Updated kernel packages that fix two security issues and a bug in the Red Hat Enterprise Linux 4 kernel are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for two security issues :

* a flaw in the key serial number collision avoidance algorithm of the keyctl subsystem that allowed a local user to cause a denial of service (CVE-2007-0006, Important)

* a flaw in the file watch implementation of the audit subsystems that allowed a local user to cause a denial of service (panic). To exploit this flaw a privileged user must have previously created a watch for a file (CVE-2007-0001, Moderate)

In addition to the security issues described above, a fix for the SCTP subsystem to address a system crash which may be experienced in Telco environments has been included.

Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architecture and configurations as listed in this erratum.

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel :

A double free vulnerability in the squashfs module could allow a local user to cause a Denial of Service by mounting a crafted squashfs filesystem (CVE-2006-5701).

The zlib_inflate function allows local users to cause a crash via a malformed filesystem that uses zlib compression that triggers memory corruption (CVE-2006-5823).

The key serial number collision avoidance code in the key_alloc_serial function in kernels 2.6.9 up to 2.6.20 allows local users to cause a crash via vectors thatr trigger a null dereference (CVE-2007-0006).

The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels immediately and reboot to effect the fixes.

In addition to these security fixes, other fixes have been included such as :

  - New drivers: nozomi, UVC

    - Fixed SiS SATA support for chips on 966/968 bridges

    - Fixed issues in squashfs by updating to 3.2 (#27008)

    - Added support for SiS968 bridgest to the sis190 bridge

    - Fixed JMicron cable detection

    - Added /proc/config.gz support and enabled kexec on       x86_64

    - Other minor fixes

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

Red Hat セキュリティアドバイザリ 2007:0085 から：

2 つのセキュリティ問題と 1 つのバグを修正する更新済みのカーネルパッケージが Red Hat Enterprise Linux 4 で現在利用可能です。

Red Hat セキュリティレスポンスチームは、この更新に重大なセキュリティインパクトがあると評価しています。

Linux カーネルで、オペレーティングシステムの基本関数を処理します。

これらの新しいカーネルパッケージには、2 つのセキュリティの問題に対する修正が含まれています：

* keyctl サブシステムのキーシリアル番号衝突を回避するアルゴリズムにある欠陥により、ローカルユーザーがサービス拒否を引き起こす可能性がありました（CVE-2007-0006、重要度高）

- 監査サブシステムのファイルウォッチ実装の欠陥により、ローカルユーザーがサービス拒否（パニック）を引き起こす可能性がありました。この欠陥を悪用するには、特権ユーザーが事前にファイルのウォッチを作成する必要があります（CVE-2007-0001、重要度中）

上述したセキュリティの問題に加えて、電話会社の環境で経験されるシステムクラッシュに対処する SCTP サブシステムの修正も含まれました。

Red Hat Enterprise Linux 4 のユーザーは、このエラータに記載されているマシンアーキテクチャと構成に関連づけられたパッケージへ、カーネルをアップグレードすることが推奨されます。

Updated kernel packages that fix security issues and bugs in the Red Hat Enterprise Linux 5 kernel are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the following security issues :

* a flaw in the key serial number collision avoidance algorithm of the keyctl subsystem that allowed a local user to cause a denial of service (CVE-2007-0006, Important)

* a flaw in the Omnikey CardMan 4040 driver that allowed a local user to execute arbitrary code with kernel privileges. In order to exploit this issue, the Omnikey CardMan 4040 PCMCIA card must be present and the local user must have access rights to the character device created by the driver. (CVE-2007-0005, Moderate)

* a flaw in the core-dump handling that allowed a local user to create core dumps from unreadable binaries via PT_INTERP. (CVE-2007-0958, Low)

In addition to the security issues described above, a fix for a kernel panic in the powernow-k8 module, and a fix for a kernel panic when booting the Xen domain-0 on system with large memory installations have been included.

Red Hat would like to thank Daniel Roethlisberger for reporting an issue fixed in this erratum.

Red Hat Enterprise Linux 5 users are advised to upgrade their kernels to the packages associated with their machine architecture and configurations as listed in this erratum.

来自 Red Hat 安全公告 2007:0085：

更新后的 kernel 程序包修复了 Red Hat Enterprise Linux 4 内核中的两个安全问题和一个缺陷，现在可用。

Red Hat 安全响应团队将此更新评级为具有重要安全影响。

Linux 内核处理操作系统的基本功能。

这些新的 kernel 程序包包含针对两个安全问题的补丁：

* keyctl 子系统的密钥序列号冲突避免算法中的缺陷，允许本地用户造成拒绝服务（CVE-2007-0006，重要）

* 审计子系统的文件监视实现中的缺陷，允许本地用户造成拒绝服务（混乱）。要利用此缺陷，特权用户之前必须已为文件创建监视（CVE-2007-0001，中危）

除了上述安全问题，还包括了针对 SCTP 子系统的补丁，用于解决 Telco 环境中可能发生的系统崩溃。

建议 Red Hat Enterprise Linux 4 用户将其内核升级到此勘误表中列出的与其计算机架构和配置相关的程序包。

來自 Red Hat 安全性公告 2007:0085：

現已提供適用於 Red Hat Enterprise Linux 4 核心的更新版核心套件，可修正兩個安全性問題和一個錯誤。

Red Hat 安全性回應團隊已將此更新評等為具有重要安全性影響。

Linux 核心負責處理作業系統的基本功能。

這些新的核心套件可修正兩個安全性問題：

* keyctl 子系統的金鑰序號衝突避免演算法中存有一個瑕疵，允許本機使用者造成拒絕服務 (CVE-2007-0006，重要)

* 稽核子系統的檔案監控實作中存有一個瑕疵，允許本機使用者造成拒絕服務 (不穩定)。有權限的使用者必須先前已建立檔案監控，才能惡意利用此瑕疵 (CVE-2007-0001，中等)

除了上述安全性問題外，亦包含可讓 SCTP 子系統解決在 Telco 環境中可能發生之系統當機問題的修正。

建議 Red Hat Enterprise Linux 4 使用者將核心升級至與其機器架構和組態相關的套件 (如此錯字勘誤表所列)。

From Red Hat Security Advisory 2007:0085 :

Updated kernel packages that fix two security issues and a bug in the Red Hat Enterprise Linux 4 kernel are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for two security issues :

* a flaw in the key serial number collision avoidance algorithm of the keyctl subsystem that allowed a local user to cause a denial of service (CVE-2007-0006, Important)

* a flaw in the file watch implementation of the audit subsystems that allowed a local user to cause a denial of service (panic). To exploit this flaw a privileged user must have previously created a watch for a file (CVE-2007-0001, Moderate)

In addition to the security issues described above, a fix for the SCTP subsystem to address a system crash which may be experienced in Telco environments has been included.

Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architecture and configurations as listed in this erratum.

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel :

The 2.6.17 kernel and earlier, when running on IA64 and SPARC platforms would allow a local user to cause a DoS (crash) via a malformed ELF file (CVE-2006-4538).

The mincore function in the Linux kernel did not properly lock access to user space, which has unspecified impact and attack vectors, possibly related to a deadlock (CVE-2006-4814).

An unspecified vulnerability in the listxattr system call, when a 'bad inode' is present, could allow a local user to cause a DoS (data corruption) and possibly gain privileges via unknown vectors (CVE-2006-5753).

The zlib_inflate function allows local users to cause a crash via a malformed filesystem that uses zlib compression that triggers memory corruption (CVE-2006-5823).

The ext3fs_dirhash function could allow local users to cause a DoS (crash) via an ext3 stream with malformed data structures (CVE-2006-6053).

When SELinux hooks are enabled, the kernel could allow a local user to cause a DoS (crash) via a malformed file stream that triggers a NULL pointer derefernece (CVE-2006-6056).

The key serial number collision avoidance code in the key_alloc_serial function in kernels 2.6.9 up to 2.6.20 allows local users to cause a crash via vectors thatr trigger a null dereference (CVE-2007-0006).

The Linux kernel version 2.6.13 to 2.6.20.1 allowed a remote attacker to cause a DoS (oops) via a crafted NFSACL2 ACCESS request that triggered a free of an incorrect pointer (CVE-2007-0772).

A local user could read unreadable binaries by using the interpreter (PT_INTERP) functionality and triggering a core dump; a variant of CVE-2004-1073 (CVE-2007-0958).

