CVE-2006-0096
CVSS7.2
发布时间 :2006-01-06 06:03:00
修订时间 :2008-11-20 00:00:00
NMCOPS    

[原文]wan/sdla.c in Linux kernel 2.6.x before 2.6.11 and 2.4.x before 2.4.29 does not require the CAP_SYS_RAWIO privilege for an SDLA firmware upgrade, with unknown impact and local attack vectors. NOTE: further investigation suggests that this issue requires root privileges to exploit, since it is protected by CAP_NET_ADMIN; thus it might not be a vulnerability, although capabilities provide finer distinctions between privilege levels.


[CNNVD]Linux Kernel SDLA IOCTL未经授权的本地固件访问漏洞(CNNVD-200601-034)

        Linux kernel 2.6.11之前的2.6.x版本以及2.4.29之前的2.4.x版本中的wan/sdla.c,不要求SDLA的CAP_SYS_RAWIO固件升级,具有未知影响和本地攻击矢量。注意:进一步调查表明,由于此问题受CAP_NET_ADMIN的保护,所以它需要使用根特权;因此,即使能够很好地区分不同特权等级,此问题可能也不是漏洞。

- CVSS (基础分值)

CVSS分值: 7.2 [严重(HIGH)]
机密性影响: COMPLETE [完全的信息泄露导致所有系统文件暴露]
完整性影响: COMPLETE [系统完整性可被完全破坏]
可用性影响: COMPLETE [可能导致系统完全宕机]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: LOCAL [漏洞利用需要具有物理访问权限或本地帐户]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/o:linux:linux_kernel:2.6.12.2Linux Kernel 2.6.12.2
cpe:/o:linux:linux_kernel:2.6.1Linux Kernel 2.6.1
cpe:/o:linux:linux_kernel:2.6.15:rc4Linux Kernel 2.6.15 Release Candidate 4
cpe:/o:linux:linux_kernel:2.6.14:rc4Linux Kernel 2.6.14 Release Candidate 4
cpe:/o:linux:linux_kernel:2.4.27Linux Kernel 2.4.27
cpe:/o:linux:linux_kernel:2.6.11.6Linux Kernel 2.6.11.6
cpe:/o:linux:linux_kernel:2.4.24_ow1
cpe:/o:linux:linux_kernel:2.4.23:pre9Linux Kernel 2.4.23 pre9
cpe:/o:linux:linux_kernel:2.4.0:test3Linux Kernel 2.4.0 test3
cpe:/o:linux:linux_kernel:2.6.14.2Linux Kernel 2.6.14.2
cpe:/o:linux:linux_kernel:2.6.11Linux Kernel 2.6.11
cpe:/o:linux:linux_kernel:2.6.9:2.6.20
cpe:/o:linux:linux_kernel:2.6.15Linux Kernel 2.6.15
cpe:/o:linux:linux_kernel:2.4.12Linux Kernel 2.4.12
cpe:/o:linux:linux_kernel:2.4.0:test8Linux Kernel 2.4.0 test8
cpe:/o:linux:linux_kernel:2.6.11.3Linux Kernel 2.6.11.3
cpe:/o:linux:linux_kernel:2.6.15:rc1Linux Kernel 2.6.15 Release Candidate 1
cpe:/o:linux:linux_kernel:2.4.19:pre3Linux Kernel 2.4.19 pre3
cpe:/o:linux:linux_kernel:2.4.23_ow2
cpe:/o:linux:linux_kernel:2.4.3Linux Kernel 2.4.3
cpe:/o:linux:linux_kernel:2.6.11.9Linux Kernel 2.6.11.9
cpe:/o:linux:linux_kernel:2.4.23Linux Kernel 2.4.23
cpe:/o:linux:linux_kernel:2.4.0:test10Linux Kernel 2.4.0 test10
cpe:/o:linux:linux_kernel:2.6.12.1Linux Kernel 2.6.12.1
cpe:/o:linux:linux_kernel:2.4.0:test1Linux Kernel 2.4.0 test1
cpe:/o:linux:linux_kernel:2.4.27:pre2Linux Kernel 2.4.27 pre2
cpe:/o:linux:linux_kernel:2.4.4Linux Kernel 2.4.4
cpe:/o:linux:linux_kernel:2.4.13Linux Kernel 2.4.13
cpe:/o:linux:linux_kernel:2.4.0:test12Linux Kernel 2.4.0 test12
cpe:/o:linux:linux_kernel:2.4.0:test2Linux Kernel 2.4.0 test2
cpe:/o:linux:linux_kernel:2.4.18:pre1Linux Kernel 2.4.18 pre1
cpe:/o:linux:linux_kernel:2.6.14.4Linux Kernel 2.6.14.4
cpe:/o:linux:linux_kernel:2.4.20Linux Kernel 2.4.20
cpe:/o:linux:linux_kernel:2.4.19:pre4Linux Kernel 2.4.19 pre4
cpe:/o:linux:linux_kernel:2.4.0:test4Linux Kernel 2.4.0 test4
cpe:/o:linux:linux_kernel:2.4.27:pre4Linux Kernel 2.4.27 pre4
cpe:/o:linux:linux_kernel:2.4.27:pre5Linux Kernel 2.4.27 pre5
cpe:/o:linux:linux_kernel:2.6.11.2Linux Kernel 2.6.11.2
cpe:/o:linux:linux_kernel:2.4.21:pre7Linux Kernel 2.4.21 pre7
cpe:/o:linux:linux_kernel:2.6.0Linux Kernel 2.6.0
cpe:/o:linux:linux_kernel:2.4.22Linux Kernel 2.4.22
cpe:/o:linux:linux_kernel:2.6.11.4Linux Kernel 2.6.11.4
cpe:/o:linux:linux_kernel:2.6.12.3Linux Kernel 2.6.12.3
cpe:/o:linux:linux_kernel:2.6.3Linux Kernel 2.6.3
cpe:/o:linux:linux_kernel:2.6.11.12Linux Kernel 2.6.11.12
cpe:/o:linux:linux_kernel:2.4.19:pre5Linux Kernel 2.4.19 pre5
cpe:/o:linux:linux_kernel:2.4.21Linux Kernel 2.4.21
cpe:/o:linux:linux_kernel:2.4.0:test6Linux Kernel 2.4.0 test6
