Vulnerabilities > CVE-2005-1263 - Local Buffer Overflow vulnerability in Linux Kernel ELF Core Dump

047910
CVSS 7.2 - HIGH
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
local
low complexity
linux
nessus
exploit available

Summary

The elf_core_dump function in binfmt_elf.c for Linux kernel 2.x.x to 2.2.27-rc2, 2.4.x to 2.4.31-pre1, and 2.6.x to 2.6.12-rc4 allows local users to execute arbitrary code via an ELF binary that, in certain conditions involving the create_elf_tables function, causes a negative length argument to pass a signed integer comparison, leading to a buffer overflow.

Vulnerable Configurations

Part Description Count
OS
Linux
129

Exploit-Db

descriptionLinux Kernel 2.2.x.2.3.x/2.4.x/2.5.x/2.6.x ELF Core Dump Local Buffer Overflow Vulnerability. CVE-2005-1263. Local exploit for linux platform
idEDB-ID:25647
last seen2016-02-03
modified2005-05-11
published2005-05-11
reporterPaul Starzetz
sourcehttps://www.exploit-db.com/download/25647/
titleLinux Kernel 2.2.x / 2.3.x / 2.4.x / 2.5.x / 2.6.x - ELF Core Dump Local Buffer Overflow Vulnerability

Nessus

  • NASL familyMandriva Local Security Checks
    NASL idMANDRAKE_MDKSA-2005-111.NASL
    descriptionMultiple vulnerabilities in the Linux kernel have been discovered and fixed in this update. The following have been fixed in the 2.4 kernels : Colin Percival discovered a vulnerability in Intel
    last seen2020-06-01
    modified2020-06-02
    plugin id18599
    published2005-07-01
    reporterThis script is Copyright (C) 2005-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/18599
    titleMandrake Linux Security Advisory : kernel-2.4 (MDKSA-2005:111)
    code
    #%NASL_MIN_LEVEL 80502
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Mandrake Linux Security Advisory MDKSA-2005:111. 
    # The text itself is copyright (C) Mandriva S.A.
    #
    
    if (NASL_LEVEL < 3000) exit(0);
    
    include("compat.inc");
    
    if (description)
    {
      script_id(18599);
      script_version ("1.23");
      script_cvs_date("Date: 2019/08/02 13:32:47");
    
      script_cve_id("CVE-2005-0109", "CVE-2005-0209", "CVE-2005-0384", "CVE-2005-0400", "CVE-2005-0530", "CVE-2005-0531", "CVE-2005-0749", "CVE-2005-0750", "CVE-2005-0767", "CVE-2005-1263");
      script_xref(name:"MDKSA", value:"2005:111");
    
      script_name(english:"Mandrake Linux Security Advisory : kernel-2.4 (MDKSA-2005:111)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Mandrake Linux host is missing one or more security
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Multiple vulnerabilities in the Linux kernel have been discovered and
    fixed in this update. The following have been fixed in the 2.4 
    kernels :
    
    Colin Percival discovered a vulnerability in Intel's Hyper-Threading
    technology could allow a local user to use a malicious thread to
    create covert channels, monitor the execution of other threads, and
    obtain sensitive information such as cryptographic keys via a timing
    attack on memory cache misses. This has been corrected by disabling HT
    support in all kernels (CVE-2005-0109).
    
    When forwarding fragmented packets, a hardware assisted checksum could
    only be used once which could lead to a Denial of Service attack or
    crash by remote users (CVE-2005-0209).
    
    A flaw in the Linux PPP driver was found where on systems allowing
    remote users to connect to a server via PPP, a remote client could
    cause a crash, resulting in a Denial of Service (CVE-2005-0384).
    
    An information leak in the ext2 filesystem code was found where when a
    new directory is created, the ext2 block written to disk is not
    initialized (CVE-2005-0400).
    
    A signedness error in the copy_from_read_buf function in n_tty.c
    allows local users to read kernel memory via a negative argument
    (CVE-2005-0530).
    
    George Guninski discovered a buffer overflow in the ATM driver where
    the atm_get_addr() function does not validate its arguments
    sufficiently which could allow a local attacker to overwrite large
    portions of kernel memory by supplying a negative length argument.
    This could potentially lead to the execution of arbitrary code
    (CVE-2005-0531).
    
    A flaw when freeing a pointer in load_elf_library was found that could
    be abused by a local user to potentially crash the machine causing a
    Denial of Service (CVE-2005-0749).
    
    A problem with the Bluetooth kernel stack in kernels 2.4.6 through
    2.4.30-rc1 and 2.6 through 2.6.11.5 could be used by a local attacker
    to gain root access or crash the machine (CVE-2005-0750).
    
    A race condition in the Radeon DRI driver allows a local user with DRI
    privileges to execute arbitrary code as root (CVE-2005-0767).
    
    Paul Starzetz found an integer overflow in the ELF binary format
    loader's code dump function in kernels prior to and including
    2.4.31-pre1 and 2.6.12-rc4. By creating and executing a specially
    crafted ELF executable, a local attacker could exploit this to execute
    arbitrary code with root and kernel privileges (CVE-2005-1263)."
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
      script_cwe_id(20);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:kernel-2.4.25.14mdk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:kernel-2.4.28.0.rc1.6mdk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:kernel-enterprise-2.4.25.14mdk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:kernel-enterprise-2.4.28.0.rc1.6mdk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:kernel-i586-up-1GB-2.4.28.0.rc1.6mdk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:kernel-i686-up-4GB-2.4.25.14mdk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:kernel-p3-smp-64GB-2.4.25.14mdk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:kernel-smp-2.4.25.14mdk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:kernel-smp-2.4.28.0.rc1.6mdk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:kernel-source");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:kernel-source-2.4");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:10.0");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:10.1");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2005/06/30");
      script_set_attribute(attribute:"plugin_publication_date", value:"2005/07/01");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2005-2019 Tenable Network Security, Inc.");
      script_family(english:"Mandriva Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Mandrake/release")) audit(AUDIT_OS_NOT, "Mandriva / Mandake Linux");
    if (!get_kb_item("Host/Mandrake/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^(amd64|i[3-6]86|x86_64)$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Mandriva / Mandrake Linux", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"MDK10.0", reference:"kernel-2.4.25.14mdk-1-1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"kernel-enterprise-2.4.25.14mdk-1-1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"kernel-i686-up-4GB-2.4.25.14mdk-1-1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"kernel-p3-smp-64GB-2.4.25.14mdk-1-1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.0", reference:"kernel-smp-2.4.25.14mdk-1-1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.0", reference:"kernel-source-2.4.25-14mdk", yank:"mdk")) flag++;
    
