Ubuntu 14.04 LTS : linux vulnerabilities (USN-3422-1) (BlueBorne)

Ubuntu Security Notice (C) 2017 Canonical, Inc. / NASL script (C) 2017 Tenable Network Security, Inc.


Synopsis :

The remote Ubuntu host is missing one or more security-related
patches.

Description :

It was discovered that a buffer overflow existed in the Bluetooth
stack of the Linux kernel when handling L2CAP configuration responses.
A physically proximate attacker could use this to cause a denial of
service (system crash). (CVE-2017-1000251)

It was discovered that the asynchronous I/O (aio) subsystem of the
Linux kernel did not properly set permissions on aio memory mappings
in some situations. An attacker could use this to more easily exploit
other vulnerabilities. (CVE-2016-10044)

Baozeng Ding and Andrey Konovalov discovered a race condition in the
L2TPv3 IP Encapsulation implementation in the Linux kernel. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2016-10200)

Andreas Gruenbacher and Jan Kara discovered that the filesystem
implementation in the Linux kernel did not clear the setgid bit during
a setxattr call. A local attacker could use this to possibly elevate
group privileges. (CVE-2016-7097)

Sergej Schumilo, Ralf Spenneberg, and Hendrik Schwartke discovered
that the key management subsystem in the Linux kernel did not properly
allocate memory in some situations. A local attacker could use this to
cause a denial of service (system crash). (CVE-2016-8650)

Vlad Tsyrklevich discovered an integer overflow vulnerability in the
VFIO PCI driver for the Linux kernel. A local attacker with access to
a vfio PCI device file could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2016-9083,
CVE-2016-9084)

It was discovered that an information leak existed in
__get_user_asm_ex() in the Linux kernel. A local attacker could use
this to expose sensitive information. (CVE-2016-9178)

CAI Qian discovered that the sysctl implementation in the Linux kernel
did not properly perform reference counting in some situations. An
unprivileged attacker could use this to cause a denial of service
(system hang). (CVE-2016-9191)

It was discovered that the keyring implementation in the Linux kernel
in some situations did not prevent special internal keyrings from
being joined by userspace keyrings. A privileged local attacker could
use this to bypass module verification. (CVE-2016-9604)

It was discovered that an integer overflow existed in the trace
subsystem of the Linux kernel. A local privileged attacker could use
this to cause a denial of service (system crash). (CVE-2016-9754)

Andrey Konovalov discovered that the IPv4 implementation in the Linux
kernel did not properly handle invalid IP options in some situations.
An attacker could use this to cause a denial of service or possibly
execute arbitrary code. (CVE-2017-5970)

Dmitry Vyukov discovered that the Linux kernel did not properly handle
TCP packets with the URG flag. A remote attacker could use this to
cause a denial of service. (CVE-2017-6214)

It was discovered that a race condition existed in the AF_PACKET
handling code in the Linux kernel. A local attacker could use this to
cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2017-6346)

It was discovered that the keyring implementation in the Linux kernel
did not properly restrict searches for dead keys. A local attacker
could use this to cause a denial of service (system crash).
(CVE-2017-6951)

Dmitry Vyukov discovered that the generic SCSI (sg) subsystem in the
Linux kernel contained a stack-based buffer overflow. A local attacker
with access to an sg device could use this to cause a denial of
service (system crash) or possibly execute arbitrary code.
(CVE-2017-7187)

Eric Biggers discovered a memory leak in the keyring implementation in
the Linux kernel. A local attacker could use this to cause a denial of
service (memory consumption). (CVE-2017-7472)

It was discovered that a buffer overflow existed in the Broadcom
FullMAC WLAN driver in the Linux kernel. A local attacker could use
this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2017-7541).

Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

Solution :

Update the affected packages.

Risk factor :

High / CVSS Base Score : 8.3
(CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.9
(CVSS2#E:F/RL:U/RC:ND)
Public Exploit Available : true

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now