cpe:/o:linux:linux_kernel:2.4.25Linux Kernel 2.4.25
cpe:/o:linux:linux_kernel:2.6.15:rc7Linux Kernel 2.6.15 Release Candidate 7
cpe:/o:linux:linux_kernel:2.6.15:rc5Linux Kernel 2.6.15 Release Candidate 5
cpe:/o:linux:linux_kernel:2.4.1Linux Kernel 2.4.1
cpe:/o:linux:linux_kernel:2.6.15:rc3Linux Kernel 2.6.15 Release Candidate 3
cpe:/o:linux:linux_kernel:2.4.17Linux Kernel 2.4.17
cpe:/o:linux:linux_kernel:2.4.14Linux Kernel 2.4.14
cpe:/o:linux:linux_kernel:2.4.10Linux Kernel 2.4.10
cpe:/o:linux:linux_kernel:2.4.18:pre5Linux Kernel 2.4.18 pre5
cpe:/o:linux:linux_kernel:2.4.28Linux Kernel 2.4.28
cpe:/o:linux:linux_kernel:2.6.14:rc3Linux Kernel 2.6.14 Release Candidate 3
cpe:/o:linux:linux_kernel:2.6.8.1Linux Kernel 2.6.8.1
cpe:/o:linux:linux_kernel:2.6.12Linux Kernel 2.6.12
cpe:/o:linux:linux_kernel:2.4.19:pre6Linux Kernel 2.4.19 pre6
cpe:/o:linux:linux_kernel:2.4.0:test7Linux Kernel 2.4.0 test7
cpe:/o:linux:linux_kernel:2.6.14:rc1Linux Kernel 2.6.14 Release Candidate 1
cpe:/o:linux:linux_kernel:2.4.21:pre1Linux Kernel 2.4.21 pre1
cpe:/o:linux:linux_kernel:2.4.27:pre3Linux Kernel 2.4.27 pre3
cpe:/o:linux:linux_kernel:2.4.18:pre3Linux Kernel 2.4.18 pre3
cpe:/o:linux:linux_kernel:2.4.5Linux Kernel 2.4.5
cpe:/o:linux:linux_kernel:2.4.19:pre2Linux Kernel 2.4.19 pre2
cpe:/o:linux:linux_kernel:2.6.15:rc6Linux Kernel 2.6.15 Release Candidate 6
cpe:/o:linux:linux_kernel:2.4.18::x86
cpe:/o:linux:linux_kernel:2.6.5Linux Kernel 2.6.5
cpe:/o:linux:linux_kernel:2.6.7Linux Kernel 2.6.7
cpe:/o:linux:linux_kernel:2.4.18:pre7Linux Kernel 2.4.18 pre7
cpe:/o:linux:linux_kernel:2.4.0:test9Linux Kernel 2.4.0 test9
cpe:/o:linux:linux_kernel:2.4.2Linux Kernel 2.4.2
cpe:/o:linux:linux_kernel:2.4.0:test11Linux Kernel 2.4.0 test11
cpe:/o:linux:linux_kernel:2.6.12.4Linux Kernel 2.6.12.4
cpe:/o:linux:linux_kernel:2.6.14:rc2Linux Kernel 2.6.14 Release Candidate 2
cpe:/o:linux:linux_kernel:2.4.16Linux Kernel 2.4.16
cpe:/o:linux:linux_kernel:2.4.27:pre1Linux Kernel 2.4.27 pre1
cpe:/o:linux:linux_kernel:2.4.6Linux Kernel 2.4.6
cpe:/o:linux:linux_kernel:2.6.11.8Linux Kernel 2.6.11.8
cpe:/o:linux:linux_kernel:2.4.24Linux Kernel 2.4.24
cpe:/o:linux:linux_kernel:2.4.7Linux Kernel 2.4.7
cpe:/o:linux:linux_kernel:2.6.4Linux Kernel 2.6.4
cpe:/o:linux:linux_kernel:2.4.18:pre4Linux Kernel 2.4.18 pre4
cpe:/o:linux:linux_kernel:2.6.13Linux Kernel 2.6.13
cpe:/o:linux:linux_kernel:2.4.11Linux Kernel 2.4.11
cpe:/o:linux:linux_kernel:2.4.18:pre8Linux Kernel 2.4.18 pre8
cpe:/o:linux:linux_kernel:2.4.19Linux Kernel 2.4.19
cpe:/o:linux:linux_kernel:2.6.11.5Linux Kernel 2.6.11.5
cpe:/o:linux:linux_kernel:2.4.18:pre6Linux Kernel 2.4.18 pre6
cpe:/o:linux:linux_kernel:2.4.21:pre4Linux Kernel 2.4.21 pre4
cpe:/o:linux:linux_kernel:2.4.9Linux Kernel 2.4.9
cpe:/o:linux:linux_kernel:2.4.18Linux Kernel 2.4.18
cpe:/o:linux:linux_kernel:2.4.8Linux Kernel 2.4.8
cpe:/o:linux:linux_kernel:2.4.0:test5Linux Kernel 2.4.0 test5
cpe:/o:linux:linux_kernel:2.6.2Linux Kernel 2.6.2
cpe:/o:linux:linux_kernel:2.6.11.11Linux Kernel 2.6.11.11
cpe:/o:linux:linux_kernel:2.4.19:pre1Linux Kernel 2.4.19 pre1
cpe:/o:linux:linux_kernel:2.4.18:pre2Linux Kernel 2.4.18 pre2
cpe:/o:linux:linux_kernel:2.6.11.7Linux Kernel 2.6.11.7
cpe:/o:linux:linux_kernel:2.6.10Linux Kernel 2.6.10
cpe:/o:linux:linux_kernel:2.6.14Linux Kernel 2.6.14
cpe:/o:linux:linux_kernel:2.4.26Linux Kernel 2.4.26
cpe:/o:linux:linux_kernel:2.6.8Linux Kernel 2.6.8
cpe:/o:linux:linux_kernel:2.6.11.1Linux Kernel 2.6.11.1
cpe:/o:linux:linux_kernel:2.6.14.1Linux Kernel 2.6.14.1
cpe:/o:linux:linux_kernel:2.6.14.3Linux Kernel 2.6.14.3
cpe:/o:linux:linux_kernel:2.6.6Linux Kernel 2.6.6
cpe:/o:linux:linux_kernel:2.4.0Linux Kernel 2.4.0
cpe:/o:linux:linux_kernel:2.4.15Linux Kernel 2.4.15
cpe:/o:linux:linux_kernel:2.6.11.10Linux Kernel 2.6.11.10

