Welcome to our website
To take full advantage of all features you need to login or register. Registration is completely free and takes only a few seconds.
DSA 481-1: New Linux 2.4.17 packages fix local root exploit (ia64)
Posted by Philipp Esselbach on: 04/14/2004 11:18 AM [ Print | 0 comment(s) ]
New Kernel 2.4.17 packages (ia64) has been released for Debian GNU/Linux
---------------------------------------------------------------------------
Debian Security Advisory DSA 481-1 security@debian.org
http://www.debian.org/security/ Martin Schulze
April 14th, 2004 http://www.debian.org/security/faq
---------------------------------------------------------------------------
Package : kernel-image-2.4.17-ia64
Vulnerability : several vulnerabilities
Problem-Type : local
Debian-specific: no
CVE ID : CAN-2004-0003 CAN-2004-0010 CAN-2004-0109 CAN-2004-0177 CAN-2004-0178
Several serious problems have been discovered in the Linux kernel. This update takes care of Linux 2.4.17 for the IA-64 architecture. The Common Vulnerabilities and Exposures project identifies the following problems that will be fixed with this update:
---------------------------------------------------------------------------
Debian Security Advisory DSA 481-1 security@debian.org
http://www.debian.org/security/ Martin Schulze
April 14th, 2004 http://www.debian.org/security/faq
---------------------------------------------------------------------------
Package : kernel-image-2.4.17-ia64
Vulnerability : several vulnerabilities
Problem-Type : local
Debian-specific: no
CVE ID : CAN-2004-0003 CAN-2004-0010 CAN-2004-0109 CAN-2004-0177 CAN-2004-0178
Several serious problems have been discovered in the Linux kernel. This update takes care of Linux 2.4.17 for the IA-64 architecture. The Common Vulnerabilities and Exposures project identifies the following problems that will be fixed with this update:
CAN-2004-0003
A vulnerability has been discovered in the R128 drive in the Linux kernel which could potentially lead an attacker to gain unauthorised privileges. Alan Cox and Thomas Biege developed a correction for this
CAN-2004-0010
Arjan van de Ven discovered a stack-based buffer overflow in the ncp_lookup function for ncpfs in the Linux kernel, which could lead an attacker to gain unauthorised privileges. Petr Vandrovec developed a correction for this.
CAN-2004-0109
zen-parse discovered a buffer overflow vulnerability in the ISO9660 filesystem component of Linux kernel which could be abused by an attacker to gain unauthorised root access. Sebastian Krahmer and Ernie Petrides developed a correction for this.
CAN-2004-0177
Solar Designer discovered an information leak in the ext3 code of Linux. In a worst case an attacker could read sensitive data such as cryptographic keys which would otherwise never hit disk media. Theodore Ts'o developed a correction for this.
CAN-2004-0178
Andreas Kies discovered a denial of service condition in the Sound Blaster driver in Linux. He also developed a correction for this.
These problems will also be fixed by upstream in Linux 2.4.26 and future versions of 2.6.
For the stable distribution (woody) these problems have been fixed in version 011226.17 for Linux 2.4.17.
For the unstable distribution (sid) these problems have been fixed in version 2.4.25-5 for Linux 2.4.25 and in version 2.6.5-1 for Linux 2.6.5.
We recommend that you upgrade your kernel packages immediately, either with a Debian provided kernel or with a self compiled one.
Upgrade Instructions
---------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the footer to the proper configuration.
Debian GNU/Linux 3.0 alias woody
---------------------------------
Source archives:
http://security.debian.org/pool/updates/main/k/kernel-image-2.4.17-ia64/kernel-image-2.4.17-ia64_011226.17.dsc
Size/MD5 checksum: 736 2f8bdbd5d82c972dee55ae3eb3051ebf
http://security.debian.org/pool/updates/main/k/kernel-image-2.4.17-ia64/kernel-image-2.4.17-ia64_011226.17.tar.gz
Size/MD5 checksum: 25407685 a4f251ad4275ee197e3f5b3aa76c45c9
Architecture independent components:
http://security.debian.org/pool/updates/main/k/kernel-image-2.4.17-ia64/kernel-source-2.4.17-ia64_011226.17_all.deb
Size/MD5 checksum: 24730726 c6133857bb4423ecec496517f212da70
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/k/kernel-image-2.4.17-ia64/kernel-headers-2.4.17-ia64_011226.17_ia64.deb
Size/MD5 checksum: 3635930 ee77880f4ae85e0850115788e0bc18e6
http://security.debian.org/pool/updates/main/k/kernel-image-2.4.17-ia64/kernel-image-2.4.17-itanium_011226.17_ia64.deb
Size/MD5 checksum: 7020714 942615101e2eb34833f53fa6eb7713d2
http://security.debian.org/pool/updates/main/k/kernel-image-2.4.17-ia64/kernel-image-2.4.17-itanium-smp_011226.17_ia64.deb
Size/MD5 checksum: 7169180 04d65a0c0eae8b01488383ada809a936
http://security.debian.org/pool/updates/main/k/kernel-image-2.4.17-ia64/kernel-image-2.4.17-mckinley_011226.17_ia64.deb
Size/MD5 checksum: 7011536 5388a3be55dfe67c54355d6974f26400
http://security.debian.org/pool/updates/main/k/kernel-image-2.4.17-ia64/kernel-image-2.4.17-mckinley-smp_011226.17_ia64.deb
Size/MD5 checksum: 7161438 7fca8b5dbaf833e15810acde2ad678de
These files will probably be moved into the stable distribution on its next revision.