    if (rpm_check(release:"MDK10.1", reference:"kernel-2.4.28.0.rc1.6mdk-1-1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.1", cpu:"i386", reference:"kernel-enterprise-2.4.28.0.rc1.6mdk-1-1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.1", cpu:"i386", reference:"kernel-i586-up-1GB-2.4.28.0.rc1.6mdk-1-1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.1", reference:"kernel-smp-2.4.28.0.rc1.6mdk-1-1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.1", reference:"kernel-source-2.4-2.4.28-0.rc1.6mdk", yank:"mdk")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2005-529.NASL
    descriptionUpdated kernel packages that fix a number of security issues as well as other bugs are now available for Red Hat Enterprise Linux 2.1 (32 bit architectures) This update has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating system. This is a kernel maintenance update to Red Hat Enterprise Linux 2.1. The following security issues were corrected : A flaw between execve() syscall handling and core dumping of ELF-format executables allowed local unprivileged users to cause a denial of service (system crash) or possibly gain privileges. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-1263 to this issue. A flaw when freeing a pointer in load_elf_library was discovered. A local user could potentially use this flaw to cause a denial of service (crash). (CVE-2005-0749) The Direct Rendering Manager (DRM) driver did not properly check the DMA lock, which could allow remote attackers or local users to cause a denial of service (X Server crash) or possibly modify the video output. (CVE-2004-1056) A flaw in the moxa serial driver could allow a local user to perform privileged operations such as replacing the firmware. (CVE-2005-0504) The following bug fixes were also made : - Fix a race condition that can cause a panic in __get_lease() - Fix a race condition that can cause a panic when reading /proc/mdstat - Fix incorrect ide accounting - Prevent non-root users from reloading moxa driver firmware - Fix a NULL pointer dereference bug in rpciod - Fix legacy-usb handoff for certain IBM platforms - Fix a bug that caused busy inodes after unmount - Provide an additional fix for a memory leak in scsi_scan_single. - Fix a potential kswapd/dquot deadlock. - Fix a potential local DoS in shmemfs. - Fix a random poolsize vulnerability. Red Hat Enterprise Linux 2.1 users are advised to upgrade their kernels to the packages associated with their machine configurations as listed in this erratum.
    last seen2020-06-01
    modified2020-06-02
    plugin id19543
    published2005-08-30
    reporterThis script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/19543
    titleRHEL 2.1 : kernel (RHSA-2005:529)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2005:529. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(19543);
      script_version ("1.30");
      script_cvs_date("Date: 2019/10/25 13:36:11");
    
      script_cve_id("CVE-2004-1056", "CVE-2005-0504", "CVE-2005-0749", "CVE-2005-1263");
      script_xref(name:"RHSA", value:"2005:529");
    
      script_name(english:"RHEL 2.1 : kernel (RHSA-2005:529)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Updated kernel packages that fix a number of security issues as well
    as other bugs are now available for Red Hat Enterprise Linux 2.1 (32
    bit architectures)
    
    This update has been rated as having important security impact by the
    Red Hat Security Response Team.
    
    The Linux kernel handles the basic functions of the operating system.
    
    This is a kernel maintenance update to Red Hat Enterprise Linux 2.1.
    
    The following security issues were corrected :
    
    A flaw between execve() syscall handling and core dumping of
    ELF-format executables allowed local unprivileged users to cause a
    denial of service (system crash) or possibly gain privileges. The
    Common Vulnerabilities and Exposures project has assigned the name
    CVE-2005-1263 to this issue.
    
    A flaw when freeing a pointer in load_elf_library was discovered. A
    local user could potentially use this flaw to cause a denial of
    service (crash). (CVE-2005-0749)
    
    The Direct Rendering Manager (DRM) driver did not properly check the
    DMA lock, which could allow remote attackers or local users to cause a
    denial of service (X Server crash) or possibly modify the video
    output. (CVE-2004-1056)
    
    A flaw in the moxa serial driver could allow a local user to perform
    privileged operations such as replacing the firmware. (CVE-2005-0504)
    
    The following bug fixes were also made :
    
      - Fix a race condition that can cause a panic in
        __get_lease() - Fix a race condition that can cause a
        panic when reading /proc/mdstat - Fix incorrect ide
        accounting - Prevent non-root users from reloading moxa
        driver firmware - Fix a NULL pointer dereference bug in
        rpciod - Fix legacy-usb handoff for certain IBM
        platforms - Fix a bug that caused busy inodes after
        unmount - Provide an additional fix for a memory leak in
        scsi_scan_single. - Fix a potential kswapd/dquot
        deadlock. - Fix a potential local DoS in shmemfs. - Fix
        a random poolsize vulnerability.
    
    Red Hat Enterprise Linux 2.1 users are advised to upgrade their
    kernels to the packages associated with their machine configurations
    as listed in this erratum."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2004-1056"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2005-0504"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2005-0749"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2005-1263"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2005:529"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
      script_cwe_id(119);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-BOOT");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-debug");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-doc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-enterprise");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-headers");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-smp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-source");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-summit");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:2.1");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2005/01/10");
      script_set_attribute(attribute:"patch_publication_date", value:"2005/08/25");
      script_set_attribute(attribute:"plugin_publication_date", value:"2005/08/30");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl", "linux_alt_patch_detect.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    include("ksplice.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^2\.1([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 2.1", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    if (get_one_kb_item("Host/ksplice/kernel-cves"))
    {
      rm_kb_item(name:"Host/uptrack-uname-r");
      cve_list = make_list("CAN-2005-1263", "CVE-2004-1056", "CVE-2005-0504", "CVE-2005-0749", "CVE-2005-1263");
      if (ksplice_cves_check(cve_list))
      {
        audit(AUDIT_PATCH_INSTALLED, "KSplice hotfix for RHSA-2005:529");
      }
      else
      {
        __rpm_report = ksplice_reporting_text();
      }
    }
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2005:529";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL2.1", cpu:"i686", reference:"kernel-2.4.9-e.65")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"kernel-BOOT-2.4.9-e.65")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i686", reference:"kernel-debug-2.4.9-e.65")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"kernel-doc-2.4.9-e.65")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i686", reference:"kernel-enterprise-2.4.9-e.65")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"kernel-headers-2.4.9-e.65")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i686", reference:"kernel-smp-2.4.9-e.65")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"kernel-source-2.4.9-e.65")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i686", reference:"kernel-summit-2.4.9-e.65")) flag++;
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "kernel / kernel-BOOT / kernel-debug / kernel-doc / etc");
      }
    }
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2005-472.NASL
    descriptionUpdated kernel packages that fix several security issues in the Red Hat Enterprise Linux 3 kernel are now available. This security advisory has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating system. These new kernel packages contain fixes for the three security issues described below as well as an important fix for a problem that could lead to data corruption on x86-architecture SMP systems with greater than 4GB of memory through heavy usage of multi-threaded applications. A flaw between execve() syscall handling and core dumping of ELF-format executables allowed local unprivileged users to cause a denial of service (system crash) or possibly gain privileges. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-1263 to this issue. A flaw in shared memory locking allowed local unprivileged users to lock and unlock regions of shared memory segments they did not own (CVE-2005-0176). A flaw in the locking of SysV IPC shared memory regions allowed local unprivileged users to bypass their RLIMIT_MEMLOCK resource limit (CVE-2004-0491). Note: The kernel-unsupported package contains various drivers and modules that are unsupported and therefore might contain security problems that have not been addressed. All Red Hat Enterprise Linux 3 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum. Please also consult the RHEL3 Update 5 advisory RHSA-2005:294 for the complete list of features added and bugs fixed in U5, which was released only a week prior to this security update.
    last seen2020-06-01
    modified2020-06-02
    plugin id18389
    published2005-05-28
    reporterThis script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/18389
    titleRHEL 3 : kernel (RHSA-2005:472)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2005:472. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(18389);
      script_version ("1.26");
      script_cvs_date("Date: 2019/10/25 13:36:11");
    
      script_cve_id("CVE-2004-0491", "CVE-2005-0176", "CVE-2005-1263");
      script_xref(name:"RHSA", value:"2005:472");
    
      script_name(english:"RHEL 3 : kernel (RHSA-2005:472)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Updated kernel packages that fix several security issues in the Red
    Hat Enterprise Linux 3 kernel are now available.
    
    This security advisory has been rated as having important security
    impact by the Red Hat Security Response Team.
    
    The Linux kernel handles the basic functions of the operating system.
    
    These new kernel packages contain fixes for the three security issues
    described below as well as an important fix for a problem that could
    lead to data corruption on x86-architecture SMP systems with greater
    than 4GB of memory through heavy usage of multi-threaded applications.
    
    A flaw between execve() syscall handling and core dumping of
    ELF-format executables allowed local unprivileged users to cause a
    denial of service (system crash) or possibly gain privileges. The
    Common Vulnerabilities and Exposures project has assigned the name
    CVE-2005-1263 to this issue.
    