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0096
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-0096
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200601-034
(官方数据源) CNNVD

- 其它链接及资源

http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2006:044
(UNKNOWN)  MANDRIVA  MDKSA-2006:044
http://www.ubuntulinux.org/support/documentation/usn/usn-244-1
(UNKNOWN)  UBUNTU  USN-244-1
http://www.securityfocus.com/bid/16304
(UNKNOWN)  BID  16304
http://www.kernel.org/git/?p=linux/kernel/git/tglx/history.git;a=commitdiff;h=0f1d4813a4a65296e1131f320a60741732bc068f
(UNKNOWN)  CONFIRM  http://www.kernel.org/git/?p=linux/kernel/git/tglx/history.git;a=commitdiff;h=0f1d4813a4a65296e1131f320a60741732bc068f
http://www.debian.org/security/2006/dsa-1017
(UNKNOWN)  DEBIAN  DSA-1017
http://secunia.com/advisories/19374
(VENDOR_ADVISORY)  SECUNIA  19374
http://secunia.com/advisories/18977
(VENDOR_ADVISORY)  SECUNIA  18977
http://secunia.com/advisories/18527
(VENDOR_ADVISORY)  SECUNIA  18527
http://linux.bkbits.net:8080/linux-2.4/cset@1.1448.91.23?nav=index.html%7Csrc/%7Csrc/drivers%7Csrc/drivers/net%7Csrc/drivers/net/wan%7Crelated/drivers/net/wan/sdla.c
(UNKNOWN)  CONFIRM  http://linux.bkbits.net:8080/linux-2.4/cset@1.1448.91.23?nav=index.html|src/|src/drivers|src/drivers/net|src/drivers/net/wan|related/drivers/net/wan/sdla.c

- 漏洞信息

Linux Kernel SDLA IOCTL未经授权的本地固件访问漏洞
高危 访问验证错误
2006-01-06 00:00:00 2006-01-30 00:00:00
本地  
        Linux kernel 2.6.11之前的2.6.x版本以及2.4.29之前的2.4.x版本中的wan/sdla.c,不要求SDLA的CAP_SYS_RAWIO固件升级,具有未知影响和本地攻击矢量。注意:进一步调查表明,由于此问题受CAP_NET_ADMIN的保护,所以它需要使用根特权;因此,即使能够很好地区分不同特权等级,此问题可能也不是漏洞。

