Mandrake Linux Security Advisory : kernel (MDKSA-2006:182)

High Nessus Plugin ID 24567


The remote Mandrake Linux host is missing one or more security updates.


A number of vulnerabilities were discovered and corrected in the Linux 2.6 kernel :

Stephane Eranian discovered an issue with permon2.0 where, under certain circumstances, the perfmonctl() system call may not correctly manage the file descriptor reference count, resulting in the system possibly running out of file structure (CVE-2006-3741).

Prior to and including 2.6.17, the Universal Disk Format (UDF) filesystem driver allowed local users to cause a DoS (hang and crash) via certain operations involving truncated files (CVE-2006-4145).

Various versions of the Linux kernel allowed local users to cause a DoS (crash) via an SCTP socket with a certain SO_LINGER value, which is possibly related to the patch used to correct CVE-2006-3745 (CVE-2006-4535).

The Unidirectional Lightweight Encapsulation (ULE) decapsulation component in the dvb driver allows remote attackers to cause a DoS (crash) via an SNDU length of 0 in a ULE packet (CVE-2006-4623).

The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels immediately and reboot to effect the fixes.

In addition to these security fixes, other fixes have been included such as :

- added support for new devices: o NetXtreme BCM5715 gigabit ethernet o NetXtreme II BCM5708 gigabit ethernet
- enabled the CISS driver for Xen kernels - updated ich8 support in ata_piix - enabled support for 1078 type controller in megaraid_sas - multiple fixes for RSBAC support

To update your kernel, please follow the directions located at :


Update the affected packages.

Plugin Details

Severity: High

ID: 24567

File Name: mandrake_MDKSA-2006-182.nasl

Version: $Revision: 1.14 $

Type: local

Published: 2007/02/18

Modified: 2015/03/19

Dependencies: 12634

Risk Information

Risk Factor: High


Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:kernel-, p-cpe:/a:mandriva:linux:kernel-BOOT-, p-cpe:/a:mandriva:linux:kernel-i586-up-1GB-, p-cpe:/a:mandriva:linux:kernel-i686-up-4GB-, p-cpe:/a:mandriva:linux:kernel-smp-, p-cpe:/a:mandriva:linux:kernel-source-, p-cpe:/a:mandriva:linux:kernel-source-stripped-, p-cpe:/a:mandriva:linux:kernel-xbox-, p-cpe:/a:mandriva:linux:kernel-xen0-, p-cpe:/a:mandriva:linux:kernel-xenU-, p-cpe:/a:mandriva:linux:lib64rsbac1, p-cpe:/a:mandriva:linux:lib64rsbac1-devel, p-cpe:/a:mandriva:linux:lib64rsbac1-static-devel, p-cpe:/a:mandriva:linux:librsbac1, p-cpe:/a:mandriva:linux:librsbac1-devel, p-cpe:/a:mandriva:linux:librsbac1-static-devel, p-cpe:/a:mandriva:linux:rsbac-admin, p-cpe:/a:mandriva:linux:rsbac-admin-doc, p-cpe:/a:mandriva:linux:xen, cpe:/o:mandriva:linux:2006

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2006/10/11

Reference Information

CVE: CVE-2006-3741, CVE-2006-4145, CVE-2006-4535, CVE-2006-4623

BID: 19562, 19939, 20361

MDKSA: 2006:182

CWE: 399