    A flaw in shared memory locking allowed local unprivileged users to
    lock and unlock regions of shared memory segments they did not own
    (CVE-2005-0176).
    
    A flaw in the locking of SysV IPC shared memory regions allowed local
    unprivileged users to bypass their RLIMIT_MEMLOCK resource limit
    (CVE-2004-0491).
    
    Note: The kernel-unsupported package contains various drivers and
    modules that are unsupported and therefore might contain security
    problems that have not been addressed.
    
    All Red Hat Enterprise Linux 3 users are advised to upgrade their
    kernels to the packages associated with their machine architectures
    and configurations as listed in this erratum.
    
    Please also consult the RHEL3 Update 5 advisory RHSA-2005:294 for the
    complete list of features added and bugs fixed in U5, which was
    released only a week prior to this security update."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2004-0491"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2005-0176"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2005-1263"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2005:472"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-BOOT");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-doc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-hugemem");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-hugemem-unsupported");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-smp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-smp-unsupported");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-source");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-unsupported");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:3");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2004/12/31");
      script_set_attribute(attribute:"patch_publication_date", value:"2005/05/25");
      script_set_attribute(attribute:"plugin_publication_date", value:"2005/05/28");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl", "linux_alt_patch_detect.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    include("ksplice.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^3([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 3.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    if (get_one_kb_item("Host/ksplice/kernel-cves"))
    {
      rm_kb_item(name:"Host/uptrack-uname-r");
      cve_list = make_list("CAN-2005-1263", "CVE-2004-0491", "CVE-2005-0176", "CVE-2005-1263");
      if (ksplice_cves_check(cve_list))
      {
        audit(AUDIT_PATCH_INSTALLED, "KSplice hotfix for RHSA-2005:472");
      }
      else
      {
        __rpm_report = ksplice_reporting_text();
      }
    }
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2005:472";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL3", reference:"kernel-2.4.21-32.0.1.EL")) flag++;
      if (rpm_check(release:"RHEL3", cpu:"i386", reference:"kernel-BOOT-2.4.21-32.0.1.EL")) flag++;
      if (rpm_check(release:"RHEL3", reference:"kernel-doc-2.4.21-32.0.1.EL")) flag++;
      if (rpm_check(release:"RHEL3", cpu:"i686", reference:"kernel-hugemem-2.4.21-32.0.1.EL")) flag++;
      if (rpm_check(release:"RHEL3", cpu:"i686", reference:"kernel-hugemem-unsupported-2.4.21-32.0.1.EL")) flag++;
      if (rpm_check(release:"RHEL3", cpu:"i686", reference:"kernel-smp-2.4.21-32.0.1.EL")) flag++;
      if (rpm_check(release:"RHEL3", cpu:"x86_64", reference:"kernel-smp-2.4.21-32.0.1.EL")) flag++;
      if (rpm_check(release:"RHEL3", cpu:"i686", reference:"kernel-smp-unsupported-2.4.21-32.0.1.EL")) flag++;
      if (rpm_check(release:"RHEL3", cpu:"x86_64", reference:"kernel-smp-unsupported-2.4.21-32.0.1.EL")) flag++;
      if (rpm_check(release:"RHEL3", reference:"kernel-source-2.4.21-32.0.1.EL")) flag++;
      if (rpm_check(release:"RHEL3", reference:"kernel-unsupported-2.4.21-32.0.1.EL")) flag++;
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "kernel / kernel-BOOT / kernel-doc / kernel-hugemem / etc");
      }
    }
    
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2005-472.NASL
    descriptionUpdated kernel packages that fix several security issues in the Red Hat Enterprise Linux 3 kernel are now available. This security advisory has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating system. These new kernel packages contain fixes for the three security issues described below as well as an important fix for a problem that could lead to data corruption on x86-architecture SMP systems with greater than 4GB of memory through heavy usage of multi-threaded applications. A flaw between execve() syscall handling and core dumping of ELF-format executables allowed local unprivileged users to cause a denial of service (system crash) or possibly gain privileges. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-1263 to this issue. A flaw in shared memory locking allowed local unprivileged users to lock and unlock regions of shared memory segments they did not own (CVE-2005-0176). A flaw in the locking of SysV IPC shared memory regions allowed local unprivileged users to bypass their RLIMIT_MEMLOCK resource limit (CVE-2004-0491). Note: The kernel-unsupported package contains various drivers and modules that are unsupported and therefore might contain security problems that have not been addressed. All Red Hat Enterprise Linux 3 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum. Please also consult the RHEL3 Update 5 advisory RHSA-2005:294 for the complete list of features added and bugs fixed in U5, which was released only a week prior to this security update.
    last seen2020-06-01
    modified2020-06-02
    plugin id21828
    published2006-07-03
    reporterThis script is Copyright (C) 2006-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/21828
    titleCentOS 3 : kernel (CESA-2005:472)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2005:472 and 
    # CentOS Errata and Security Advisory 2005:472 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(21828);
      script_version("1.15");
      script_cvs_date("Date: 2019/10/25 13:36:02");
    
      script_cve_id("CVE-2004-0491", "CVE-2005-0176", "CVE-2005-1263");
      script_xref(name:"RHSA", value:"2005:472");
    
      script_name(english:"CentOS 3 : kernel (CESA-2005:472)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote CentOS host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Updated kernel packages that fix several security issues in the Red
    Hat Enterprise Linux 3 kernel are now available.
    
    This security advisory has been rated as having important security
    impact by the Red Hat Security Response Team.
    
    The Linux kernel handles the basic functions of the operating system.
    
    These new kernel packages contain fixes for the three security issues
    described below as well as an important fix for a problem that could
    lead to data corruption on x86-architecture SMP systems with greater
    than 4GB of memory through heavy usage of multi-threaded applications.
    
    A flaw between execve() syscall handling and core dumping of
    ELF-format executables allowed local unprivileged users to cause a
    denial of service (system crash) or possibly gain privileges. The
    Common Vulnerabilities and Exposures project has assigned the name
    CVE-2005-1263 to this issue.
    
    A flaw in shared memory locking allowed local unprivileged users to
    lock and unlock regions of shared memory segments they did not own
    (CVE-2005-0176).
    
    A flaw in the locking of SysV IPC shared memory regions allowed local
    unprivileged users to bypass their RLIMIT_MEMLOCK resource limit
    (CVE-2004-0491).
    
    Note: The kernel-unsupported package contains various drivers and
    modules that are unsupported and therefore might contain security
    problems that have not been addressed.
    
    All Red Hat Enterprise Linux 3 users are advised to upgrade their
    kernels to the packages associated with their machine architectures
    and configurations as listed in this erratum.
    
    Please also consult the RHEL3 Update 5 advisory RHSA-2005:294 for the
    complete list of features added and bugs fixed in U5, which was
    released only a week prior to this security update."
      );
      # https://lists.centos.org/pipermail/centos-announce/2005-May/011760.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?4a08da71"
      );
      # https://lists.centos.org/pipermail/centos-announce/2005-May/011761.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?d12fa673"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected kernel packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:kernel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:kernel-BOOT");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:kernel-doc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:kernel-hugemem");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:kernel-hugemem-unsupported");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:kernel-smp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:kernel-smp-unsupported");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:kernel-source");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:kernel-unsupported");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:3");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2004/12/31");
      script_set_attribute(attribute:"patch_publication_date", value:"2005/05/25");
      script_set_attribute(attribute:"plugin_publication_date", value:"2006/07/03");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2006-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"CentOS Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/CentOS/release");
    if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS");
    os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS");
    os_ver = os_ver[1];
    if (! preg(pattern:"^3([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 3.x", "CentOS " + os_ver);
    
    if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && "ia64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"CentOS-3", cpu:"i386", reference:"kernel-2.4.21-32.0.1.EL")) flag++;
    if (rpm_check(release:"CentOS-3", cpu:"x86_64", reference:"kernel-2.4.21-32.0.1.EL")) flag++;
    if (rpm_check(release:"CentOS-3", cpu:"i386", reference:"kernel-BOOT-2.4.21-32.0.1.EL")) flag++;
    if (rpm_check(release:"CentOS-3", cpu:"i386", reference:"kernel-doc-2.4.21-32.0.1.EL")) flag++;
    if (rpm_check(release:"CentOS-3", cpu:"x86_64", reference:"kernel-doc-2.4.21-32.0.1.EL")) flag++;
    if (rpm_check(release:"CentOS-3", cpu:"i386", reference:"kernel-hugemem-2.4.21-32.0.1.EL")) flag++;
    if (rpm_check(release:"CentOS-3", cpu:"i386", reference:"kernel-hugemem-unsupported-2.4.21-32.0.1.EL")) flag++;
    if (rpm_check(release:"CentOS-3", cpu:"i386", reference:"kernel-smp-2.4.21-32.0.1.EL")) flag++;
    if (rpm_check(release:"CentOS-3", cpu:"x86_64", reference:"kernel-smp-2.4.21-32.0.1.EL")) flag++;
    if (rpm_check(release:"CentOS-3", cpu:"i386", reference:"kernel-smp-unsupported-2.4.21-32.0.1.EL")) flag++;
    if (rpm_check(release:"CentOS-3", cpu:"x86_64", reference:"kernel-smp-unsupported-2.4.21-32.0.1.EL")) flag++;
    if (rpm_check(release:"CentOS-3", cpu:"i386", reference:"kernel-source-2.4.21-32.0.1.EL")) flag++;
    if (rpm_check(release:"CentOS-3", cpu:"x86_64", reference:"kernel-source-2.4.21-32.0.1.EL")) flag++;
    if (rpm_check(release:"CentOS-3", cpu:"i386", reference:"kernel-unsupported-2.4.21-32.0.1.EL")) flag++;
    if (rpm_check(release:"CentOS-3", cpu:"x86_64", reference:"kernel-unsupported-2.4.21-32.0.1.EL")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "kernel / kernel-BOOT / kernel-doc / kernel-hugemem / etc");
    }
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2005-392.NASL
    description - Tue May 17 2005 Dave Jones <davej at redhat.com> - Remove the unused (and outdated) Xen patches from the FC3 tree. - Mon May 16 2005 Dave Jones <davej at redhat.com> - Rebase to 2.6.11.10, (fixing CVE-2005-1264) - Thu May 12 2005 Dave Jones <davej at redhat.com> - Rebase to 2.6.11.9, (fixing CVE-2005-1263) - Tue May 10 2005 Dave Jones <davej at redhat.com> - Fix two bugs in x86-64 page fault handler. - Mon May 9 2005 Dave Jones <davej at redhat.com> - Rebase to 2.6.11.8 |<i> Fixes CVE-2005-1368 (local DoS in key lookup). (#156680) </I>|<i> Fixes CVE-2005-1369 (i2c alarms sysfs DoS). (#156683) </I>- Merge IDE fixes from 2.6.11-ac7 - Add Conflicts for older IPW firmwares. - Fix conntrack leak with raw sockets. - Sun May 1 2005 Dave Jones <davej at redhat.com> - Various firewire fixes backported from -mm. (#133798) (Thanks to Jody McIntyre for doing this) - Fri Apr 29 2005 Dave Jones <davej at redhat.com> - fix oops in aacraid open when using adaptec tools. (#148761) - Blacklist another brainless SCSI scanner. (#155457) - Thu Apr 21 2005 Dave Jones <davej at redhat.com> - Fix up SCSI queue locking. (#155472) - Tue Apr 19 2005 Dave Jones <davej at redhat.com> - SCSI tape security: require CAP_ADMIN for SG_IO etc. (#155355) - Mon Apr 18 2005 Dave Jones <davej at redhat.com> - Retry more aggressively during USB device initialization - Thu Apr 14 2005 Dave Jones <davej at redhat.com> - Build DRM modular. (#154769) - Fri Apr 8 2005 Dave Jones <davej at redhat.com> - Disable Longhaul driver (again). Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id18377
    published2005-05-28
    reporterThis script is Copyright (C) 2005-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/18377
    titleFedora Core 3 : kernel-2.6.11-1.27_FC3 (2005-392)
    code
    #%NASL_MIN_LEVEL 80502
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory 2005-392.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(18377);
      script_version ("1.14");
      script_cvs_date("Date: 2019/08/02 13:32:24");
    
      script_xref(name:"FEDORA", value:"2005-392");
    
      script_name(english:"Fedora Core 3 : kernel-2.6.11-1.27_FC3 (2005-392)");
      script_summary(english:"Checks rpm output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora Core host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "  - Tue May 17 2005 Dave Jones <davej at redhat.com>
    
        - Remove the unused (and outdated) Xen patches from the
          FC3 tree.
    
      - Mon May 16 2005 Dave Jones <davej at redhat.com>
    
        - Rebase to 2.6.11.10, (fixing CVE-2005-1264)
    
      - Thu May 12 2005 Dave Jones <davej at redhat.com>
    
        - Rebase to 2.6.11.9, (fixing CVE-2005-1263)
    
      - Tue May 10 2005 Dave Jones <davej at redhat.com>
    
        - Fix two bugs in x86-64 page fault handler.
    
      - Mon May 9 2005 Dave Jones <davej at redhat.com>
    
        - Rebase to 2.6.11.8 |<i> Fixes CVE-2005-1368 (local DoS
          in key lookup). (#156680) </I>|<i> Fixes CVE-2005-1369
          (i2c alarms sysfs DoS). (#156683) </I>- Merge IDE
          fixes from 2.6.11-ac7
    
      - Add Conflicts for older IPW firmwares.
    
        - Fix conntrack leak with raw sockets.
    
      - Sun May 1 2005 Dave Jones <davej at redhat.com>
    
        - Various firewire fixes backported from -mm. (#133798)
          (Thanks to Jody McIntyre for doing this)
    
      - Fri Apr 29 2005 Dave Jones <davej at redhat.com>
    
        - fix oops in aacraid open when using adaptec tools.
          (#148761)
    
        - Blacklist another brainless SCSI scanner. (#155457)
    
      - Thu Apr 21 2005 Dave Jones <davej at redhat.com>
    
        - Fix up SCSI queue locking. (#155472)
    
      - Tue Apr 19 2005 Dave Jones <davej at redhat.com>
    
        - SCSI tape security: require CAP_ADMIN for SG_IO etc.
          (#155355)
    
      - Mon Apr 18 2005 Dave Jones <davej at redhat.com>
    
        - Retry more aggressively during USB device
          initialization
    
      - Thu Apr 14 2005 Dave Jones <davej at redhat.com>
    
        - Build DRM modular. (#154769)
    
      - Fri Apr 8 2005 Dave Jones <davej at redhat.com>
    
        - Disable Longhaul driver (again).
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      # https://lists.fedoraproject.org/pipermail/announce/2005-May/000916.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?8ac50a02"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_attribute(attribute:"risk_factor", value:"High");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:kernel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:kernel-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:kernel-doc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:kernel-smp");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora_core:3");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2005/05/23");
      script_set_attribute(attribute:"plugin_publication_date", value:"2005/05/28");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2005-2019 Tenable Network Security, Inc.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! ereg(pattern:"^3([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 3.x", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    flag = 0;
    if (rpm_check(release:"FC3", reference:"kernel-2.6.11-1.27_FC3")) flag++;
    if (rpm_check(release:"FC3", reference:"kernel-debuginfo-2.6.11-1.27_FC3")) flag++;
    if (rpm_check(release:"FC3", reference:"kernel-doc-2.6.11-1.27_FC3")) flag++;
    if (rpm_check(release:"FC3", reference:"kernel-smp-2.6.11-1.27_FC3")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "kernel / kernel-debuginfo / kernel-doc / kernel-smp");
    }
    