- 公告与补丁

        目前厂商已经发布了升级补丁以修复这个安全问题,补丁下载链接:
        Linux kernel 2.4 .0-test3
        Linux linux-2.4.29.tar.bz2
        http://kernel.org/pub/linux/kernel/v2.4/linux-2.4.29.tar.bz2
        Linux kernel 2.4 .0-test6
        Linux linux-2.4.29.tar.bz2
        http://kernel.org/pub/linux/kernel/v2.4/linux-2.4.29.tar.bz2
        Linux kernel 2.4 .0-test8
        Linux linux-2.4.29.tar.bz2
        http://kernel.org/pub/linux/kernel/v2.4/linux-2.4.29.tar.bz2
        Linux kernel 2.4 .0-test7
        Linux linux-2.4.29.tar.bz2
        http://kernel.org/pub/linux/kernel/v2.4/linux-2.4.29.tar.bz2
        Linux kernel 2.4
        Debian kernel-headers-2.4_102sarge1_powerpc.deb
        Debian GNU/Linux 3.1 alias sarge
        http://security.debian.org/pool/updates/main/k/kernel-latest-powerpc/k ernel-headers-2.4_102sarge1_powerpc.deb
        Debian kernel-image-2.4-powerpc-smp_102sarge1_powerpc.deb
        Debian GNU/Linux 3.1 alias sarge
        http://security.debian.org/pool/updates/main/k/kernel-latest-powerpc/k ernel-image-2.4-powerpc-smp_102sarge1_powerpc.deb
        Linux linux-2.4.29.tar.bz2
        http://kernel.org/pub/linux/kernel/v2.4/linux-2.4.29.tar.bz2
        Linux kernel 2.4 .0-test2
        Linux linux-2.4.29.tar.bz2
        http://kernel.org/pub/linux/kernel/v2.4/linux-2.4.29.tar.bz2
        Linux kernel 2.4.1
        Linux linux-2.4.29.tar.bz2
        http://kernel.org/pub/linux/kernel/v2.4/linux-2.4.29.tar.bz2
        Linux kernel 2.4.11
        Linux linux-2.4.29.tar.bz2
        http://kernel.org/pub/linux/kernel/v2.4/linux-2.4.29.tar.bz2
        Linux kernel 2.4.12
        Linux linux-2.4.29.tar.bz2
        http://kernel.org/pub/linux/kernel/v2.4/linux-2.4.29.tar.bz2
        Linux kernel 2.4.13
        Linux linux-2.4.29.tar.bz2
        http://kernel.org/pub/linux/kernel/v2.4/linux-2.4.29.tar.bz2
        Linux kernel 2.4.14
        Linux linux-2.4.29.tar.bz2
        http://kernel.org/pub/linux/kernel/v2.4/linux-2.4.29.tar.bz2
        Linux kernel 2.4.15
        Linux linux-2.4.29.tar.bz2
        http://kernel.org/pub/linux/kernel/v2.4/linux-2.4.29.tar.bz2
        Linux kernel 2.4.17
        Linux linux-2.4.29.tar.bz2
        http://kernel.org/pub/linux/kernel/v2.4/linux-2.4.29.tar.bz2
        Linux kernel 2.4.18 pre-8
        Linux linux-2.4.29.tar.bz2
        http://kernel.org/pub/linux/kernel/v2.4/linux-2.4.29.tar.bz2
        Linux kernel 2.4.18 pre-7
        Linux linux-2.4.29.tar.bz2
        http://kernel.org/pub/linux/kernel/v2.4/linux-2.4.29.tar.bz2
        Linux kernel 2.4.18
        Linux linux-2.4.29.tar.bz2
        http://kernel.org/pub/linux/kernel/v2.4/linux-2.4.29.tar.bz2
        Mandriva kernel-2.6.3.32mdk-1-1mdk.i586.rpm
        Multi Network Firewall 2.0:
        http://wwwnew.mandriva.com/en/downloads/
        Mandriva kernel-i686-up-4GB-2.6.3.32mdk-1-1mdk.i586.rpm
        Multi Network Firewall 2.0:
        http://wwwnew.mandriva.com/en/downloads/
        Mandriva kernel-p3-smp-64GB-2.6.3.32mdk-1-1mdk.i586.rpm
        Multi Network Firewall 2.0:
        http://wwwnew.mandriva.com/en/downloads/
        Mandriva kernel-secure-2.6.3.32mdk-1-1mdk.i586.rpm
        Multi Network Firewall 2.0:
        http://wwwnew.mandriva.com/en/downloads/
        Mandriva kernel-smp-2.6.3.32mdk-1-1mdk.i586.rpm
        Multi Network Firewall 2.0:
        http://wwwnew.mandriva.com/en/downloads/
        Linux kernel 2.4.18 pre-6
        Linux linux-2.4.29.tar.bz2
        http://kernel.org/pub/linux/kernel/v2.4/linux-2.4.29.tar.bz2
        Linux kernel 2.4.18 pre-3
        Linux linux-2.4.29.tar.bz2
        http://kernel.org/pub/linux/kernel/v2.4/linux-2.4.29.tar.bz2
        Linux kernel 2.4.18 pre-2
        Linux linux-2.4.29.tar.bz2
        http://kernel.org/pub/linux/kernel/v2.4/linux-2.4.29.tar.bz2
        Linux kernel 2.4.18 pre-4
        Linux linux-2.4.29.tar.bz2
        http://kernel.org/pub/linux/kernel/v2.4/linux-2.4.29.tar.bz2
        Linux kernel 2.4.19 -pre4
        Linux linux-2.4.29.tar.bz2
        http://kernel.org/pub/linux/kernel/v2.4/linux-2.4.29.tar.bz2
        Linux kernel 2.4.19 -pre1
        Linux linux-2.4.29.tar.bz2
        http://kernel.org/pub/linux/kernel/v2.4/linux-2.4.29.tar.bz2
        Linux kernel 2.4.19 -pre6
        Linux linux-2.4.29.tar.bz2
        http://kernel.org/pub/linux/kernel/v2.4/linux-2.4.29.tar.bz2
        Linux kernel 2.4.19 -pre2
        Linux linux-2.4.29.tar.bz2
        http://kernel.org/pub/linux/kernel/v2.4/linux-2.4.29.tar.bz2
        Linux kernel 2.4.19
        Linux linux-2.4.29.tar.bz2
        http://kernel.org/pub/linux/kernel/v2.4/linux-2.4.29.tar.bz2
        Mandriva kernel-2.4.19.50mdk-1-1mdk.i586.rpm
        Corporate Server 2.1:
        http://www.mandriva.com/en/download
        Mandriva kerne

- 漏洞信息 (F48071)

Mandriva Linux Security Advisory 2006.116 (PacketStormID:F48071)
2006-07-09 00:00:00
Mandriva  mandriva.com
advisory,kernel,vulnerability
linux,mandriva
CVE-2005-3359,CVE-2005-3784,CVE-2005-3858,CVE-2005-4618,CVE-2006-0096,CVE-2006-0555,CVE-2006-1242,CVE-2006-1525,CVE-2006-1528,CVE-2006-1855,CVE-2006-1856,CVE-2006-2071,CVE-2006-2271,CVE-2006-2272,CVE-2006-2444
[点击下载]

Mandriva Linux Security Advisory MDKSA-2006-116 - A ridiculous number of vulnerabilities were discovered and corrected in the Linux 2.6 kernel.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDKSA-2006:116
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : kernel
 Date    : July 5, 2006
 Affected: Corporate 3.0, Multi Network Firewall 2.0
 _______________________________________________________________________
 
 Problem Description:
 
 A number of vulnerabilities were discovered and corrected in the Linux
 2.6 kernel:
 
 Prior to 2.6.14, the atm module allows local users to cause a Denial of
 Service (panic) via certain socket calls that produce inconsistent
 reference counts for loadable protocol modules (CVE-2005-3359).
 