A vulnerability has been discovered in the R128 drive in the Linux kernel which could potentially lead an attacker to gain unauthorised privileges. Alan Cox and Thomas Biege developed a correction for this
CAN-2004-0010
Arjan van de Ven discovered a stack-based buffer overflow in the ncp_lookup function for ncpfs in the Linux kernel, which could lead an attacker to gain unauthorised privileges. Petr Vandrovec developed a correction for this.
CAN-2004-0109
zen-parse discovered a buffer overflow vulnerability in the ISO9660 filesystem component of Linux kernel which could be abused by an attacker to gain unauthorised root access. Sebastian Krahmer and Ernie Petrides developed a correction for this.
CAN-2004-0177
Solar Designer discovered an information leak in the ext3 code of Linux. In a worst case an attacker could read sensitive data such as cryptographic keys which would otherwise never hit disk media. Theodore Ts'o developed a correction for this.
CAN-2004-0178
Andreas Kies discovered a denial of service condition in the Sound Blaster driver in Linux. He also developed a correction for this.
These problems will also be fixed by upstream in Linux 2.4.26 and future versions of 2.6.
For the stable distribution (woody) these problems have been fixed in version 011226.17 for Linux 2.4.17.
For the unstable distribution (sid) these problems have been fixed in version 2.4.25-5 for Linux 2.4.25 and in version 2.6.5-1 for Linux 2.6.5.
We recommend that you upgrade your kernel packages immediately, either with a Debian provided kernel or with a self compiled one.
Upgrade Instructions
---------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the footer to the proper configuration.
Debian GNU/Linux 3.0 alias woody
---------------------------------
Source archives:
http://security.debian.org/pool/updates/main/k/kernel-image-2.4.17-ia64/kernel-image-2.4.17-ia64_011226.17.dsc
Size/MD5 checksum: 736 2f8bdbd5d82c972dee55ae3eb3051ebf
http://security.debian.org/pool/updates/main/k/kernel-image-2.4.17-ia64/kernel-image-2.4.17-ia64_011226.17.tar.gz
Size/MD5 checksum: 25407685 a4f251ad4275ee197e3f5b3aa76c45c9
Architecture independent components:
http://security.debian.org/pool/updates/main/k/kernel-image-2.4.17-ia64/kernel-source-2.4.17-ia64_011226.17_all.deb
Size/MD5 checksum: 24730726 c6133857bb4423ecec496517f212da70
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/k/kernel-image-2.4.17-ia64/kernel-headers-2.4.17-ia64_011226.17_ia64.deb
Size/MD5 checksum: 3635930 ee77880f4ae85e0850115788e0bc18e6
http://security.debian.org/pool/updates/main/k/kernel-image-2.4.17-ia64/kernel-image-2.4.17-itanium_011226.17_ia64.deb
Size/MD5 checksum: 7020714 942615101e2eb34833f53fa6eb7713d2
http://security.debian.org/pool/updates/main/k/kernel-image-2.4.17-ia64/kernel-image-2.4.17-itanium-smp_011226.17_ia64.deb
Size/MD5 checksum: 7169180 04d65a0c0eae8b01488383ada809a936
http://security.debian.org/pool/updates/main/k/kernel-image-2.4.17-ia64/kernel-image-2.4.17-mckinley_011226.17_ia64.deb
Size/MD5 checksum: 7011536 5388a3be55dfe67c54355d6974f26400
http://security.debian.org/pool/updates/main/k/kernel-image-2.4.17-ia64/kernel-image-2.4.17-mckinley-smp_011226.17_ia64.deb
Size/MD5 checksum: 7161438 7fca8b5dbaf833e15810acde2ad678de
These files will probably be moved into the stable distribution on its next revision.