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-131-1.NASL
    descriptionColin Percival discovered an information disclosure in the
    last seen2020-06-01
    modified2020-06-02
    plugin id20522
    published2006-01-15
    reporterUbuntu Security Notice (C) 2005-2019 Canonical, Inc. / NASL script (C) 2006-2016 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/20522
    titleUbuntu 4.10 / 5.04 : linux-source-2.6.8.1, linux-source-2.6.10 vulnerabilities (USN-131-1)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Ubuntu Security Notice USN-131-1. The text 
    # itself is copyright (C) Canonical, Inc. See 
    # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
    # trademark of Canonical, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(20522);
      script_version("1.15");
      script_cvs_date("Date: 2019/08/02 13:33:00");
    
      script_cve_id("CVE-2005-0109", "CVE-2005-1041", "CVE-2005-1263", "CVE-2005-1264", "CVE-2005-1368", "CVE-2005-1369", "CVE-2005-1589");
      script_xref(name:"USN", value:"131-1");
    
      script_name(english:"Ubuntu 4.10 / 5.04 : linux-source-2.6.8.1, linux-source-2.6.10 vulnerabilities (USN-131-1)");
      script_summary(english:"Checks dpkg output for updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Ubuntu host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Colin Percival discovered an information disclosure in the 'Hyper
    Threading Technology' architecture in processors which are capable of
    simultaneous multithreading (in particular Intel Pentium 4, Intel
    Mobile Pentium 4, and Intel Xeon processors). This allows a malicious
    thread to monitor the execution of another thread on the same CPU.
    This could be exploited to steal cryptographic keys, passwords, or
    other arbitrary data from unrelated processes. Since it is not
    possible to provide a safe patch in a short time, HyperThreading has
    been disabled in the updated kernel packages for now. You can manually
    enable HyperThreading again by passing the kernel parameter 'ht=on' at
    boot. (CAN-2005-0109)
    
    A Denial of Service vulnerability was discovered in the
    fib_seq_start() function(). This allowed a local user to crash the
    system by reading /proc/net/route in a certain way. (CAN-2005-1041)
    
    Paul Starzetz found an integer overflow in the ELF binary format
    loader's core dump function. By creating and executing a specially
    crafted ELF executable, a local attacker could exploit this to execute
    arbitrary code with root and kernel privileges. However, it is
    believed that this flaw is not actually exploitable on 2.6.x kernels
    (as shipped by Ubuntu). (CAN-2005-1263)
    
    Alexander Nyberg discovered a flaw in the keyring kernel module. This
    allowed a local attacker to cause a kernel crash on SMP machines by
    calling key_user_lookup() in a particular way. This vulnerability does
    not affect the kernel of Ubuntu 4.10. (CAN-2005-1368)
    
    The it87 and via686a hardware monitoring drivers created a sysfs file
    named 'alarms' with write permissions, but they are not designed to be
    writeable. This allowed a local user to crash the kernel by attempting
    to write to these files. (CAN-2005-1369)
    
    It was discovered that the drivers for raw devices (CAN-2005-1264) and
    pktcdvd devices (CAN-2005-1589) used the wrong function to pass
    arguments to the underlying block device. This made the kernel address
    space accessible to userspace applications. This allowed any local
    user with at least read access to a device in /dev/pktcdvd/* (usually
    members of the 'cdrom' group) or /dev/raw/* (usually only root) to
    execute arbitrary code with kernel privileges. Ubuntu 4.10's kernel is
    not affected by the pktcdvd flaw since it does not yet support packet
    CD writing.
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Ubuntu security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-doc-2.6.10");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-doc-2.6.8.1");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-386");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-686");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-686-smp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-amd64-generic");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-amd64-k8");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-amd64-k8-smp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-amd64-xeon");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6.8.1-5");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6.8.1-5-386");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6.8.1-5-686");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6.8.1-5-686-smp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6.8.1-5-amd64-generic");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6.8.1-5-amd64-k8");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6.8.1-5-amd64-k8-smp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6.8.1-5-amd64-xeon");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-386");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-686");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-686-smp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-amd64-generic");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-amd64-k8");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-amd64-k8-smp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-amd64-xeon");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6.8.1-5-386");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6.8.1-5-686");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6.8.1-5-686-smp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6.8.1-5-amd64-generic");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6.8.1-5-amd64-k8");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6.8.1-5-amd64-k8-smp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6.8.1-5-amd64-xeon");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-patch-debian-2.6.8.1");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-patch-ubuntu-2.6.10");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-source-2.6.10");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-source-2.6.8.1");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-tree-2.6.10");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-tree-2.6.8.1");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:4.10");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:5.04");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2005/05/23");
      script_set_attribute(attribute:"plugin_publication_date", value:"2006/01/15");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"Ubuntu Security Notice (C) 2005-2019 Canonical, Inc. / NASL script (C) 2006-2016 Tenable Network Security, Inc.");
      script_family(english:"Ubuntu Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("ubuntu.inc");
    include("misc_func.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/Ubuntu/release");
    if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
    release = chomp(release);
    if (! ereg(pattern:"^(4\.10|5\.04)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 4.10 / 5.04", "Ubuntu " + release);
    if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);
    
    flag = 0;
    
    if (ubuntu_check(osver:"4.10", pkgname:"linux-doc-2.6.8.1", pkgver:"2.6.8.1-16.18")) flag++;
    if (ubuntu_check(osver:"4.10", pkgname:"linux-headers-2.6.8.1-5", pkgver:"2.6.8.1-16.18")) flag++;
    if (ubuntu_check(osver:"4.10", pkgname:"linux-headers-2.6.8.1-5-386", pkgver:"2.6.8.1-16.18")) flag++;
    if (ubuntu_check(osver:"4.10", pkgname:"linux-headers-2.6.8.1-5-686", pkgver:"2.6.8.1-16.18")) flag++;
    if (ubuntu_check(osver:"4.10", pkgname:"linux-headers-2.6.8.1-5-686-smp", pkgver:"2.6.8.1-16.18")) flag++;
    if (ubuntu_check(osver:"4.10", pkgname:"linux-headers-2.6.8.1-5-amd64-generic", pkgver:"2.6.8.1-16.18")) flag++;
    if (ubuntu_check(osver:"4.10", pkgname:"linux-headers-2.6.8.1-5-amd64-k8", pkgver:"2.6.8.1-16.18")) flag++;
    if (ubuntu_check(osver:"4.10", pkgname:"linux-headers-2.6.8.1-5-amd64-k8-smp", pkgver:"2.6.8.1-16.18")) flag++;
    if (ubuntu_check(osver:"4.10", pkgname:"linux-headers-2.6.8.1-5-amd64-xeon", pkgver:"2.6.8.1-16.18")) flag++;
    if (ubuntu_check(osver:"4.10", pkgname:"linux-image-2.6.8.1-5-386", pkgver:"2.6.8.1-16.18")) flag++;
    if (ubuntu_check(osver:"4.10", pkgname:"linux-image-2.6.8.1-5-686", pkgver:"2.6.8.1-16.18")) flag++;
    if (ubuntu_check(osver:"4.10", pkgname:"linux-image-2.6.8.1-5-686-smp", pkgver:"2.6.8.1-16.18")) flag++;
    if (ubuntu_check(osver:"4.10", pkgname:"linux-image-2.6.8.1-5-amd64-generic", pkgver:"2.6.8.1-16.18")) flag++;
    if (ubuntu_check(osver:"4.10", pkgname:"linux-image-2.6.8.1-5-amd64-k8", pkgver:"2.6.8.1-16.18")) flag++;
    if (ubuntu_check(osver:"4.10", pkgname:"linux-image-2.6.8.1-5-amd64-k8-smp", pkgver:"2.6.8.1-16.18")) flag++;
    if (ubuntu_check(osver:"4.10", pkgname:"linux-image-2.6.8.1-5-amd64-xeon", pkgver:"2.6.8.1-16.18")) flag++;
    if (ubuntu_check(osver:"4.10", pkgname:"linux-patch-debian-2.6.8.1", pkgver:"2.6.8.1-16.18")) flag++;
    if (ubuntu_check(osver:"4.10", pkgname:"linux-source-2.6.8.1", pkgver:"2.6.8.1-16.18")) flag++;
    if (ubuntu_check(osver:"4.10", pkgname:"linux-tree-2.6.8.1", pkgver:"2.6.8.1-16.18")) flag++;
    if (ubuntu_check(osver:"5.04", pkgname:"linux-doc-2.6.10", pkgver:"2.6.10-34.1")) flag++;
    if (ubuntu_check(osver:"5.04", pkgname:"linux-headers-2.6.10-5", pkgver:"2.6.10-34.1")) flag++;
    if (ubuntu_check(osver:"5.04", pkgname:"linux-headers-2.6.10-5-386", pkgver:"2.6.10-34.1")) flag++;
    if (ubuntu_check(osver:"5.04", pkgname:"linux-headers-2.6.10-5-686", pkgver:"2.6.10-34.1")) flag++;
    if (ubuntu_check(osver:"5.04", pkgname:"linux-headers-2.6.10-5-686-smp", pkgver:"2.6.10-34.1")) flag++;
    if (ubuntu_check(osver:"5.04", pkgname:"linux-headers-2.6.10-5-amd64-generic", pkgver:"2.6.10-34.1")) flag++;
    if (ubuntu_check(osver:"5.04", pkgname:"linux-headers-2.6.10-5-amd64-k8", pkgver:"2.6.10-34.1")) flag++;
    if (ubuntu_check(osver:"5.04", pkgname:"linux-headers-2.6.10-5-amd64-k8-smp", pkgver:"2.6.10-34.1")) flag++;
    if (ubuntu_check(osver:"5.04", pkgname:"linux-headers-2.6.10-5-amd64-xeon", pkgver:"2.6.10-34.1")) flag++;
    if (ubuntu_check(osver:"5.04", pkgname:"linux-image-2.6.10-5-386", pkgver:"2.6.10-34.1")) flag++;
    if (ubuntu_check(osver:"5.04", pkgname:"linux-image-2.6.10-5-686", pkgver:"2.6.10-34.1")) flag++;
    if (ubuntu_check(osver:"5.04", pkgname:"linux-image-2.6.10-5-686-smp", pkgver:"2.6.10-34.1")) flag++;
    if (ubuntu_check(osver:"5.04", pkgname:"linux-image-2.6.10-5-amd64-generic", pkgver:"2.6.10-34.1")) flag++;
    if (ubuntu_check(osver:"5.04", pkgname:"linux-image-2.6.10-5-amd64-k8", pkgver:"2.6.10-34.1")) flag++;
    if (ubuntu_check(osver:"5.04", pkgname:"linux-image-2.6.10-5-amd64-k8-smp", pkgver:"2.6.10-34.1")) flag++;
    if (ubuntu_check(osver:"5.04", pkgname:"linux-image-2.6.10-5-amd64-xeon", pkgver:"2.6.10-34.1")) flag++;
    if (ubuntu_check(osver:"5.04", pkgname:"linux-patch-ubuntu-2.6.10", pkgver:"2.6.10-34.1")) flag++;
    if (ubuntu_check(osver:"5.04", pkgname:"linux-source-2.6.10", pkgver:"2.6.10-34.1")) flag++;
    if (ubuntu_check(osver:"5.04", pkgname:"linux-tree-2.6.10", pkgver:"2.6.10-34.1")) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : ubuntu_report_get()
      );
      exit(0);
    }
    else
    {
      tested = ubuntu_pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "linux-doc-2.6.10 / linux-doc-2.6.8.1 / linux-headers-2.6 / etc");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SA_2005_029.NASL
    descriptionThe remote host is missing the patch for the advisory SUSE-SA:2005:029 (kernel). The Linux kernel is the core component of the Linux system. This update fixes various security as well as non-security problems discovered since the last round of kernel updates. The following security problems have been fixed: - when creating directories on ext2 filesystems the kernel did not zero initialize the memory allocated. Therefore potentially sensitive information could be exposed to users (CVE-2005-0400). All SUSE LINUX based products are affected. - local users can crash the kernel via a crafted ELF library or executable, which causes a free of an invalid pointer (CVE-2005-0749). All SUSE LINUX based products are affected. - local users could gain root access via a bluetooth socket (CVE-2005-0750). The fix for this problem was missing in SUSE LINUX 9.3 only. - local users could gain root access by causing a core dump of specially crafted ELF executables (CVE-2005-1263). The problem is believed to be not exploitable on any SUSE LINUX based product. The patch is included nevertheless. - on the x86-64 platform various bugs allowed local users to crash the kernel or CPU (CVE-2005-0756, CVE-2005-1762, CVE-2005-1764, CVE-2005-1765) All SUSE LINUX based products on the x86-64 architecture are affected. - an overflow in the x86-64 ptrace code allowed local users to write a few bytes into kernel memory pages they normally shouldn
    last seen2019-10-28
    modified2005-06-10
    plugin id18462
    published2005-06-10
    reporterThis script is Copyright (C) 2005-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/18462
    titleSUSE-SA:2005:029: kernel
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # This plugin text was extracted from SuSE Security Advisory SUSE-SA:2005:029
    #
    
    
    if ( ! defined_func("bn_random") ) exit(0);
    
    include("compat.inc");
    
    if(description)
    {
     script_id(18462);
     script_version ("1.8");
     
     name["english"] = "SUSE-SA:2005:029: kernel";
     
     script_name(english:name["english"]);
     
     script_set_attribute(attribute:"synopsis", value:
    "The remote host is missing a vendor-supplied security patch" );
     script_set_attribute(attribute:"description", value:
    "The remote host is missing the patch for the advisory SUSE-SA:2005:029 (kernel).
    
    
    The Linux kernel is the core component of the Linux system.
    
    This update fixes various security as well as non-security problems
    discovered since the last round of kernel updates.
    
    
    The following security problems have been fixed:
    
    - when creating directories on ext2 filesystems the kernel did not
    zero initialize the memory allocated. Therefore potentially
    sensitive information could be exposed to users (CVE-2005-0400).
    
    All SUSE LINUX based products are affected.
    
    - local users can crash the kernel via a crafted ELF library or
    executable, which causes a free of an invalid pointer
    (CVE-2005-0749).
    
    All SUSE LINUX based products are affected.
    
    - local users could gain root access via a bluetooth socket
    (CVE-2005-0750).
    
    The fix for this problem was missing in SUSE LINUX 9.3 only.
    
    - local users could gain root access by causing a core dump of
    specially crafted ELF executables (CVE-2005-1263).
    
    The problem is believed to be not exploitable on any SUSE LINUX
    based product. The patch is included nevertheless.
    
    - on the x86-64 platform various bugs allowed local users to crash
    the kernel or CPU (CVE-2005-0756, CVE-2005-1762, CVE-2005-1764,
    CVE-2005-1765)
    
    All SUSE LINUX based products on the x86-64 architecture are
    affected.
    
    - an overflow in the x86-64 ptrace code allowed local users to
    write a few bytes into kernel memory pages they normally
    shouldn't have access to (CVE-2005-1763).
    
    SLES 9 and SUSE LINUX 9.1-9.3 on the x86-64 architecture are
    affected.
    
    - insufficient checks in the 32bit DRM ioctl functions could allow
    unprivileged local users to gain root access.
    
    SLES 9 and SUSE LINUX 9.1-9.3 on the x86-64 architecture are
    affected." );
     script_set_attribute(attribute:"solution", value:
    "http://www.suse.de/security/advisories/2005_29_kernel.html" );
     script_set_attribute(attribute:"risk_factor", value:"High" );
    
    
    
     script_set_attribute(attribute:"plugin_publication_date", value: "2005/06/10");
     script_end_attributes();
    
     
     summary["english"] = "Check for the version of the kernel package";
     script_summary(english:summary["english"]);
     
     script_category(ACT_GATHER_INFO);
     
     script_copyright(english:"This script is Copyright (C) 2005-2019 Tenable Network Security, Inc.");
     family["english"] = "SuSE Local Security Checks";
     script_family(english:family["english"]);
     
     script_dependencies("ssh_get_info.nasl");
     script_require_keys("Host/SuSE/rpm-list");
     exit(0);
    }
    
    include("rpm.inc");
    if ( rpm_check( reference:"k_athlon-2.4.20-136", release:"SUSE8.2") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"k_deflt-2.4.20-136", release:"SUSE8.2") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"k_psmp-2.4.20-136", release:"SUSE8.2") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"k_smp-2.4.20-136", release:"SUSE8.2") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"kernel-source-2.4.20.SuSE-136", release:"SUSE8.2") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"Intel-536ep-4.62-25", release:"SUSE9.0") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"Intel-v92ham-4.53-25", release:"SUSE9.0") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"k_athlon-2.4.21-291", release:"SUSE9.0") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"k_deflt-2.4.21-291", release:"SUSE9.0") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"k_smp-2.4.21-291", release:"SUSE9.0") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"k_smp4G-2.4.21-291", release:"SUSE9.0") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"k_um-2.4.21-291", release:"SUSE9.0") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"kernel-source-2.4.21-291", release:"SUSE9.0") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"ltmodem-8.26a-214", release:"SUSE9.0") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"kernel-bigsmp-2.6.5-7.155.29", release:"SUSE9.1") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"kernel-default-2.6.5-7.155.29", release:"SUSE9.1") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"kernel-smp-2.6.5-7.155.29", release:"SUSE9.1") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"kernel-source-2.6.5-7.155.29", release:"SUSE9.1") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"kernel-syms-2.6.5-7.155.29", release:"SUSE9.1") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"ltmodem-2.6.2-38.15", release:"SUSE9.1") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"kernel-docs-2.6.5-7.155.29", release:"SUSE9.1") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"Intel-536ep-4.69-5.9", release:"SUSE9.2") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"kernel-bigsmp-2.6.8-24.16", release:"SUSE9.2") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"kernel-bigsmp-nongpl-2.6.8-24.16", release:"SUSE9.2") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"kernel-default-2.6.8-24.16", release:"SUSE9.2") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"kernel-default-nongpl-2.6.8-24.16", release:"SUSE9.2") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"kernel-smp-2.6.8-24.16", release:"SUSE9.2") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"kernel-smp-nongpl-2.6.8-24.16", release:"SUSE9.2") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"kernel-source-2.6.8-24.16", release:"SUSE9.2") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"kernel-syms-2.6.8-24.16", release:"SUSE9.2") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"kernel-um-2.6.8-24.16", release:"SUSE9.2") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"kernel-um-nongpl-2.6.8-24.16", release:"SUSE9.2") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"ltmodem-8.31a8-6.9", release:"SUSE9.2") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"um-host-install-initrd-1.0-48.8", release:"SUSE9.2") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"um-host-kernel-2.6.8-24.16", release:"SUSE9.2") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"kernel-docs-2.6.8-24.16", release:"SUSE9.2") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"Intel-536ep-4.69-10.1", release:"SUSE9.3") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"dprobes-3.6.5-8.2", release:"SUSE9.3") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"kernel-bigsmp-2.6.11.4-21.7", release:"SUSE9.3") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"kernel-bigsmp-nongpl-2.6.11.4-21.7", release:"SUSE9.3") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"kernel-default-2.6.11.4-21.7", release:"SUSE9.3") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"kernel-default-nongpl-2.6.11.4-21.7", release:"SUSE9.3") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"kernel-smp-2.6.11.4-21.7", release:"SUSE9.3") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"kernel-smp-nongpl-2.6.11.4-21.7", release:"SUSE9.3") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"kernel-source-2.6.11.4-21.7", release:"SUSE9.3") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"kernel-syms-2.6.11.4-21.7", release:"SUSE9.3") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"kernel-um-2.6.11.4-21.7", release:"SUSE9.3") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"kernel-um-nongpl-2.6.11.4-21.7", release:"SUSE9.3") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"kernel-xen-2.6.11.4-21.7", release:"SUSE9.3") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"kernel-xen-nongpl-2.6.11.4-21.7", release:"SUSE9.3") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"ltmodem-8.31a10-7.1", release:"SUSE9.3") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"um-host-install-initrd-1.0-50.1", release:"SUSE9.3") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"um-host-kernel-2.6.11.4-21.7", release:"SUSE9.3") )
    {
     security_hole(0);
     exit(0);
    }
    if ( rpm_check( reference:"kernel-docs-2.6.11.4-21.7", release:"SUSE9.3") )
    {
     security_hole(0);
     exit(0);
    }
    
  • NASL familyMandriva Local Security Checks
    NASL idMANDRAKE_MDKSA-2005-110.NASL
    descriptionMultiple vulnerabilities in the Linux kernel have been discovered and fixed in this update. The following CVE names have been fixed in the LE2005 kernel : Colin Percival discovered a vulnerability in Intel
    last seen2020-06-01
    modified2020-06-02
    plugin id18598
    published2005-07-01
    reporterThis script is Copyright (C) 2005-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/18598
    titleMandrake Linux Security Advisory : kernel (MDKSA-2005:110)
    code
    #%NASL_MIN_LEVEL 80502
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Mandrake Linux Security Advisory MDKSA-2005:110. 
    # The text itself is copyright (C) Mandriva S.A.
    #
    
    if (NASL_LEVEL < 3000) exit(0);
    
    include("compat.inc");
    
    if (description)
    {
      script_id(18598);
      script_version ("1.24");
      script_cvs_date("Date: 2019/08/02 13:32:47");
    
      script_cve_id("CVE-2004-1056", "CVE-2004-1337", "CVE-2005-0109", "CVE-2005-0178", "CVE-2005-0209", "CVE-2005-0384", "CVE-2005-0400", "CVE-2005-0530", "CVE-2005-0531", "CVE-2005-0532", "CVE-2005-0749", "CVE-2005-0750", "CVE-2005-0767", "CVE-2005-0839", "CVE-2005-0937", "CVE-2005-1041", "CVE-2005-1263", "CVE-2005-1264", "CVE-2005-1369", "CVE-2006-3634");
      script_xref(name:"MDKSA", value:"2005:110");
    
      script_name(english:"Mandrake Linux Security Advisory : kernel (MDKSA-2005:110)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Mandrake Linux host is missing one or more security
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Multiple vulnerabilities in the Linux kernel have been discovered and
    fixed in this update. The following CVE names have been fixed in the
    LE2005 kernel :
    
    Colin Percival discovered a vulnerability in Intel's Hyper-Threading
    technology could allow a local user to use a malicious thread to
    create covert channels, monitor the execution of other threads, and
    obtain sensitive information such as cryptographic keys via a timing
    attack on memory cache misses. This has been corrected by disabling HT
    support in all kernels (CVE-2005-0109).
    
