Debians sikkerhedsbulletin

DSA-417-1 linux-kernel-2.4.18-powerpc+alpha -- manglende grænsekontrol

Rapporteret den:

7. jan 2004

Berørte pakker:

kernel-patch-2.4.18-powerpc, kernel-image-2.4.18-1-alpha

Sårbar:

Referencer i sikkerhedsdatabaser:

I Bugtraq-databasen (hos SecurityFocus): BugTraq-id 9356.
I Mitres CVE-ordbog: CVE-2003-0961, CVE-2003-0985.

Yderligere oplysninger:

Paul Starzetz har opdaget en fejl i grænsekontrollen i mremap() i Linux-kernen (findes i version 2.4.x og 2.6.x), hvilket kan give en lokal angriber root-rettigheder. Version 2.2 er ikke påvirket af denne fejl.

Andrew Morton har opdaget en manglende grænsekontrol i brk-systemkaldet, der kan anvendes til at fremstille en lokal root-udnyttelse.

I den stabile distribution (woody) er disse problemr rettet i version 2.4.18-12 til alpha-arkitekturen og i version 2.4.18-1woody3 til powerpc-arkitekturen.

I den ustabile distribution (sid) vil disse problemer snart blive rettet med nye pakker.

Vi anbefaler at du opgraderer dine kernel-pakker. Disse problemer er også rettet i opstrømsversion 2.4.24.

Rettet i:

Debian GNU/Linux 3.0 (woody)

Kildekode:: http://security.debian.org/pool/updates/main/k/kernel-source-2.4.18/kernel-source-2.4.18_2.4.18-14.1.dsc; http://security.debian.org/pool/updates/main/k/kernel-source-2.4.18/kernel-source-2.4.18_2.4.18-14.1.diff.gz; http://security.debian.org/pool/updates/main/k/kernel-source-2.4.18/kernel-source-2.4.18_2.4.18.orig.tar.gz; http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-alpha/kernel-image-2.4.18-1-alpha_2.4.18-12.dsc; http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-alpha/kernel-image-2.4.18-1-alpha_2.4.18-12.tar.gz; http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.18-powerpc/kernel-patch-2.4.18-powerpc_2.4.18-1woody3.dsc; http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.18-powerpc/kernel-patch-2.4.18-powerpc_2.4.18-1woody3.tar.gz
Arkitekturuafhængig komponent:: http://security.debian.org/pool/updates/main/k/kernel-source-2.4.18/kernel-doc-2.4.18_2.4.18-14.1_all.deb; http://security.debian.org/pool/updates/main/k/kernel-source-2.4.18/kernel-source-2.4.18_2.4.18-14.1_all.deb; http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.18-powerpc/kernel-patch-2.4.18-powerpc_2.4.18-1woody3_all.deb
Alpha:: http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-alpha/kernel-headers-2.4.18-1_2.4.18-12_alpha.deb; http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-alpha/kernel-headers-2.4.18-1-generic_2.4.18-12_alpha.deb; http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-alpha/kernel-headers-2.4.18-1-smp_2.4.18-12_alpha.deb; http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-alpha/kernel-image-2.4.18-1-generic_2.4.18-11_alpha.deb; http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-alpha/kernel-image-2.4.18-1-smp_2.4.18-11_alpha.deb
PowerPC:: http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.18-powerpc/kernel-headers-2.4.18_2.4.18-1woody3_powerpc.deb; http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.18-powerpc/kernel-image-2.4.18-newpmac_2.4.18-1woody3_powerpc.deb; http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.18-powerpc/kernel-image-2.4.18-powerpc_2.4.18-1woody3_powerpc.deb; http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.18-powerpc/kernel-image-2.4.18-powerpc-smp_2.4.18-1woody3_powerpc.deb

MD5-kontrolsummer for de listede filer findes i den originale sikkerhedsbulletin.

MD5-kontrolsummer for de listede filer findes i den reviderede sikkerhedsbulletin.