A vulnerability has been discovered in the Linux kernel that may lead to a denial of service. The Common Vulnerabilities and Exposures project identifies the following problem :

  - CVE-2008-1669     Alexander Viro discovered a race condition in the fcntl     code that may permit local users on multi-processor     systems to execute parallel code paths that are     otherwise prohibited and gain re-ordered access to the     descriptor table.

This is a respin of the previous kernel update, which got retracted due to an IDE-CDROM regression, where any IDE CDROM access would hang or crash the system. Only this problem was fixed additionally.

This kernel update fixes the following security problems :

  - On x86_64 a denial of service attack could be used by     local attackers to immediately panic / crash the     machine. (CVE-2008-1615)

  - Fixed a SMP ordering problem in fcntl_setlk could     potentially allow local attackers to execute code by     timing file locking. (CVE-2008-1669)

  - Fixed a resource starvation problem in the handling of     ZERO mmap pages. (CVE-2008-2372)

  - The asn1 implementation in (a) the Linux kernel, as used     in the cifs and ip_nat_snmp_basic modules does not     properly validate length values during decoding of ASN.1     BER data, which allows remote attackers to cause a     denial of service (crash) or execute arbitrary code via     (1) a length greater than the working buffer, which can     lead to an unspecified overflow; (2) an oid length of     zero, which can lead to an off-by-one error; or (3) an     indefinite length for a primitive encoding.
    (CVE-2008-1673)

  - Various tty / serial devices did not check     functionpointers for NULL before calling them, leading     to potential crashes or code execution. The devices     affected are usually only accessible by the root user     though. (CVE-2008-2812)

  - A missing permission check in mount changing was added     which could have been used by local attackers to change     the mountdirectory. (CVE-2008-2931)

Additionally a very large number of bugs was fixed. Details can be found in the RPM changelog of the included packages.

OCFS2 has been upgraded to the 1.4.1 release :

  - Endian fixes

  - Use slab caches for DLM objects

  - Export DLM state info to debugfs

  - Avoid ENOSPC in rare conditions when free inodes are     reserved by other nodes

  - Error handling fix in ocfs2_start_walk_page_trans()

  - Cleanup lockres printing

  - Allow merging of extents

  - Fix to allow changing permissions of symlinks

  - Merged local fixes upstream (no code change)

I   Service Console rpm updates

 a.  Security Update to Service Console Kernel

   This fix upgrades service console kernel version to 2.4.21-57.EL.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2007-5001, CVE-2007-6151, CVE-2007-6206,    CVE-2008-0007, CVE-2008-1367, CVE-2008-1375, CVE-2006-4814, and    CVE-2008-1669 to the security issues fixed in kernel-2.4.21-57.EL.

 b.  Samba Security Update

   This fix upgrades the service console rpm samba to version    3.0.9-1.3E.15vmw

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2008-1105 to this issue.

Updated kernel packages that fix various security issues and several bugs are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

These updated packages fix the following security issues :

* the absence of a protection mechanism when attempting to access a critical section of code has been found in the Linux kernel open file descriptors control mechanism, fcntl. This could allow a local unprivileged user to simultaneously execute code, which would otherwise be protected against parallel execution. As well, a race condition when handling locks in the Linux kernel fcntl functionality, may have allowed a process belonging to a local unprivileged user to gain re-ordered access to the descriptor table. (CVE-2008-1669, Important)

* on AMD64 architectures, the possibility of a kernel crash was discovered by testing the Linux kernel process-trace ability. This could allow a local unprivileged user to cause a denial of service (kernel crash). (CVE-2008-1615, Important)

* the absence of a protection mechanism when attempting to access a critical section of code, as well as a race condition, have been found in the Linux kernel file system event notifier, dnotify. This could allow a local unprivileged user to get inconsistent data, or to send arbitrary signals to arbitrary system processes. (CVE-2008-1375, Important)

Red Hat would like to thank Nick Piggin for responsibly disclosing the following issue :

* when accessing kernel memory locations, certain Linux kernel drivers registering a fault handler did not perform required range checks. A local unprivileged user could use this flaw to gain read or write access to arbitrary kernel memory, or possibly cause a kernel crash.
(CVE-2008-0007, Important)

* the possibility of a kernel crash was found in the Linux kernel IPsec protocol implementation, due to improper handling of fragmented ESP packets. When an attacker controlling an intermediate router fragmented these packets into very small pieces, it would cause a kernel crash on the receiving node during packet reassembly.
(CVE-2007-6282, Important)

* a flaw in the MOXA serial driver could allow a local unprivileged user to perform privileged operations, such as replacing firmware.
(CVE-2005-0504, Important)

As well, these updated packages fix the following bugs :

* multiple buffer overflows in the neofb driver have been resolved. It was not possible for an unprivileged user to exploit these issues, and as such, they have not been handled as security issues.

* a kernel panic, due to inconsistent detection of AGP aperture size, has been resolved.

* a race condition in UNIX domain sockets may have caused 'recv()' to return zero. In clustered configurations, this may have caused unexpected failovers.

* to prevent link storms, network link carrier events were delayed by up to one second, causing unnecessary packet loss. Now, link carrier events are scheduled immediately.

* a client-side race on blocking locks caused large time delays on NFS file systems.

* in certain situations, the libATA sata_nv driver may have sent commands with duplicate tags, which were rejected by SATA devices.
This may have caused infinite reboots.

* running the 'service network restart' command may have caused networking to fail.

* a bug in NFS caused cached information about directories to be stored for too long, causing wrong attributes to be read.

* on systems with a large highmem/lowmem ratio, NFS write performance may have been very slow when using small files.

* a bug, which caused network hangs when the system clock was wrapped around zero, has been resolved.

Red Hat Enterprise Linux 4 users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2008-0211.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2008-0233.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2008-0237.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
32309	Debian DSA-1575-1 : linux-2.6 - denial of service	Nessus	Debian Local Security Checks	2008/5/13	2021/1/4	medium
41533	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 5473)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	critical
40380	VMSA-2008-0011 : Updated ESX service console packages for Samba and vmnix	Nessus	VMware ESX Local Security Checks	2009/7/27	2021/1/6	high
43682	CentOS 4 : kernel (CESA-2008:0237)	Nessus	CentOS Local Security Checks	2010/1/6	2021/1/4	high
801449	CentOS RHSA-2008-0211 Security Check	Log Correlation Engine	Generic			high
801450	CentOS RHSA-2008-0233 Security Check	Log Correlation Engine	Generic			high
801451	CentOS RHSA-2008-0237 Security Check	Log Correlation Engine	Generic			high

检测

插件搜索

medium

critical

high

high

high

high

high