The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels immediately and reboot to effect the fixes.

In addition to these security fixes, other fixes have been included such as :

  - add PCI IDs for cciss driver (HP ML370G5 / DL360G5)

    - fixed a mssive SCSI reset on megasas (Dell PE2960)

    - increased port-reset completion delay for HP       controllers (HP ML350)

    - NUMA rnage fixes for x86_64

    - various netfilter fixes

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

This kernel update fixes the following security problems :

  - CVE-2006-5751: An integer overflow in the networking     bridge ioctl starting with Kernel 2.6.7 could be used by     local attackers to overflow kernel memory buffers and     potentially escalate privileges [#222656]

  - CVE-2006-6106: Multiple buffer overflows in the     cmtp_recv_interopmsg function in the Bluetooth driver     (net/bluetooth/cmtp/capi.c) in the Linux kernel allowed     remote attackers to cause a denial of service (crash)     and possibly execute arbitrary code via CAPI messages     with a large value for the length of the (1) manu     (manufacturer) or (2) serial (serial number) field.
    [#227603]

  - CVE-2006-5749: The isdn_ppp_ccp_reset_alloc_state     function in drivers/isdn/isdn_ppp.c in the Linux kernel     does not call the init_timer function for the ISDN PPP     CCP reset state timer, which has unknown attack vectors     and results in a system crash. [#229619]

  - CVE-2006-5753: Unspecified vulnerability in the     listxattr system call in Linux kernel, when a 'bad     inode' is present, allows local users to cause a denial     of service (data corruption) and possibly gain     privileges. [#230270]

  - CVE-2007-0006: The key serial number collision avoidance     code in the key_alloc_serial function allows local users     to cause a denial of service (crash) via vectors that     trigger a null dereference. [#243003]

  - CVE-2007-0772: A remote denial of service problem on     NFSv2 mounts with ACL enabled was fixed. [#244909]

Furthermore, it catches up to the mainline kernel, version 2.6.18.8, and contains a large number of additional fixes for non security bugs.

The kernel key management code did not correctly handle key reuse. A local attacker could create many key requests, leading to a denial of service. (CVE-2007-0006)

The kernel NFS code did not correctly validate NFSACL2 ACCESS requests. If a system was serving NFS mounts, a remote attacker could send a specially crafted packet, leading to a denial of service.
(CVE-2007-0772)

When dumping core, the kernel did not correctly handle PT_INTERP processes. A local attacker could create situations where they could read the contents of otherwise unreadable executable programs.
(CVE-2007-0958).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2007-0085.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
24727	CentOS 4 : kernel (CESA-2007:0085)	Nessus	CentOS Local Security Checks	2007/2/28	2021/1/4	medium
24689	Mandrake Linux Security Advisory : kernel (MDKSA-2007:047)	Nessus	Mandriva Local Security Checks	2007/2/22	2021/1/6	medium
67456	Oracle Linux 4：カーネル（ELSA-2007-0085）	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/8/24	medium
25319	RHEL 5 : kernel (RHSA-2007:0099)	Nessus	Red Hat Local Security Checks	2007/5/25	2021/1/14	medium
67456	Oracle Linux 4：kernel (ELSA-2007-0085)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/8/24	medium
67456	Oracle Linux 4：kernel (ELSA-2007-0085)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/8/24	medium
67456	Oracle Linux 4 : kernel (ELSA-2007-0085)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/8/24	medium
24810	Mandrake Linux Security Advisory : kernel (MDKSA-2007:060)	Nessus	Mandriva Local Security Checks	2007/3/12	2021/1/6	high
24724	RHEL 4 : kernel (RHSA-2007:0085)	Nessus	Red Hat Local Security Checks	2007/2/27	2021/1/14	medium
27293	openSUSE 10 Security Update : kernel (kernel-2705)	Nessus	SuSE Local Security Checks	2007/10/17	2021/1/14	high
28048	Ubuntu 6.06 LTS / 6.10 : linux-source-2.6.15/2.6.17 vulnerabilities (USN-451-1)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	high
801425	CentOS RHSA-2007-0085 Security Check	Log Correlation Engine	Generic			high

検出

プラグインの検索

medium

medium

medium

medium

medium

medium

medium

high

medium

high

high

high