 Prior to 2.6.15, the auto-reap child processes included processes with
 ptrace attached, leading to a dangling ptrace reference and allowing
 local users to cause a Denial of Service (crash) (CVE-2005-3784).
 
 Prior to and including 2.6.12, a memory leak in the ip6_input_finish
 function could allow an attacker to cause a Denial of Service via
 malformed IPv6 packets with unspecified parameter problems, which
 prevents SKB from being freed (CVE-2005-3858).
 
 Prior to 2.6.15, a buffer overflow in sysctl could allow a local user
 to corrupt user memory and possibly cause a Denial of Service via a
 long string, causing sysctl to write a zero byte outside the buffer
 (CVE-2005-4618).
 
 Prior to 2.6.11, wan/sdla.c does not require CAP_SYS_RAWIO privilege
 for an SDLA firmware upgrade, with unknown impact and local attack
 vectors (CVE-2006-0096).
 
 Prior to 2.6.15.5, a local user could cause a Denial of Service (NFS
 client panic) via unknown attack vectors related to the use of O_DIRECT
 (direct I/O) (CVE-2006-0555).
 
 Prior to 2.6.16, the ip_push_pending_frames function increments the IP
 ID field when sending a RST after receiving unsolicited TCP SYN-ACK
 packets, which allows a remote attacker to conduct an idle scan attack,
 bypassing any intended protection against such an attack
 (CVE-2006-1242).
 
 Prior to 2.6.16.8, the ip_route_input function allows local users to
 cause a DoS (panic) via a request for a route for a multicast IP
 address, which triggers a null dereference (CVE-2006-1525).
 
 Prior to 2.6.13, local users could cause a Denial of Service (crash)
 via a dio transfer from the sg driver to memory mapped IO space
 (CVE-2006-1528).
 
 Prior to 2.6.11.12, the choose_new_parent function includes certain
 debugging code which could allow a local user to cause a Denial of
 Service (panic) by causing certain circumstances involving termination
 of a parent process (CVE-2006-1855).
 
 Prior to and including 2.6.16, the kernel did not add the appropriate
 LSM file_permission hooks to the readv and writev functions, which
 could allow an attacker to bypass intended access restrictions
 (CVE-2006-1856).
 
 Prior to 2.6.16, local users can bypass IPC permissions and modify a
 read-only attachment of shared memory by using mprotect to give write
 permission to the attachment (CVE-2006-2071).
 
 Prior to 2.6.17, the ECNE chunk handling in SCTP (lksctp) allows remote
 attackers to cause a DoS (kernel panic) via an unexpected chucnk when
 the session is in CLOSED state (CVE-2006-2271).
 
 Prior to 2.6.17, SCTP (lksctp) allows remote attacker to cause a DoS
 (kernel panic) via incoming IP fragmented COOKIE_ECHO and HEARTBEAT
 SCTP control chunks (CVE-2006-2272).
 
 Memory corruption can be triggered remotely when the ip_nat_snmp_basic
 module is loaded and traffic on port 161 or 162 is NATed
 (CVE-2006-2444).
 
 The provided packages are patched to fix these vulnerabilities.  All
 users are encouraged to upgrade to these updated kernels.
 
 To update your kernel, please follow the directions located at:
 
   http://www.mandriva.com/en/security/kernelupdate
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3359
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3784
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3858
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4618
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0096
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0555
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1242
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1525
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1528
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1855
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1856
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2071
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2271
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2272
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2444
 _______________________________________________________________________
 
 Updated Packages:
 
 Corporate 3.0:
 a5f9a1061112afa86f10ec1bdc9d49f0  corporate/3.0/RPMS/kernel-2.6.3.32mdk-1-1mdk.i586.rpm
 edf706536ecb71300eb53c42838dfb7f  corporate/3.0/RPMS/kernel-BOOT-2.6.3.32mdk-1-1mdk.i586.rpm
 27be129a647b32dab207593327cfbdb0  corporate/3.0/RPMS/kernel-enterprise-2.6.3.32mdk-1-1mdk.i586.rpm
 25df51c79bda0995e1ab5e626bed3365  corporate/3.0/RPMS/kernel-i686-up-4GB-2.6.3.32mdk-1-1mdk.i586.rpm
 9d6f94621c8d02ea4a2378575b9150b8  corporate/3.0/RPMS/kernel-p3-smp-64GB-2.6.3.32mdk-1-1mdk.i586.rpm
 0a15845463acdec596ba4b02e718087e  corporate/3.0/RPMS/kernel-secure-2.6.3.32mdk-1-1mdk.i586.rpm
 6cd61286a7e3aac569186465e6d37e67  corporate/3.0/RPMS/kernel-smp-2.6.3.32mdk-1-1mdk.i586.rpm
 4b1b11ed7ea70b3119eab29783739f06  corporate/3.0/RPMS/kernel-source-2.6.3-32mdk.i586.rpm
 ae918285bd5b813d3dbac4dc180c0d6d  corporate/3.0/RPMS/kernel-source-stripped-2.6.3-32mdk.i586.rpm
 a4632a1ebf83f95f547d266abaad2106  corporate/3.0/SRPMS/kernel-2.6.3.32mdk-1-1mdk.src.rpm

 Corporate 3.0/X86_64:
 cb09cd5187a99ea139bf82783bd184a4  x86_64/corporate/3.0/RPMS/kernel-2.6.3.32mdk-1-1mdk.x86_64.rpm
 139e7d1dedffe1f4f44c6e988b5c4ef2  x86_64/corporate/3.0/RPMS/kernel-BOOT-2.6.3.32mdk-1-1mdk.x86_64.rpm
 f8d744824c238b071eafda67136592ae  x86_64/corporate/3.0/RPMS/kernel-secure-2.6.3.32mdk-1-1mdk.x86_64.rpm
 0ab64016fffb13934347e3d5cba2b45e  x86_64/corporate/3.0/RPMS/kernel-smp-2.6.3.32mdk-1-1mdk.x86_64.rpm
 437cfd7b69813e44cda4e0fe6e091521  x86_64/corporate/3.0/RPMS/kernel-source-2.6.3-32mdk.x86_64.rpm
 dee29e29dc05f364ceb389144144c469  x86_64/corporate/3.0/RPMS/kernel-source-stripped-2.6.3-32mdk.x86_64.rpm
 a4632a1ebf83f95f547d266abaad2106  x86_64/corporate/3.0/SRPMS/kernel-2.6.3.32mdk-1-1mdk.src.rpm

 Multi Network Firewall 2.0:
 3d6ff857e798601ce4cf62c16e29ed42  mnf/2.0/RPMS/kernel-2.6.3.32mdk-1-1mdk.i586.rpm
 94ea4314713ca6a39120a066b9dd9b59  mnf/2.0/RPMS/kernel-i686-up-4GB-2.6.3.32mdk-1-1mdk.i586.rpm
 694ad7fad48ec9a0b0bdb6a7b1e94148  mnf/2.0/RPMS/kernel-p3-smp-64GB-2.6.3.32mdk-1-1mdk.i586.rpm
 d602f9f1e991794a1cedb21e1b87e949  mnf/2.0/RPMS/kernel-secure-2.6.3.32mdk-1-1mdk.i586.rpm
 c7a984793f0f81d33bedd18eebd34228  mnf/2.0/RPMS/kernel-smp-2.6.3.32mdk-1-1mdk.i586.rpm
 81a4bfaab9d2a45a8500f2741f1db6a5  mnf/2.0/SRPMS/kernel-2.6.3.32mdk-1-1mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFEq9cGmqjQ0CJFipgRAjRFAKDkoTvT4ht14u+E3EyZYDadNRql8wCgoiNp
ycOpCb9cZ6HIXDL0KeZwIDc=
=5WcB
-----END PGP SIGNATURE-----

    

- 漏洞信息

22419
Linux Kernel SDLA Upgrade CAP_SYS_RAWIO Arbitrary Kernel Memory Disclosure
Vendor Verified

- 漏洞描述

Unknown or Incomplete

- 时间线

2005-01-10 Unknow
Unknow Unknow

- 解决方案

Unknown or Incomplete

- 相关参考

- 漏洞作者

Unknown or Incomplete

- 漏洞信息

Linux Kernel SDLA IOCTL Unauthorized Local Firmware Access Vulnerability
Access Validation Error 16304
No Yes
2006-01-18 12:00:00 2007-01-09 07:01:00
The vendor reported this issue.

