-0676

Clement LECIGNE discovered a bug in the sock_getsockopt function
that may result in leaking sensitive kernel memory.

CVE-2009-0745

Peter Kerwien discovered an issue in the ext4 filesystem that
allows local users to cause a denial of service (kernel oops)
during a resize operation.

CVE-2009-0834

Roland McGrath discovered an issue on amd64 kernels that allows
local users to circumvent system call audit configurations which
filter based on the syscall numbers or argument details.

CVE-2009-0859

Jiri Olsa discovered that a local user can cause a denial of
service (system hang) using a SHM_INFO shmctl call on kernels
compiled with CONFIG_SHMEM disabled. This issue does not affect
prebuilt Debian kernels.

CVE-2009-1046

Mikulas Patocka reported an issue in the console subsystem that
allows a local user to cause memory corruption by selecting a
small number of 3-byte UTF-8 characters.

CVE-2009-1192

Shaohua Li reported an issue in the AGP subsystem they may allow
local users to read sensitive kernel memory due to a leak of
uninitialized memory.

CVE-2009-1242

Benjamin Gilbert reported a local denial of service vulnerability
in the KVM VMX implementation that allows local users to trigger
an oops.

CVE-2009-1265

Thomas Pollet reported an overflow in the af_rose implementation
that allows remote attackers to retrieve uninitialized kernel
memory that may contain sensitive data.

CVE-2009-1337

Oleg Nesterov discovered an issue in the exit_notify function that
allows local users to send an arbitrary signal to a process by
running a program that modifies the exit_signal field and then
uses an exec system call to launch a setuid application.

CVE-2009-1338

Daniel Hokka Zakrisson discovered that a kill(-1) is permitted to
reach processes outside of the current process namespace.

CVE-2009-1439

Pavan Naregundi reported an issue in the CIFS filesystem code that
allows remote users to overwrite memory via a long
nativeFileSystem field in a Tree Connect response during mount.

For the stable distribution (etch), these problems have been fixed in
version 2.6.24-6~etchnhalf.8etch1.

We recommend that you upgrade your linux-2.6.24 packages.

Note: Debian 'etch' includes linux kernel packages based upon both the
2.6.18 and 2.6.24 linux releases. All known security issues are
carefully tracked against both packages and both packages will receive
security updates until security support for Debian 'etch'
concludes. However, given the high frequency at which low-severity
security issues are discovered in the kernel and the resource
requirements of doing an update, lower severity 2.6.18 and 2.6.24
updates will typically release in a staggered or "leap-frog" fashion.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 4.0 alias etch
- -------------------------------

Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-2.6.24_2.6.24-6~etchnhalf.8etch1.diff.gz
Size/MD5 checksum: 4033829 ff5f9342fbd061dcab316080057bf9ac
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-2.6.24_2.6.24-6~etchnhalf.8etch1.dsc
Size/MD5 checksum: 5117 c71acfa6a187429a702d368e5974d082
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-2.6.24_2.6.24.orig.tar.gz
Size/MD5 checksum: 59630522 6b8751d1eb8e71498ba74bbd346343af

Architecture independent packages:

http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-tree-2.6.24_2.6.24-6~etchnhalf.8etch1_all.deb
Size/MD5 checksum: 82422 f39c24b3acf13eee80ab07421e120bc7
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-doc-2.6.24_2.6.24-6~etchnhalf.8etch1_all.deb
Size/MD5 checksum: 4260850 8b0891fa602714572b2ea8be13d4b2eb
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-support-2.6.24-etchnhalf.1_2.6.24-6~etchnhalf.8etch1_all.deb
Size/MD5 checksum: 96802 317936645be453126afab54705999059
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-manual-2.6.24_2.6.24-6~etchnhalf.8etch1_all.deb
Size/MD5 checksum: 1542086 460bc638a040b2674f4da6e30fc975f1
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-source-2.6.24_2.6.24-6~etchnhalf.8etch1_all.deb
Size/MD5 checksum: 46865722 b3afc19906294f1990ab97e6c8943285
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-patch-debian-2.6.24_2.6.24-6~etchnhalf.8etch1_all.deb
Size/MD5 checksum: 917482 dc533207197184a44dcc931372534b0b

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-image-2.6.24-etchnhalf.1-amd64_2.6.24-6~etchnhalf.8etch1_amd64.deb
Size/MD5 checksum: 19480638 9f9f06adb37a611ed3f24000859beb03
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-common_2.6.24-6~etchnhalf.8etch1_amd64.deb
Size/MD5 checksum: 3654580 aac989a8eee05d7adaf9731dfdda062f
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-amd64_2.6.24-6~etchnhalf.8etch1_amd64.deb
Size/MD5 checksum: 344960 4a6f4ac493086ec243734b3b6968a2bd
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-all-amd64_2.6.24-6~etchnhalf.8etch1_amd64.deb
Size/MD5 checksum: 82010 f7713fceebf11933dd20c7db1c636df0
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-all_2.6.24-6~etchnhalf.8etch1_amd64.deb
Size/MD5 checksum: 81998 7f2d31a9d80ae34c397d90912dbbb46f

arm architecture (ARM)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-mckinley_2.6.24-6~etchnhalf.8etch1_ia64.deb
Size/MD5 checksum: 318210 76ad07637a2fac8a32d827c23f893ffa
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-image-2.6.24-etchnhalf.1-itanium_2.6.24-6~etchnhalf.8etch1_ia64.deb
Size/MD5 checksum: 32025152 eb4eec0df149a61e18ae22ef8c50eb43
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-itanium_2.6.24-6~etchnhalf.8etch1_ia64.deb
Size/MD5 checksum: 318482 a155708aa4e74d90e54a4f107221c995
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-common_2.6.24-6~etchnhalf.8etch1_ia64.deb
Size/MD5 checksum: 3567324 0e1d20a7ecbf444ad6aba30cc169963d
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-all_2.6.24-6~etchnhalf.8etch1_ia64.deb
Size/MD5 checksum: 82000 f66623c2c53891b0d92055fb032d0592
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-image-2.6.24-etchnhalf.1-mckinley_2.6.24-6~etchnhalf.8etch1_ia64.deb
Size/MD5 checksum: 32206190 62738a79d48dffcad324124d2b73f3d4
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-all-ia64_2.6.24-6~etchnhalf.8etch1_ia64.deb
Size/MD5 checksum: 82028 6aa864922de84ad84cfff13eb9ce71ee

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-all-sparc_2.6.24-6~etchnhalf.8etch1_sparc.deb
Size/MD5 checksum: 82152 88b0f93df760ac992f30c1927d0144f7
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-common_2.6.24-6~etchnhalf.8etch1_sparc.deb
Size/MD5 checksum: 3652306 42dda4de967328363df86bee8ba0c53b
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-image-2.6.24-etchnhalf.1-sparc64_2.6.24-6~etchnhalf.8etch1_sparc.deb
Size/MD5 checksum: 13022916 93538efd19eae1488128df8a3a73b957
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-sparc64_2.6.24-6~etchnhalf.8etch1_sparc.deb
Size/MD5 checksum: 263066 c796e2fd4e51ff6a66d9eec594c81386
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-image-2.6.24-etchnhalf.1-sparc64-smp_2.6.24-6~etchnhalf.8etch1_sparc.deb
Size/MD5 checksum: 13317632 e50f9515e67c38d66c58f317bf2c9292
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-sparc64-smp_2.6.24-6~etchnhalf.8etch1_sparc.deb
Size/MD5 checksum: 264930 a1d0ba75ee8eded18b4d97327ebd0291
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-all_2.6.24-6~etchnhalf.8etch1_sparc.deb
Size/MD5 checksum: 82128 6c1ebe596b196e25cb0307f78ab1f358

These changes will probably be included in the oldstable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFJ/JE8huANDBmkLRkRAlzXAJwJvkPuUoKwLYQPFVnF7t2DRIkzjQCgg8zC
w+zXZAH5HPrUZ78bMIHk8Sw=
=KhiR
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Security World

Search This Blog

Saturday, May 02, 2009

[SECURITY] [DSA 1787-1] New Linux 2.6.24 packages fix several vulnerabilities

No comments: