Vulnerabilities > CVE-2005-0750 - Buffer Index vulnerability in Linux Kernel Bluetooth Signed
Attack vector
LOCAL Attack complexity
LOW Privileges required
NONE Confidentiality impact
COMPLETE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
The bluez_sock_create function in the Bluetooth stack for Linux kernel 2.4.6 through 2.4.30-rc1 and 2.6 through 2.6.11.5 allows local users to gain privileges via (1) socket or (2) socketpair call with a negative protocol value.
Vulnerable Configurations
Exploit-Db
description Linux Kernel 2.4.x/2.6.x Bluetooth Signed Buffer Index Vulnerability (3). CVE-2005-0750. Local exploit for linux platform id EDB-ID:25289 last seen 2016-02-03 modified 2005-10-19 published 2005-10-19 reporter backdoored.net source https://www.exploit-db.com/download/25289/ title Linux Kernel 2.4.x/2.6.x - Bluetooth Signed Buffer Index Vulnerability 3 description Linux Kernel 2.4.x/2.6.x Bluetooth Signed Buffer Index Vulnerability (1). CVE-2005-0750. Local exploit for linux platform id EDB-ID:25287 last seen 2016-02-03 modified 2005-03-28 published 2005-03-28 reporter ilja van sprundel source https://www.exploit-db.com/download/25287/ title Linux Kernel 2.4.x/2.6.x - Bluetooth Signed Buffer Index Vulnerability 1 description Linux Kernel 2.4.x/2.6.x Bluetooth Signed Buffer Index Vulnerability (2). CVE-2005-0750. Local exploit for linux platform id EDB-ID:25288 last seen 2016-02-03 modified 2005-04-08 published 2005-04-08 reporter qobaiashi source https://www.exploit-db.com/download/25288/ title Linux Kernel 2.4.x/2.6.x - Bluetooth Signed Buffer Index Vulnerability 2 description Linux Kernel 2.4.x/2.6.x Bluetooth Signed Buffer Index Vulnerability (4). CVE-2005-0750. Local exploit for linux platform id EDB-ID:25290 last seen 2016-02-03 modified 2005-10-24 published 2005-10-24 reporter qobaiashi source https://www.exploit-db.com/download/25290/ title Linux Kernel 2.4.x/2.6.x - Bluetooth Signed Buffer Index Vulnerability 4
Nessus
NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2005-283.NASL description Updated kernel packages are now available as part of ongoing support and maintenance of Red Hat Enterprise Linux version 2.1. This is the seventh regular update. This security advisory has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating system. This is the seventh regular kernel update to Red Hat Enterprise Linux 2.1 The following security updates were made : A flaw in fragment queuing was discovered that affected the Linux 2.4 and Linux 2.6 kernel netfilter subsystem. On systems configured to filter or process network packets (for example those configured to do firewalling), a remote attacker could send a carefully crafted set of fragmented packets to a machine and cause a denial of service (system crash). In order to sucessfully exploit this flaw, the attacker would need to know (or guess) some aspects of the firewall ruleset in place on the target system to be able to craft the right fragmented packets. (CVE-2005-0449) A flaw was discovered in the Linux PPP driver. On systems allowing remote users to connect to a server using ppp, a remote client could cause a denial of service (system crash). (CVE-2005-0384) A flaw was discovered in the bluetooth driver system. On system where the bluetooth modules are loaded, a local user could use this flaw to gain elevated (root) privileges. (CVE-2005-0750) An integer overflow flaw was discovered in the ubsec_keysetup function in the Broadcom 5820 cryptonet driver. On systems using this driver, a local user could cause a denial of service (crash) or possibly gain elevated privileges. (CVE-2004-0619) Please note that this update contains an unpatched kernel module called bcm5820_old for backwards compatibility which is still vulnerable to CVE-2004-0619. The following device drivers have been updated to new versions : mptfusion: 2.05.16 -> 2.05.16.02 bcm5820: 1.17 -> 1.81 cciss: 2.4.52 -> 2.4.54 qla2x00: 6.04.01 -> 7.01.01 There were many bug fixes in various parts of the kernel. The ongoing effort to resolve these problems has resulted in a marked improvement in the reliability and scalability of Red Hat Enterprise Linux 2.1. Bug fixes include: - Fixes an incorrect and ever-changing physical_id field in /proc/cpuinfo. - Now