Bugtraq: [SECURITY] [DSA 1428-2] New Linux 2.6.18 packages fix several vulnerabilities
[SECURITY] [DSA 1428-2] New Linux 2.6.18 packages fix several vulnerabilities
From: dann frazier <dannf_at_debian.org>
Date: Tue, 11 Dec 2007 21:11:50 -0700
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --------------------------------------------------------------------------
Debian Security Advisory DSA 1428-2 security_at_debian.org
http://www.debian.org/security/ dann frazier
December 11th, 2007 http://www.debian.org/security/faq
- --------------------------------------------------------------------------
Package : linux-2.6
Vulnerability : several
Problem-Type : local/remote
Debian-specific: no
CVE ID : CVE-2007-3104 CVE-2007-4997 CVE-2007-5500 CVE-2007-5904
Several local and remote vulnerabilities have been discovered in the Linux
kernel that may lead to a denial of service or the execution of arbitrary
code. The Common Vulnerabilities and Exposures project identifies the
following problems:
This is an update to DSA 1428-1 which omitted a reference to CVE-2007-5904.
CVE-2007-3104
Eric Sandeen provided a backport of Tejun Heo's fix for a local denial
of service vulnerability in sysfs. Under memory pressure, a dentry
structure maybe reclaimed resulting in a bad pointer dereference causing
an oops during a readdir.
CVE-2007-4997
Chris Evans discovered an issue with certain drivers that make use of the
Linux kernel's ieee80211 layer. A remote user could generate a malicious
802.11 frame that could result in a denial of service (crash). The ipw2100
driver is known to be affected by this issue, while the ipw2200 is
believed not to be.
CVE-2007-5500
Scott James Remnant diagnosed a coding error in the implementation of
ptrace which could be used by a local user to cause the kernel to enter
an infinite loop.
CVE-2007-5904
Przemyslaw Wegrzyn discovered an issue in the CIFS filesystem that could
allow a malicious server to cause a denial of service (crash) by overflowing
a buffer.
These problems have been fixed in the stable distribution in version
2.6.18.dfsg.1-13etch5.
The following matrix lists additional packages that were rebuilt for
compatability with or to take advantage of this update:
We recommend that you upgrade your kernel package immediately and reboot
the machine. If you have built a custom kernel from the kernel source
package, you will need to rebuild to take advantage of these fixes.
Upgrade Instructions
- --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 4.0 alias etch
- --------------------------------
These files will probably be moved into the stable distribution on
its next update.
- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ etch/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/etch/updates/main
Mailing list: debian-security-announce_at_lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFHXiyqhuANDBmkLRkRAppfAJkB1I4ecsbThwc6GIMUoWf5gQguhQCfXgQ5
tj/wHrh7em2ybtMWoQ6BYUU=
=BwSs
-----END PGP SIGNATURE-----
Received on Dec 12 2007
