Security World: [SECURITY] [DSA 1915-1] New Linux 2.6.26 packages fix several vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ----------------------------------------------------------------------
Debian Security Advisory DSA-1915-1 security@debian.org
http://www.debian.org/security/ dann frazier
October 22, 2009 http://www.debian.org/security/faq
- ----------------------------------------------------------------------

Package : linux-2.6
Vulnerability : privilege escalation/denial of service/sensitive memory leak
Problem type : local/remote
Debian-specific: no
CVE Id(s) : CVE-2009-2695 CVE-2009-2903 CVE-2009-2908 CVE-2009-2909
CVE-2009-2910 CVE-2009-3001 CVE-2009-3002 CVE-2009-3286
CVE-2009-3290 CVE-2009-3613

Notice: Debian 5.0.4, the next point release of Debian 'lenny',
will include a new default value for the mmap_min_addr tunable.
This change will add an additional safeguard against a class of security
vulnerabilities known as "NULL pointer dereference" vulnerabilities, but
it will need to be overridden when using certain applications.
Additional information about this change, including instructions for
making this change locally in advance of 5.0.4 (recommended), can be
found at:
http://wiki.debian.org/mmap_min_addr

Several vulnerabilities have been discovered in the Linux kernel that
may lead to a denial of service, sensitive memory leak or privilege escalation.
The Common Vulnerabilities and Exposures project identifies the following
problems:

CVE-2009-2695

Eric Paris provided several fixes to increase the protection
provided by the mmap_min_addr tunable against NULL pointer
dereference vulnerabilities.

CVE-2009-2903

Mark Smith discovered a memory leak in the appletalk
implementation. When the appletalk and ipddp modules are loaded,
but no ipddp"N" device is found, remote attackers can cause a
denial of service by consuming large amounts of system memory.

CVE-2009-2908

Loic Minier discovered an issue in the eCryptfs filesystem. A
local user can cause a denial of service (kernel oops) by causing
a dentry value to go negative.

CVE-2009-2909

Arjan van de Ven discovered an issue in the AX.25 protocol
implementation. A specially crafted call to setsockopt() can
result in a denial of service (kernel oops).

CVE-2009-2910

Jan Beulich discovered the existence of a sensitive kernel memory
leak. Systems running the 'amd64' kernel do not properly sanitize
registers for 32-bit processes.

CVE-2009-3001

Jiri Slaby fixed a sensitive memory leak issue in the ANSI/IEEE
802.2 LLC implementation. This is not exploitable in the Debian
lenny kernel as root privileges are required to exploit this
issue.

CVE-2009-3002

Eric Dumazet fixed several sensitive memory leaks in the IrDA,
X.25 PLP (Rose), NET/ROM, Acorn Econet/AUN, and Controller Area
Network (CAN) implementations. Local users can exploit these
issues to gain access to kernel memory.

CVE-2009-3286

Eric Paris discovered an issue with the NFSv4 server
implementation. When an O_EXCL create fails, files may be left
with corrupted permissions, possibly granting unintentional
privileges to other local users.

CVE-2009-3290

Jan Kiszka noticed that the kvm_emulate_hypercall function in KVM
does not prevent access to MMU hypercalls from ring 0, which
allows local guest OS users to cause a denial of service (guest
kernel crash) and read or write guest kernel memory.

CVE-2009-3613

Alistair Strachan reported an issue in the r8169 driver. Remote
users can cause a denial of service (IOMMU space exhaustion and
system crash) by transmitting a large amount of jumbo frames.

For the stable distribution (lenny), this problem has been fixed in
version 2.6.26-19lenny1.

For the oldstable distribution (etch), these problems, where
applicable, will be fixed in updates to linux-2.6 and linux-2.6.24.

We recommend that you upgrade your linux-2.6 and user-mode-linux
packages.

Note: Debian carefully tracks all known security issues across every
linux kernel package in all releases under active security support.
However, given the high frequency at which low-severity security
issues are discovered in the kernel and the resource requirements of
doing an update, updates for lower priority issues will normally not
be released for all kernels at the same time. Rather, they will be
released in a staggered or "leap-frog" fashion.

The following matrix lists additional source packages that were rebuilt for
compatibility with or to take advantage of this update:

Debian 5.0 (lenny)
user-mode-linux 2.6.26-1um-2+19lenny1

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/l/linux-2.6/linux-2.6_2.6.26-19lenny1.diff.gz
Size/MD5 checksum: 7643838 b6b5d896bbc02eea1516acefb752b028
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-2.6_2.6.26.orig.tar.gz
Size/MD5 checksum: 61818969 85e039c2588d5bf3cb781d1c9218bbcb
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-2.6_2.6.26-19lenny1.dsc
Size/MD5 checksum: 5778 87d44ca47bc435ab72f03620a8cbcc6a

Architecture independent packages:

http://security.debian.org/pool/updates/main/l/linux-2.6/linux-source-2.6.26_2.6.26-19lenny1_all.deb
Size/MD5 checksum: 48675122 160e198488576fc5207a0f4f16454051
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-manual-2.6.26_2.6.26-19lenny1_all.deb
Size/MD5 checksum: 1767094 4157e016e1c4de75246ec5b13a0b10ef
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-patch-debian-2.6.26_2.6.26-19lenny1_all.deb
Size/MD5 checksum: 2555882 942a0fcf654d6c2aaa8ba343a87752f8
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-support-2.6.26-2_2.6.26-19lenny1_all.deb
Size/MD5 checksum: 122028 28a7345af55f74689d73190015b00dbc
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-doc-2.6.26_2.6.26-19lenny1_all.deb
Size/MD5 checksum: 4627708 59a9cbb3478d6f0d0ad5e7e0704e1bb8
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-tree-2.6.26_2.6.26-19lenny1_all.deb
Size/MD5 checksum: 106722 37017679870c0c9b48eebe9a1dcc42a3

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

armel architecture (ARM EABI)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iD8DBQFK4dGOhuANDBmkLRkRAsz9AJ9hz77XsBL6DO6RmIOq+rRuJLoyWQCbBh1B
7xp5wds+BgrwXt2CHpR9JIQ=
=zP1A
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Security World

Search This Blog

Friday, October 23, 2009

[SECURITY] [DSA 1915-1] New Linux 2.6.26 packages fix several vulnerabilities

No comments: