このカーネル更新では、次のセキュリティの問題を修正しています：

- 競合状態によって、これらのファイル（例、/proc/self/environ）が setuid root になる方法で、/proc/self/ ファイルのファイルモードを変更することで、ローカルのユーザーが権限を取得する可能性があります。[#192688]。
 （CVE-2006-3626）

- CDROM / DVD 処理でのスタックベースのバッファオーバーフローが修正され、これが物理的にローカルの攻撃者によって利用され、システムに自動 DVD 処理が存在するかどうかによって、カーネルのクラッシュやカーネルのコンテキストでのコードの実行が引き起こされる可能性があります。[#190396]。（CVE-2006-2935）

- prctl（PR_SET_DUMPABLE）での引数検証のエラーによって、ローカルの攻撃者が簡単に管理者（root）の権限を取得する可能性があります。[#186980]。
 （CVE-2006-2451）

さらに、以下のセキュリティ以外のバグ：

- LUN の数を 16384 に制限します[#185164]

- LSI 1030/MPT Fusion ドライバーがエラーリカバリ中にハングします -- オプションで QAS を無効にします[#180100]

- h_copy_rdma() でバッファポインターを進めて、データの破損を回避します[#186444]

此内核更新修复以下安全问题：

- 一个争用条件允许本地用户通过更改 /proc/self/ 文件的文件模式来获得根权限，更改方式是造成这些文件（例如 /proc/self/environ）成为 setuid 根。[#192688]。
 (CVE-2006-3626)

- 修复了 CDROM / DVD 处理中的一个基于堆栈的缓冲区溢出，该问题可被物理本地攻击者用于导致内核崩溃或在内核上下文内执行代码，具体取决于系统中是否存在自动 DVD 处理。[#190396]。(CVE-2006-2935)

- 由于 prctl(PR_SET_DUMPABLE) 中的一个参数验证错误，本地攻击者可轻松获得管理员（根）权限。[#186980]。
 (CVE-2006-2451)

和以下非安全缺陷：

- 将 LUN 的最大数量限制为 16384 [#185164]

- LSI 1030/MPT Fusion 驱动程序在错误恢复期间挂起 -- 可选地禁用 QAS [#180100]

- 推进 h_copy_rdma() 中的缓冲区指针以避免数据损坏 [#186444]

This kernel update fixes the following security problems :

  - A race condition allows local users to gain root     privileges by changing the file mode of /proc/self/     files in a way that causes those files (for instance     /proc/self/environ) to become setuid root. [#192688].
    (CVE-2006-3626)

  - A stack-based buffer overflow in CDROM / DVD handling     was fixed which could be used by a physical local     attacker to crash the kernel or execute code within     kernel context, depending on presence of automatic DVD     handling in the system. [#190396]. (CVE-2006-2935)

  - Due to an argument validation error in     prctl(PR_SET_DUMPABLE) a local attacker can easily gain     administrator (root) privileges. [#186980].
    (CVE-2006-2451)

and the following non security bugs :

  - Limit the maximum number of LUNs to 16384 [#185164]

  - LSI 1030/MPT Fusion driver hang during error recovery --     Optionally disable QAS [#180100]

  - advance buffer pointers in h_copy_rdma() to avoid data     corruption [#186444]

Updated kernel packages that fix a privilege escalation security issue in the Red Hat Enterprise Linux 4 kernel are now available.

This security advisory has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

During security research, Red Hat discovered a behavioral flaw in core dump handling. A local user could create a program that would cause a core file to be dumped into a directory they would not normally have permissions to write to. This could lead to a denial of service (disk consumption), or allow the local user to gain root privileges.
(CVE-2006-2451)

Prior to applying this update, users can remove the ability to escalate privileges using this flaw by configuring core files to dump to an absolute location. By default, core files are created in the working directory of the faulting application, but this can be overridden by specifying an absolute location for core files in /proc/sys/kernel/core_pattern. To avoid a potential denial of service, a separate partition for the core files should be used.

All Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

此核心更新可修正下列安全性問題：

- 有一個爭用情形，其允許本機使用者變更 /proc/self/ 檔案的檔案模式，造成這些檔案 (例如 /proc/self/environ) 成為 setuid root，進而取得 root 權限。[#192688]。
 (CVE-2006-3626)

- 已修正處理 CDROM / DVD 時發生的一個堆疊型緩衝區溢位，視系統中存在的自動化 DVD 處理而定，其可遭實體本機攻擊者利用來損毀核心，或是在核心內容中執行程式碼。[#190396]。(CVE-2006-2935)

- 由於 prctl(PR_SET_DUMPABLE) 中的一個引數驗證錯誤，本機攻擊者可輕易取得系統管理員 (root) 權限。[#186980]。
 (CVE-2006-2451)

以及下列非安全性錯誤：

- 將 LUN 的最大數量限制為 16384 [#185164]

- LSI 1030/MPT Fusion 驅動程式在錯誤復原期間懸置 -- 選擇性停用 QAS [#180100]

- 將 h_copy_rdma() 中的緩衝區指標往前移動以避免資料損毀 [#186444]

A race condition was discovered in the do_add_counters() functions.
Processes which do not run with full root privileges, but have the CAP_NET_ADMIN capability can exploit this to crash the machine or read a random piece of kernel memory. In Ubuntu there are no packages that are affected by this, so this can only be an issue for you if you use third-party software that uses Linux capabilities. (CVE-2006-0039)

John Stultz discovered a faulty BUG_ON trigger in the handling of POSIX timers. A local attacker could exploit this to trigger a kernel oops and crash the machine. (CVE-2006-2445)

Dave Jones discovered that the PowerPC kernel did not perform certain required access_ok() checks. A local user could exploit this to read arbitrary kernel memory and crash the kernel on 64-bit systems, and possibly read arbitrary kernel memory on 32-bit systems.
(CVE-2006-2448)

A design flaw was discovered in the prctl(PR_SET_DUMPABLE, ...) system call, which allowed a local user to have core dumps created in a directory he could not normally write to. This could be exploited to drain available disk space on system partitions, or, under some circumstances, to execute arbitrary code with full root privileges.
This flaw only affects Ubuntu 6.06 LTS. (CVE-2006-2451)

In addition, the Ubuntu 6.06 LTS update fixes a range of bugs.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2006-0574.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
59120	SuSE 10 セキュリティ更新：Linux カーネル（ZYPP パッチ番号 1900）	Nessus	SuSE Local Security Checks	2012/5/17	2021/1/14	medium
59120	SuSE 10 安全更新：Linux 内核（ZYPP 修补程序编号 1900）	Nessus	SuSE Local Security Checks	2012/5/17	2021/1/14	medium
29484	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 1896)	Nessus	SuSE Local Security Checks	2007/12/13	2021/1/14	medium
22015	RHEL 4 : kernel (RHSA-2006:0574)	Nessus	Red Hat Local Security Checks	2006/7/10	2021/1/14	medium
59120	SuSE 10 安全性更新：Linux 核心 (ZYPP 修補程式編號 1900)	Nessus	SuSE Local Security Checks	2012/5/17	2021/1/14	medium
22038	CentOS 4 : kernel (CESA-2006:0574)	Nessus	CentOS Local Security Checks	2006/7/13	2021/1/4	medium
27886	Ubuntu 5.04 / 5.10 / 6.06 LTS : linux-source-2.6.10/-2.6.12/-2.6.15 vulnerabilities (USN-311-1)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	medium
59120	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 1900)	Nessus	SuSE Local Security Checks	2012/5/17	2021/1/14	medium
801419	CentOS RHSA-2006-0574 Security Check	Log Correlation Engine	Generic			high

検出

プラグインの検索

medium

medium

medium

medium

medium

medium

medium

medium

high