Ubuntu 4.10 : linux-source-2.6.8.1 vulnerabilities (USN-103-1)

High Nessus Plugin ID 20489

New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.

VPR Score: 6.7

Synopsis

The remote Ubuntu host is missing one or more security-related patches.

Description

Mathieu Lafon discovered an information leak in the ext2 file system driver. When a new directory was created, the ext2 block written to disk was not initialized, so that previous memory contents (which could contain sensitive data like passwords) became visible on the raw device. This is particularly important if the target device is removable and thus can be read by users other than root.
(CAN-2005-0400)

Yichen Xie discovered a Denial of Service vulnerability in the ELF loader. A specially crafted ELF library or executable could cause an attempt to free an invalid pointer, which lead to a kernel crash.
(CAN-2005-0749)

Ilja van Sprundel discovered that the bluez_sock_create() function did not check its 'protocol' argument for negative values. A local attacker could exploit this to execute arbitrary code with root privileges by creating a Bluetooth socket with a specially crafted protocol number. (CAN-2005-0750)

Michal Zalewski discovered that the iso9660 file system driver fails to check ranges properly in several cases. Mounting a specially crafted CD-ROM may have caused a buffer overflow leading to a kernel crash or even arbitrary code execution. (CAN-2005-0815)

Previous kernels did not restrict the use of the N_MOUSE line discipline in the serial driver. This allowed an unprivileged user to inject mouse movement and/or keystrokes (using the sunkbd driver) into the input subsystem, taking over the console or an X session, where another user is logged in. (CAN-2005-0839)

A Denial of Service vulnerability was found in the tmpfs driver, which is commonly used to mount RAM disks below /dev/shm and /tmp. The shm_nopage() did not properly verify its address argument, which could be exploited by a local user to cause a kernel crash with invalid addresses.
(http://linux.bkbits.net:8080/linux-2.6/[email protected]_bKV fPSsg).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 20489

File Name: ubuntu_USN-103-1.nasl

Version: 1.19

Type: local

Agent: unix

Published: 2006/01/15

Updated: 2019/08/02

Dependencies: 12634

Risk Information

Risk Factor: High

VPR Score: 6.7

CVSS v2.0

Base Score: 7.2

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:canonical:ubuntu_linux:linux-doc-2.6.8.1, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6.8.1-5, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6.8.1-5-386, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6.8.1-5-686, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6.8.1-5-686-smp, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6.8.1-5-amd64-generic, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6.8.1-5-amd64-k8, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6.8.1-5-amd64-k8-smp, p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6.8.1-5-amd64-xeon, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6.8.1-5-386, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6.8.1-5-686, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6.8.1-5-686-smp, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6.8.1-5-amd64-generic, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6.8.1-5-amd64-k8, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6.8.1-5-amd64-k8-smp, p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6.8.1-5-amd64-xeon, p-cpe:/a:canonical:ubuntu_linux:linux-patch-debian-2.6.8.1, p-cpe:/a:canonical:ubuntu_linux:linux-source-2.6.8.1, p-cpe:/a:canonical:ubuntu_linux:linux-tree-2.6.8.1, cpe:/o:canonical:ubuntu_linux:4.10

Required KB Items: Host/cpu, Host/Ubuntu, Host/Ubuntu/release, Host/Debian/dpkg-l

Patch Publication Date: 2005/04/01

Reference Information

CVE: CVE-2005-0400, CVE-2005-0749, CVE-2005-0750, CVE-2005-0815, CVE-2005-0839

USN: 103-1