recognizes a particular e1000 device (PCI ID 8086:1014) - Fixes a panic in disk quota code - Fixes a bug in which msync(...MS_SYNC) returns before the data is written to disk - Adds new devices to the SCSI scan list so they can be initialized and handled properly: LSI ProFibre 4000R, HP HSV200/210, HP MSA, STK OPENstorage D178. - Fixes a potential format overflow in /proc/partitions - Restores module parameters to the e100 driver for compatibility with existing customer scripts. - Fixes a bug in which cat last seen 2020-06-01 modified 2020-06-02 plugin id 18161 published 2005-04-29 reporter This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/18161 title RHEL 2.1 : kernel (RHSA-2005:283) NASL family SuSE Local Security Checks NASL id SUSE_SA_2005_021.NASL description The remote host is missing the patch for the advisory SUSE-SA:2005:021 (kernel). This Linux kernel security update fixes a problem within the Bluetooth kernel stack which can be used by a local attacker to gain root access or crash the machine. To exploit this problem, the Bluetooth modules do not need to be loaded since they are auto loaded on demand (except in products mentioned below). This problem has been assigned the Mitre CVE ID CVE-2005-0750. Updated packages have been provided for the default affected products: - SUSE Linux 8.2, 9.0 and 9.2 (both i386 and x86_64) - SUSE Linux Enterprise Server 8 (i386, ia64 and x86_64) - SUSE Linux Desktop 1.0 Other architectures do not have Bluetooth enabled. Also SUSE Linux 9.1, SUSE Linux Enterprise Server 9 and Novell Linux Desktop 9 are not affected by default since the Bluetooth module is not auto loaded. These will get the patch with the next security update. last seen 2020-06-01 modified 2020-06-02 plugin id 17982 published 2005-04-06 reporter This script is Copyright (C) 2005-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/17982 title SUSE-SA:2005:021: kernel NASL family Mandriva Local Security Checks NASL id MANDRAKE_MDKSA-2005-111.NASL description Multiple vulnerabilities in the Linux kernel have been discovered and fixed in this update. The following have been fixed in the 2.4 kernels : Colin Percival discovered a vulnerability in Intel last seen 2020-06-01 modified 2020-06-02 plugin id 18599 published 2005-07-01 reporter This script is Copyright (C) 2005-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/18599 title Mandrake Linux Security Advisory : kernel-2.4 (MDKSA-2005:111) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2005-366.NASL description Updated kernel packages that fix several security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. [Updated 9 August 2005] The advisory text has been updated to show that this update fixed the security issue named CVE-2005-0210 but not CVE-2005-0209. The issue CVE-2005-0209 was actually fixed by RHSA-2005:420. No changes have been made to the packages associated with this advisory. The Linux kernel handles the basic functions of the operating system. A flaw in the fib_seq_start function was discovered. A local user could use this flaw to cause a denial of service (system crash) via /proc/net/route. (CVE-2005-1041) A flaw in the tmpfs file system was discovered. A local user could use this flaw to cause a denial of service (system crash). (CVE-2005-0977) An integer overflow flaw was found when writing to a sysfs file. A local user could use this flaw to overwrite kernel memory, causing a denial of service (system crash) or arbitrary code execution. (CVE-2005-0867) Keith Owens reported a flaw in the Itanium unw_unwind_to_user function. A local user could use this flaw to cause a denial of service (system crash) on Itanium architectures. (CVE-2005-0135) A flaw in the NFS client O_DIRECT error case handling was discovered. A local user could use this flaw to cause a denial of service (system crash). (CVE-2005-0207) A small memory leak when defragmenting local packets was discovered that affected the Linux 2.6 kernel netfilter subsystem. A local user could send a large number of carefully crafted fragments leading to memory exhaustion (CVE-2005-0210) A flaw was discovered in the Linux PPP driver. On systems allowing remote users to connect to a server using ppp, a remote client could cause a denial of service (system crash). (CVE-2005-0384) A flaw was discovered in the ext2 file system code. When a new directory is created, the ext2 block written to disk is not initialized, which could lead to an information leak if a disk image is made available to unprivileged users. (CVE-2005-0400) A flaw in fragment queuing was discovered that affected the Linux kernel netfilter subsystem. On systems configured to filter or process network packets (e.g. firewalling), a remote attacker could send a carefully crafted set of fragmented packets to a machine and cause a denial of service (system crash). In order to sucessfully exploit this flaw, the attacker would need to know or guess some aspects of the firewall ruleset on the target system. (CVE-2005-0449) A number of flaws were found in the Linux 2.6 kernel. A local user could use these flaws to read kernel memory or cause a denial of service (crash). (CVE-2005-0529, CVE-2005-0530, CVE-2005-0531) An integer overflow in sys_epoll_wait in eventpoll.c was discovered. A local user could use this flaw to overwrite low kernel memory. This memory is usually unused, not usually resulting in a security consequence. (CVE-2005-0736) A flaw when freeing a pointer in load_elf_library was discovered. A local user could potentially use this flaw to cause a denial of service (crash). (CVE-2005-0749) A flaw was discovered in the bluetooth driver system. On systems where the bluetooth modules are loaded, a local user could use this flaw to gain elevated (root) privileges. (CVE-2005-0750) A race condition was discovered that affected the Radeon DRI driver. A local user who has DRI privileges on a Radeon graphics card may be able to use this flaw to gain root privileges. (CVE-2005-0767) Multiple range checking flaws were discovered in the iso9660 file system handler. An attacker could create a malicious file system image which would cause a denial or service or potentially execute arbitrary code if mounted. (CVE-2005-0815) A flaw was discovered when setting line discipline on a serial tty. A local user may be able to use this flaw to inject mouse movements or keystrokes when another user is logged in. (CVE-2005-0839) Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum. Please note that last seen 2020-06-01 modified 2020-06-02 plugin id 18095 published 2005-04-19 reporter This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/18095 title RHEL 4 : kernel (RHSA-2005:366) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2005-366.NASL description Updated kernel packages that fix several security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. [Updated 9 August 2005] The advisory text has been updated to show that this update fixed the security issue named CVE-2005-0210 but not CVE-2005-0209. The issue CVE-2005-0209 was actually fixed by RHSA-2005:420. No changes have been made to the packages associated with this advisory. The Linux kernel handles the basic functions of the operating system. A flaw in the fib_seq_start function was discovered. A local user could use this flaw to cause a denial of service (system crash) via /proc/net/route. (CVE-2005-1041) A flaw in the tmpfs file system was discovered. A local user could use this flaw to cause a denial of service (system crash). (CVE-2005-0977) An integer overflow flaw was found when writing to a sysfs file. A local user could use this flaw to overwrite kernel memory, causing a denial of service (system crash) or arbitrary code execution. (CVE-2005-0867) Keith Owens reported a flaw in the Itanium unw_unwind_to_user function. A local user could use this flaw to cause a denial of service (system crash) on Itanium architectures. (CVE-2005-0135) A flaw in the NFS client O_DIRECT error case handling was discovered. A local user could use this flaw to cause a denial of service (system crash). (CVE-2005-0207) A small memory leak when defragmenting local packets was discovered that affected the Linux 2.6 kernel netfilter subsystem. A local user could send a large number of carefully crafted fragments leading to memory exhaustion (CVE-2005-0210) A flaw was discovered in the Linux PPP driver. On systems allowing remote users to connect to a server using ppp, a remote client could cause a denial of service (system crash). (CVE-2005-0384) A flaw was discovered in the ext2 file system code. When a new directory is created, the ext2 block written to disk is not initialized, which could lead to an information leak if a disk image is made available to unprivileged users. (CVE-2005-0400) A flaw in fragment queuing was discovered that affected the Linux kernel netfilter subsystem. On systems configured to filter or process network packets (e.g. firewalling), a remote attacker could send a carefully crafted set of fragmented packets to a machine and cause a denial of service (system crash). In order to sucessfully exploit this flaw, the attacker would need to know or guess some aspects of the firewall ruleset on the target system. (CVE-2005-0449) A number of flaws were found in the Linux 2.6 kernel. A local user could use these flaws to read kernel memory or cause a denial of service (crash). (CVE-2005-0529, CVE-2005-0530, CVE-2005-0531) An integer overflow in sys_epoll_wait in eventpoll.c was discovered. A local user could use this flaw to overwrite low kernel memory. This memory is usually unused, not usually resulting in a security consequence. (CVE-2005-0736) A flaw when freeing a pointer in load_elf_library was discovered. A local user could potentially use this flaw to cause a denial of service (crash). (CVE-2005-0749) A flaw was discovered in the bluetooth driver system. On systems where the bluetooth modules are loaded, a local user could use this flaw to gain elevated (root) privileges. (CVE-2005-0750) A race condition was discovered that affected the Radeon DRI driver. A local user who has DRI privileges on a Radeon graphics card may be able to use this flaw to gain root privileges. (CVE-2005-0767) Multiple range checking flaws were discovered in the iso9660 file system handler. An attacker could create a malicious file system image which would cause a denial or service or potentially execute arbitrary code if mounted. (CVE-2005-0815) A flaw was discovered when setting line discipline on a serial tty. A local user may be able to use this flaw to inject mouse movements or keystrokes when another user is logged in. (CVE-2005-0839) Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum. Please note that last seen 2020-06-01 modified 2020-06-02 plugin id 21928 published 2006-07-05 reporter This script is Copyright (C) 2006-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/21928 title CentOS 3 / 4 : kernel (CESA-2005:366) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2005-293.NASL description Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 3 kernel are now available. This security advisory has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating system. The following security issues were fixed : The Vicam USB driver did not use the copy_from_user function to access userspace, crossing security boundaries. (CVE-2004-0075) The ext3 and jfs code did not properly initialize journal descriptor blocks. A privileged local user could read portions of kernel memory. (CVE-2004-0177) The terminal layer did not properly lock line discipline changes or pending IO. An unprivileged local user could read portions of kernel memory, or cause a denial of service (system crash). (CVE-2004-0814) A race condition was discovered. Local users could use this flaw to read the environment variables of another process that is still spawning via /proc/.../cmdline. (CVE-2004-1058) A flaw in the execve() syscall handling was discovered, allowing a local user to read setuid ELF binaries that should otherwise be protected by standard permissions. (CVE-2004-1073). Red Hat originally reported this as being fixed by RHSA-2004:549, but the associated fix was missing from that update. Keith Owens reported a flaw in the Itanium unw_unwind_to_user() function. A local user could use this flaw to cause a denial of service (system crash) on the Itanium architecture. (CVE-2005-0135) A missing Itanium syscall table entry could allow an unprivileged local user to cause a denial of service (system crash) on the Itanium architecture. (CVE-2005-0137) A flaw affecting the OUTS instruction on the AMD64 and Intel EM64T architectures was discovered. A local user could use this flaw to access privileged IO ports. (CVE-2005-0204) A flaw was discovered in the Linux PPP driver. On systems allowing remote users to connect to a server using ppp, a remote client could cause a denial of service (system crash). (CVE-2005-0384) A flaw in the Red Hat backport of NPTL to Red Hat Enterprise Linux 3 was discovered that left a pointer to a freed tty structure. A local user could potentially use this flaw to cause a denial of service (system crash) or possibly gain read or write access to ttys that should normally be prevented. (CVE-2005-0403) A flaw in fragment queuing was discovered affecting the netfilter subsystem. On systems configured to filter or process network packets (for example those configured to do firewalling), a remote attacker could send a carefully crafted set of fragmented packets to a machine and cause a denial of service (system crash). In order to sucessfully exploit this flaw, the attacker would need to know (or guess) some aspects of the firewall ruleset in place on the target system to be able to craft the right fragmented packets. (CVE-2005-0449) Missing validation of an epoll_wait() system call parameter could allow a local user to cause a denial of service (system crash) on the IBM S/390 and zSeries architectures. (CVE-2005-0736) A flaw when freeing a pointer in load_elf_library was discovered. A local user could potentially use this flaw to cause a denial of service (system crash). (CVE-2005-0749) A flaw was discovered in the bluetooth driver system. On system where the bluetooth modules are loaded, a local user could use this flaw to gain elevated (root) privileges. (CVE-2005-0750) In addition to the security issues listed above, there was an important fix made to the handling of the msync() system call for a particular case in which the call could return without queuing modified mmap() last seen 2020-06-01 modified 2020-06-02 plugin id 18128 published 2005-04-25 reporter This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/18128 title RHEL 3 : kernel (RHSA-2005:293) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-103-1.NASL description Mathieu Lafon discovered an information leak in the ext2 file system driver. When a new directory was created, the ext2 block written to disk was not initialized, so that previous memory contents (which could contain sensitive data like passwords) became visible on the raw device. This is particularly important if the target device is removable and thus can be read by users other than root. (CAN-2005-0400) Yichen Xie discovered a Denial of Service vulnerability in the ELF loader. A specially crafted ELF library or executable could cause an attempt to free an invalid pointer, which lead to a kernel crash. (CAN-2005-0749) Ilja van Sprundel discovered that the bluez_sock_create() function did not check its last seen 2020-06-01 modified 2020-06-02 plugin id 20489 published 2006-01-15 reporter Ubuntu Security Notice (C) 2005-2019 Canonical, Inc. / NASL script (C) 2006-2016 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/20489 title Ubuntu 4.10 : linux-source-2.6.8.1 vulnerabilities (USN-103-1) NASL family Fedora Local Security Checks NASL id FEDORA_2005-262.NASL description - Sun Mar 27 2005 Dave Jones <davej at redhat.com> - Catch up with all recent security issues. - CVE-2005-0210 : dst leak - CVE-2005-0384 : ppp dos - CVE-2005-0531 : Sign handling issues. - CVE-2005-0400 : EXT2 information leak. - CVE-2005-0449 : Remote oops. - CVE-2005-0736 : Epoll overflow - CVE-2005-0749 : ELF loader may kfree wrong memory. - CVE-2005-0750 : Missing range checking in bluetooth - CVE-2005-0767 : drm race in radeon - CVE-2005-0815 : Corrupt isofs images could cause oops. - Tue Mar 22 2005 Dave Jones <davej at redhat.com> - Fix swapped parameters to memset in ieee802.11 code. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 18324 published 2005-05-19 reporter This script is Copyright (C) 2005-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/18324 title Fedora Core 2 : kernel-2.6.10-1.771_FC2 (2005-262) NASL family Fedora Local Security Checks NASL id FEDORA_2005-313.NASL description This update rebases the kernel to the latest upstream stable release, which fixes a number of security issues. Notably : - CVE-2005-0210 : dst leak - CVE-2005-0384 : ppp dos - CVE-2005-0531 : Sign handling issues. - CVE-2005-0400 : EXT2 information leak. - CVE-2005-0449 : Remote oops. - CVE-2005-0736 : Epoll overflow - CVE-2005-0749 : ELF loader may kfree wrong memory. - CVE-2005-0750 : Missing range checking in bluetooth - CVE-2005-0767 : drm race in radeon - CVE-2005-0815 : Corrupt isofs images could cause oops Additionally, a large number of improvements have come from the 2.6.10 -> 2.6.11 transition. This update requires you are running the latest udev package, and also (if you are using SELinux) the latest selinux policy packages. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 19648 published 2005-09-12 reporter This script is Copyright (C) 2005-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/19648 title Fedora Core 3 : kernel-2.6.11-1.14_FC3 (2005-313) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2005-293.NASL description Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 3 kernel are now available. This security advisory has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating system. The following security issues were fixed : The Vicam USB driver did not use the copy_from_user function to access userspace, crossing security boundaries. (CVE-2004-0075) The ext3 and jfs code did not properly initialize journal descriptor blocks. A privileged local user could read portions of kernel memory. (CVE-2004-0177) The terminal layer did not properly lock line discipline changes or pending IO. An unprivileged local user could read portions of kernel memory, or cause a denial of service (system crash). (CVE-2004-0814) A race condition was discovered. Local users could use this flaw to read the environment variables of another process that is still spawning via /proc/.../cmdline. (CVE-2004-1058) A flaw in the execve() syscall handling was discovered, allowing a local user to read setuid ELF binaries that should otherwise be protected by standard permissions. (CVE-2004-1073). Red Hat originally reported this as being fixed by RHSA-2004:549, but the associated fix was missing from that update. Keith Owens reported a flaw in the Itanium unw_unwind_to_user() function. A local user could use this flaw to cause a denial of service (system crash) on the Itanium architecture. (CVE-2005-0135) A missing Itanium syscall table entry could allow an unprivileged local user to cause a denial of service (system crash) on the Itanium architecture. (CVE-2005-0137) A flaw affecting the OUTS instruction on the AMD64 and Intel EM64T architectures was discovered. A local user could use this flaw to access privileged IO ports. (CVE-2005-0204) A flaw was discovered in the Linux PPP driver. On systems allowing remote users to connect to a server using ppp, a remote client could cause a denial of service (system crash). (CVE-2005-0384) A flaw in the Red Hat backport of NPTL to Red Hat Enterprise Linux 3 was discovered that left a pointer to a freed tty structure. A local user could potentially use this flaw to cause a denial of service (system crash) or possibly gain read or write access to ttys that should normally be prevented. (CVE-2005-0403) A flaw in fragment queuing was discovered affecting the netfilter subsystem. On systems configured to filter or process network packets (for example those configured to do firewalling), a remote attacker could send a carefully crafted set of fragmented packets to a machine and cause a denial of service (system crash). In order to sucessfully exploit this flaw, the attacker would need to know (or guess) some aspects of the firewall ruleset in place on the target system to be able to craft the right fragmented packets. (CVE-2005-0449) Missing validation of an epoll_wait() system call parameter could allow a local user to cause a denial of service (system crash) on the IBM S/390 and zSeries architectures. (CVE-2005-0736) A flaw when freeing a pointer in load_elf_library was discovered. A local user could potentially use this flaw to cause a denial of service (system crash). (CVE-2005-0749) A flaw was discovered in the bluetooth driver system. On system where the bluetooth modules are loaded, a local user could use this flaw to gain elevated (root) privileges. (CVE-2005-0750) In addition to the security issues listed above, there was an important fix made to the handling of the msync() system call for a particular case in which the call could return without queuing modified mmap() last seen 2020-06-01 modified 2020-06-02 plugin id 21923 published 2006-07-05 reporter This script is Copyright (C) 2006-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/21923 title CentOS 3 : kernel (CESA-2005:293) NASL family SuSE Local Security Checks NASL id SUSE_SA_2005_029.NASL description The remote host is missing the patch for the advisory SUSE-SA:2005:029 (kernel). The Linux kernel is the core component of the Linux system. This update fixes various security as well as non-security problems discovered since the last round of kernel updates. The following security problems have been fixed: - when creating directories on ext2 filesystems the kernel did not zero initialize the memory allocated. Therefore potentially sensitive information could be exposed to users (CVE-2005-0400). All SUSE LINUX based products are affected. - local users can crash the kernel via a crafted ELF library or executable, which causes a free of an invalid pointer (CVE-2005-0749). All SUSE LINUX based products are affected. - local users could gain root access via a bluetooth socket (CVE-2005-0750). The fix for this problem was missing in SUSE LINUX 9.3 only. - local users could gain root access by causing a core dump of specially crafted ELF executables (CVE-2005-1263). The problem is believed to be not exploitable on any SUSE LINUX based product. The patch is included nevertheless. - on the x86-64 platform various bugs allowed local users to crash the kernel or CPU (CVE-2005-0756, CVE-2005-1762, CVE-2005-1764, CVE-2005-1765) All SUSE LINUX based products on the x86-64 architecture are affected. - an overflow in the x86-64 ptrace code allowed local users to write a few bytes into kernel memory pages they normally shouldn last seen 2019-10-28 modified 2005-06-10 plugin id 18462 published 2005-06-10 reporter This script is Copyright (C) 2005-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/18462 title SUSE-SA:2005:029: kernel NASL family Mandriva Local Security Checks NASL id MANDRAKE_MDKSA-2005-110.NASL description Multiple vulnerabilities in the Linux kernel have been discovered and fixed in this update. The following CVE names have been fixed in the LE2005 kernel : Colin Percival discovered a vulnerability in Intel last seen 2020-06-01 modified 2020-06-02 plugin id 18598 published 2005-07-01 reporter This script is Copyright (C) 2005-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/18598 title Mandrake Linux Security Advisory : kernel (MDKSA-2005:110)
Oval
| accepted | 2013-04-29T04:15:29.557-04:00 | ||||||||||||||||||||
| class | vulnerability | ||||||||||||||||||||
| contributors |
| ||||||||||||||||||||
| definition_extensions |
| ||||||||||||||||||||
| description | The bluez_sock_create function in the Bluetooth stack for Linux kernel 2.4.6 through 2.4.30-rc1 and 2.6 through 2.6.11.5 allows local users to gain privileges via (1) socket or (2) socketpair call with a negative protocol value. | ||||||||||||||||||||
| family | unix | ||||||||||||||||||||
| id | oval:org.mitre.oval:def:11719 | ||||||||||||||||||||
| status | accepted | ||||||||||||||||||||
| submitted | 2010-07-09T03:56:16-04:00 | ||||||||||||||||||||
| title | The bluez_sock_create function in the Bluetooth stack for Linux kernel 2.4.6 through 2.4.30-rc1 and 2.6 through 2.6.11.5 allows local users to gain privileges via (1) socket or (2) socketpair call with a negative protocol value. | ||||||||||||||||||||
| version | 26 |
Redhat
| advisories |
| ||||||||||||||||
| rpms |
|
References
- http://lists.grok.org.uk/pipermail/full-disclosure/2005-March/032913.html
- http://marc.info/?l=bugtraq&m=111204562102633&w=2
- http://www.redhat.com/support/errata/RHSA-2005-283.html
- http://www.redhat.com/support/errata/RHSA-2005-284.html
- http://www.redhat.com/support/errata/RHSA-2005-293.html
- http://www.redhat.com/support/errata/RHSA-2005-366.html
- http://www.securityfocus.com/bid/12911
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=152532
- https://exchange.xforce.ibmcloud.com/vulnerabilities/19844
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11719