- 受影响的程序版本

Ubuntu Ubuntu Linux 5.10 powerpc
Ubuntu Ubuntu Linux 5.10 i386
Ubuntu Ubuntu Linux 5.10 amd64
Ubuntu Ubuntu Linux 5.0 4 powerpc
Ubuntu Ubuntu Linux 5.0 4 i386
Ubuntu Ubuntu Linux 5.0 4 amd64
Ubuntu Ubuntu Linux 4.1 ppc
Ubuntu Ubuntu Linux 4.1 ia64
Ubuntu Ubuntu Linux 4.1 ia32
MandrakeSoft Multi Network Firewall 2.0
MandrakeSoft Corporate Server 3.0 x86_64
MandrakeSoft Corporate Server 3.0
MandrakeSoft Corporate Server 2.1 x86_64
MandrakeSoft Corporate Server 2.1
Linux kernel 2.6.10 rc2
Linux kernel 2.6.10
Linux kernel 2.6.9
Linux kernel 2.6.8 rc3
Linux kernel 2.6.8 rc2
Linux kernel 2.6.8 rc1
+ Ubuntu Ubuntu Linux 4.1 ppc
+ Ubuntu Ubuntu Linux 4.1 ia64
+ Ubuntu Ubuntu Linux 4.1 ia32
Linux kernel 2.6.8
+ S.u.S.E. Linux Personal 9.2 x86_64
+ S.u.S.E. Linux Personal 9.2
+ Ubuntu Ubuntu Linux 4.1 ppc
+ Ubuntu Ubuntu Linux 4.1 ia64
+ Ubuntu Ubuntu Linux 4.1 ia32
Linux kernel 2.6.7 rc1
Linux kernel 2.6.7
Linux kernel 2.6.6 rc1
Linux kernel 2.6.6
Linux kernel 2.6.5
Linux kernel 2.6.4
Linux kernel 2.6.3
Linux kernel 2.6.2
Linux kernel 2.6.1 -rc2
Linux kernel 2.6.1 -rc1
Linux kernel 2.6.1
Linux kernel 2.6 .10
Linux kernel 2.6 -test9-CVS
Linux kernel 2.6 -test9
Linux kernel 2.6 -test8
Linux kernel 2.6 -test7
Linux kernel 2.6 -test6
Linux kernel 2.6 -test5
Linux kernel 2.6 -test4
Linux kernel 2.6 -test3
Linux kernel 2.6 -test2
Linux kernel 2.6 -test11
Linux kernel 2.6 -test10
Linux kernel 2.6 -test1
Linux kernel 2.6
Linux kernel 2.4.28
+ Trustix Secure Enterprise Linux 2.0
+ Trustix Secure Linux 2.2
+ Trustix Secure Linux 2.1
+ Trustix Secure Linux 2.0
Linux kernel 2.4.27 -pre5
Linux kernel 2.4.27 -pre4
Linux kernel 2.4.27 -pre3
Linux kernel 2.4.27 -pre2
Linux kernel 2.4.27 -pre1
Linux kernel 2.4.27
Linux kernel 2.4.26
Linux kernel 2.4.25
Linux kernel 2.4.24 -ow1
Linux kernel 2.4.24
Linux kernel 2.4.23 -pre9
Linux kernel 2.4.23 -ow2
Linux kernel 2.4.23
+ Trustix Secure Linux 2.0
Linux kernel 2.4.22
+ Devil-Linux Devil-Linux 1.0.5
+ Devil-Linux Devil-Linux 1.0.4
+ Mandriva Linux Mandrake 9.2 amd64
+ Mandriva Linux Mandrake 9.2
+ Red Hat Fedora Core1
+ Slackware Linux 9.1
Linux kernel 2.4.21 pre7
Linux kernel 2.4.21 pre4
Linux kernel 2.4.21 pre1
Linux kernel 2.4.21
+ Conectiva Linux 9.0
+ Mandriva Linux Mandrake 9.1 ppc
+ Mandriva Linux Mandrake 9.1
+ Red Hat Enterprise Linux AS 3
+ RedHat Desktop 3.0
+ RedHat Enterprise Linux ES 3
+ RedHat Enterprise Linux WS 3
+ S.u.S.E. Linux Personal 9.0 x86_64
+ S.u.S.E. Linux Personal 9.0
+ SuSE SUSE Linux Enterprise Server 8
Linux kernel 2.4.20
Linux kernel 2.4.19 -pre6
Linux kernel 2.4.19 -pre5
Linux kernel 2.4.19 -pre4
Linux kernel 2.4.19 -pre3
Linux kernel 2.4.19 -pre2
Linux kernel 2.4.19 -pre1
Linux kernel 2.4.19
+ Conectiva Linux 8.0
+ Conectiva Linux Enterprise Edition 1.0
+ MandrakeSoft Corporate Server 2.1 x86_64
+ MandrakeSoft Corporate Server 2.1
+ MandrakeSoft Multi Network Firewall 2.0
+ Mandriva Linux Mandrake 9.0
+ S.u.S.E. Linux 8.1
+ Slackware Linux -current
+ SuSE SUSE Linux Enterprise Server 8
+ SuSE SUSE Linux Enterprise Server 7
Linux kernel 2.4.18 pre-8
Linux kernel 2.4.18 pre-7
Linux kernel 2.4.18 pre-6
Linux kernel 2.4.18 pre-5
Linux kernel 2.4.18 pre-4
Linux kernel 2.4.18 pre-3
Linux kernel 2.4.18 pre-2
Linux kernel 2.4.18 pre-1
Linux kernel 2.4.18 x86
Linux kernel 2.4.18
+ Astaro Security Linux 2.0 23
+ Astaro Security Linux 2.0 16
+ Debian Linux 3.0 sparc
+ Debian Linux 3.0 s/390
+ Debian Linux 3.0 ppc
+ Debian Linux 3.0 mipsel
+ Debian Linux 3.0 mips
+ Debian Linux 3.0 m68k
+ Debian Linux 3.0 ia-64
+ Debian Linux 3.0 ia-32
+ Debian Linux 3.0 hppa
+ Debian Linux 3.0 arm
+ Debian Linux 3.0 alpha
+ Mandriva Linux Mandrake 8.2
+ Mandriva Linux Mandrake 8.1
+ Mandriva Linux Mandrake 8.0
+ Red Hat Enterprise Linux AS 2.1 IA64
+ RedHat Advanced Workstation for the Itanium Processor 2.1 IA64
+ RedHat Advanced Workstation for the Itanium Processor 2.1
+ RedHat Linux 8.0
+ RedHat Linux 7.3
+ S.u.S.E. Linux 8.1
+ S.u.S.E. Linux 8.0
+ S.u.S.E. Linux 7.3
+ S.u.S.E. Linux 7.2
+ S.u.S.E. Linux 7.1
+ S.u.S.E. Linux Connectivity Server
+ S.u.S.E. Linux Database Server 0
+ S.u.S.E. Linux Firewall on CD
+ S.u.S.E. Linux Office Server
+ S.u.S.E. Linux Openexchange Server
+ S.u.S.E. Linux Personal 8.2
+ S.u.S.E. SuSE eMail Server 3.1
+ S.u.S.E. SuSE eMail Server III
+ SuSE SUSE Linux Enterprise Server 8
+ SuSE SUSE Linux Enterprise Server 7
+ Turbolinux Turbolinux Server 8.0
+ Turbolinux Turbolinux Server 7.0
+ Turbolinux Turbolinux Workstation 8.0
+ Turbolinux Turbolinux Workstation 7.0
Linux kernel 2.4.17
Linux kernel 2.4.16
Linux kernel 2.4.15
Linux kernel 2.4.14
Linux kernel 2.4.13
+ Caldera OpenLinux Server 3.1.1
+ Caldera OpenLinux Workstation 3.1.1
Linux kernel 2.4.12
+ Conectiva Linux 7.0
Linux kernel 2.4.11
Linux kernel 2.4.10
Linux kernel 2.4.9
+ Red Hat Enterprise Linux AS 2.1 IA64
+ Red Hat Enterprise Linux AS 2.1
+ RedHat Enterprise Linux ES 2.1 IA64
+ RedHat Enterprise Linux ES 2.1
+ RedHat Enterprise Linux WS 2.1 IA64
+ RedHat Enterprise Linux WS 2.1
+ RedHat Linux 7.2 ia64
+ RedHat Linux 7.2 i386
+ RedHat Linux 7.2 alpha
+ RedHat Linux 7.1 ia64
+ RedHat Linux 7.1 i386
+ RedHat Linux 7.1 alpha
+ Sun Linux 5.0.5
+ Sun Linux 5.0.3
+ Sun Linux 5.0
Linux kernel 2.4.8
+ Mandriva Linux Mandrake 8.2
+ Mandriva Linux Mandrake 8.1
+ Mandriva Linux Mandrake 8.0
Linux kernel 2.4.7
+ RedHat Linux 7.2
+ S.u.S.E. Linux 7.2
+ S.u.S.E. Linux 7.1
Linux kernel 2.4.6
Linux kernel 2.4.5
+ Slackware Linux 8.0
Linux kernel 2.4.4
+ S.u.S.E. Linux 7.2
Linux kernel 2.4.3
+ Mandriva Linux Mandrake 8.0 ppc
+ Mandriva Linux Mandrake 8.0
Linux kernel 2.4.2
Linux kernel 2.4.1
Linux kernel 2.4 .0-test9
Linux kernel 2.4 .0-test8
Linux kernel 2.4 .0-test7
Linux kernel 2.4 .0-test6
Linux kernel 2.4 .0-test5
Linux kernel 2.4 .0-test4
Linux kernel 2.4 .0-test3
Linux kernel 2.4 .0-test2
Linux kernel 2.4 .0-test12
Linux kernel 2.4 .0-test11
Linux kernel 2.4 .0-test10
Linux kernel 2.4 .0-test1
Linux kernel 2.4
Debian Linux 3.1 sparc
Debian Linux 3.1 s/390
Debian Linux 3.1 ppc
Debian Linux 3.1 mipsel
Debian Linux 3.1 mips
Debian Linux 3.1 m68k
Debian Linux 3.1 ia-64
Debian Linux 3.1 ia-32
Debian Linux 3.1 hppa
Debian Linux 3.1 arm
Debian Linux 3.1 amd64
Debian Linux 3.1 alpha
Debian Linux 3.1
Linux kernel 2.6.11
+ Red Hat Fedora Core4
Linux kernel 2.4.29

- 不受影响的程序版本

Linux kernel 2.6.11
+ Red Hat Fedora Core4
Linux kernel 2.4.29

- 漏洞讨论

The Linux kernel is susceptible to a local access-validation vulnerability in the SDLA driver.

This issue allows local users with the 'CAP_NET_ADMIN' capability, but without the 'CAP_SYS_RAWIO' capability, to read and write to the SDLA device firmware. This may cause a denial-of-service issue if attackers write an invalid firmware. Other attacks may also be possibly by writing modified firmware files.

- 漏洞利用

An exploit is not required.

- 解决方案

Please see the referenced vendor advisories for more information and fixes.


Linux kernel 2.4 .0-test3

Linux kernel 2.4 .0-test6

Linux kernel 2.4 .0-test8

Linux kernel 2.4 .0-test7

Linux kernel 2.4

Linux kernel 2.4 .0-test2

Linux kernel 2.4.1

Linux kernel 2.4.11

Linux kernel 2.4.12

Linux kernel 2.4.13

Linux kernel 2.4.14

Linux kernel 2.4.15

Linux kernel 2.4.17

Linux kernel 2.4.18 pre-8

Linux kernel 2.4.18 pre-7

Linux kernel 2.4.18

Linux kernel 2.4.18 pre-6

Linux kernel 2.4.18 pre-3

Linux kernel 2.4.18 pre-2

Linux kernel 2.4.18 pre-4

Linux kernel 2.4.19 -pre4

Linux kernel 2.4.19 -pre1

Linux kernel 2.4.19 -pre6

Linux kernel 2.4.19 -pre2

Linux kernel 2.4.19

Linux kernel 2.4.19 -pre5

Linux kernel 2.4.21

Linux kernel 2.4.21 pre1

Linux kernel 2.4.22

Linux kernel 2.4.23

Linux kernel 2.4.23 -ow2

Linux kernel 2.4.24

Linux kernel 2.4.25

Linux kernel 2.4.27 -pre1

Linux kernel 2.4.27

Linux kernel 2.4.27 -pre2

Linux kernel 2.4.27 -pre4

Linux kernel 2.4.27 -pre3

Linux kernel 2.4.28

Linux kernel 2.4.3

Linux kernel 2.4.4

Linux kernel 2.4.5

Linux kernel 2.4.6

Linux kernel 2.4.7

Linux kernel 2.4.8

Linux kernel 2.4.9

Linux kernel 2.6 -test6

Linux kernel 2.6 -test4

Linux kernel 2.6 -test2

Linux kernel 2.6 -test11

Linux kernel 2.6 -test9-CVS

Linux kernel 2.6

Linux kernel 2.6 -test3

Linux kernel 2.6 .10

Linux kernel 2.6 -test5

Linux kernel 2.6 -test1

Linux kernel 2.6 -test7

Linux kernel 2.6 -test9

Linux kernel 2.6 -test8

Linux kernel 2.6.1 -rc1

Linux kernel 2.6.1 -rc2

Linux kernel 2.6.1

Linux kernel 2.6.10 rc2

Linux kernel 2.6.2

Linux kernel 2.6.4

Linux kernel 2.6.6 rc1

Linux kernel 2.6.7 rc1

Linux kernel 2.6.7

Linux kernel 2.6.8 rc3

Linux kernel 2.6.8 rc2

Linux kernel 2.6.8 rc1

Linux kernel 2.6.8

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站