Debian Security Advisory DSA 358-1
Posted: 2003-08-01 09:15
Es gibt neue kernel images und sourcen ...New kernel source and i386, alpha kernel images fix multiple vulnerabilities
Resources for System-Administrators
https://www.rootforum.org/forum/
Es gibt neue kernel images und sourcen ...New kernel source and i386, alpha kernel images fix multiple vulnerabilities
*grinZ*arty wrote:Da gehen wieder die Uptimes flöten.... :?
Ja, das würde ich auch gerne wissen. Weiss dazu schon jemand näheres?dea wrote:Ich frag' mich nur, inwiefern mein 2.4.21er davon betroffen ist ...
byeA number of vulnerabilities have been discovered in the Linux kernel.
- - CAN-2003-0461: /proc/tty/driver/serial in Linux 2.4.x reveals the
exact number of characters used in serial links, which could allow
local users to obtain potentially sensitive information such as the
length of passwords. This bug has been fixed by restricting access
to /proc/tty/driver/serial.
- - CAN-2003-0462: A race condition in the way env_start and env_end
pointers are initialized in the execve system call and used in
fs/proc/base.c on Linux 2.4 allows local users to cause a denial of
service (crash).
- - CAN-2003-0476: The execve system call in Linux 2.4.x records the
file descriptor of the executable process in the file table of the
calling process, which allows local users to gain read access to
restricted file descriptors.
- - CAN-2003-0501: The /proc filesystem in Linux allows local users to
obtain sensitive information by opening various entries in
/proc/self before executing a setuid program, which causes the
program to fail to change the ownership and permissions of those
entries.
- - CAN-2003-0550: The STP protocol, as enabled in Linux 2.4.x, does not
provide sufficient security by design, which allows attackers to
modify the bridge topology. This bug has been fixed by disabling
STP by default.
- - CAN-2003-0551: The STP protocol, as enabled in Linux 2.4.x, does not
provide sufficient security by design, which allows attackers to
modify the bridge topology.
- - CAN-2003-0552: Linux 2.4.x allows remote attackers to spoof the
bridge forwarding table via forged packets whose source addresses
are the same as the target.
- - CAN-2003-0018: Linux kernel 2.4.10 through 2.4.21-pre4 does not
properly handle the O_DIRECT feature, which allows local attackers
with write privileges to read portions of previously deleted files,
or cause file system corruption. This bug has been fixed by
disabling O_DIRECT.
- - CAN-2003-0619: Integer signedness error in the decode_fh function of
nfs3xdr.c in Linux kernel before 2.4.21 allows remote attackers to
cause a denial of service (kernel panic) via a negative size value
within XDR data of an NFSv3 procedure call.
Danke, danke. Aber das ist mir schon klar, ich lese die Liste ja selbst. :)Hi dodolin,
in dem neuen Kernel sind neue Fixes drin, u.a. der Fix für den NFS-Bug. Hier die Auflistung:
Code: Select all
kernel-image-2.4.18-1-i386 (2.4.18-10) stable-security; urgency=high
* Rebuilt against kernel-source 2.4.18-12 (closes: #203802).
. Fixed is_dumpable crash in include/linux/sched.h.
-- Herbert Xu <herbert#debian.org> Sat, 2 Aug 2003 09:18:34 +1000
Das ich das mal erleben durfte... Inzwischen gibt es auch das DSA dafür, ich war also wohl nur etwas schneller als das DSA. Krass! :)BTW: Es gibt schon wieder neue i386 Kernel-Pakete von Debian stable, diesesmal allerdings ohne DSA?!