    An information leak in the ext2 filesystem code in kernels prior to
    2.6.11.6 was found where when a new directory is created, the ext2
    block written to disk is not initialized (CVE-2005-0400).
    
    A flaw when freeing a pointer in load_elf_library was found in kernels
    prior to 2.6.11.6 that could be abused by a local user to potentially
    crash the machine causing a Denial of Service (CVE-2005-0749).
    
    A problem with the Bluetooth kernel stack in kernels 2.4.6 through
    2.4.30-rc1 and 2.6 through 2.6.11.5 could be used by a local attacker
    to gain root access or crash the machine (CVE-2005-0750).
    
    Paul Starzetz found an integer overflow in the ELF binary format
    loader's code dump function in kernels prior to and including
    2.4.31-pre1 and 2.6.12-rc4. By creating and executing a specially
    crafted ELF executable, a local attacker could exploit this to execute
    arbitrary code with root and kernel privileges (CVE-2005-1263).
    
    The drivers for raw devices used the wrong function to pass arguments
    to the underlying block device in 2.6.x kernels. This made the kernel
    address space accessible to user-space applications allowing any local
    user with at least read access to a device in /dev/raw/* (usually only
    root) to execute arbitrary code with kernel privileges
    (CVE-2005-1264).
    
    The it87 and via686a hardware monitor drivers in kernels prior to
    2.6.11.8 and 2.6.12 prior to 2.6.12-rc2 created a sysfs file named
    'alarms' with write permissions although they are not designed to be
    writable. This allowed a local user to crash the kernel by attempting
    to write to these files (CVE-2005-1369).
    
    In addition to the above-noted CVE-2005-0109, CVE-2005-0400,
    CVE-2005-0749, CVE-2005-0750, and CVE-2005-1369 fixes, the following
    CVE names have been fixed in the 10.1 kernel :
    
    The POSIX Capability Linux Security Module (LSM) for 2.6 kernels up to
    and including 2.6.8.1 did not properly handle the credentials of a
    process that is launched before the module is loaded, which could be
    used by local attackers to gain elevated privileges (CVE-2004-1337).
    
    A flaw in the Linux PPP driver in kernel 2.6.8.1 was found where on
    systems allowing remote users to connect to a server via PPP, a remote
    client could cause a crash, resulting in a Denial of Service
    (CVE-2005-0384).
    
    George Guninski discovered a buffer overflow in the ATM driver in
    kernels 2.6.10 and 2.6.11 before 2.6.11-rc4 where the atm_get_addr()
    function does not validate its arguments sufficiently which could
    allow a local attacker to overwrite large portions of kernel memory by
    supplying a negative length argument. This could potentially lead to
    the execution of arbitrary code (CVE-2005-0531).
    
    The reiserfs_copy_from_user_to_file_region function in reiserfs/file.c
    before kernel 2.6.11, when running on 64-bit architectures, could
    allow local users to trigger a buffer overflow as a result of casting
    discrepancies between size_t and int data types. This could allow an
    attacker to overwrite kernel memory, crash the machine, or potentially
    obtain root access (CVE-2005-0532).
    
    A race condition in the Radeon DRI driver in kernel 2.6.8.1 allows a
    local user with DRI privileges to execute arbitrary code as root
    (CVE-2005-0767).
    
    Access was not restricted to the N_MOUSE discipline for a TTY in
    kernels prior to 2.6.11. This could allow local attackers to obtain
    elevated privileges by injecting mouse or keyboard events into other
    user's sessions (CVE-2005-0839).
    
    Some futex functions in futex.c in 2.6 kernels performed get_user
    calls while holding the mmap_sem semaphore, which could allow a local
    attacker to cause a deadlock condition in do_page_fault by triggering
    get_user faults while another thread is executing mmap or other
    functions (CVE-2005-0937).
    
    In addition to the above-noted CVE-2004-1337, CVE-2005-0109,
    CVE-2005-0384, CVE-2005-0400, CVE-2005-0531, CVE-2005-0532,
    CVE-2005-0749, CVE-2005-0750, CVE-2005-0767, CVE-2005-0839,
    CVE-2005-0937, CVE-2005-1263, CVE-2005-1264, and CVE-2005-1369 fixes,
    the following CVE names have been fixed in the 10.0/ Corporate 3.0
    kernels :
    
    A race condition in the setsid function in kernels before 2.6.8.1
    could allow a local attacker to cause a Denial of Service and possibly
    access portions of kernel memory related to TTY changes, locking, and
    semaphores (CVE-2005-0178).
    
    When forwarding fragmented packets in kernel 2.6.8.1, a hardware
    assisted checksum could only be used once which could lead to a Denial
    of Service attack or crash by remote users (CVE-2005-0209).
    
    A signedness error in the copy_from_read_buf function in n_tty.c
    before kernel 2.6.11 allows local users to read kernel memory via a
    negative argument (CVE-2005-0530).
    
    A vulnerability in the fib_seq_start() function allowed a local user
    to crash the system by readiung /proc/net/route in a certain way,
    causing a Denial of Service (CVE-2005-1041).
    
    A vulnerability in the Direct Rendering Manager (DRM) driver in the
    2.6 kernel does not properly check the DMA lock, which could allow
    remote attackers or local users to cause a Denial of Service (X Server
    crash) and possibly modify the video output (CVE-2004-1056)."
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
      script_cwe_id(20);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:kernel-2.6.11.12mdk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:kernel-2.6.3.27mdk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:kernel-2.6.8.1.25mdk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:kernel-enterprise-2.6.3.27mdk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:kernel-enterprise-2.6.8.1.25mdk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:kernel-i586-up-1GB-2.6.11.12mdk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:kernel-i586-up-1GB-2.6.8.1.25mdk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:kernel-i686-up-4GB-2.6.11.12mdk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:kernel-i686-up-4GB-2.6.3.27mdk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:kernel-i686-up-64GB-2.6.8.1.25mdk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:kernel-p3-smp-64GB-2.6.3.27mdk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:kernel-secure-2.6.3.27mdk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:kernel-secure-2.6.8.1.25mdk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:kernel-smp-2.6.11.12mdk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:kernel-smp-2.6.3.27mdk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:kernel-smp-2.6.8.1.25mdk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:kernel-source");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:kernel-source-2.6");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:kernel-source-stripped");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:kernel-source-stripped-2.6");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:kernel-xbox-2.6.11.12mdk");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:10.0");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:10.1");
      script_set_attribute(attribute:"cpe", value:"x-cpe:/o:mandrakesoft:mandrake_linux:le2005");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2005/06/30");
      script_set_attribute(attribute:"plugin_publication_date", value:"2005/07/01");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2005-2019 Tenable Network Security, Inc.");
      script_family(english:"Mandriva Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Mandrake/release")) audit(AUDIT_OS_NOT, "Mandriva / Mandake Linux");
    if (!get_kb_item("Host/Mandrake/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^(amd64|i[3-6]86|x86_64)$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Mandriva / Mandrake Linux", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"MDK10.0", reference:"kernel-2.6.3.27mdk-1-1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"kernel-enterprise-2.6.3.27mdk-1-1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"kernel-i686-up-4GB-2.6.3.27mdk-1-1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"kernel-p3-smp-64GB-2.6.3.27mdk-1-1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.0", reference:"kernel-secure-2.6.3.27mdk-1-1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.0", reference:"kernel-smp-2.6.3.27mdk-1-1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.0", reference:"kernel-source-2.6.3-27mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.0", reference:"kernel-source-stripped-2.6.3-27mdk", yank:"mdk")) flag++;
    
    if (rpm_check(release:"MDK10.1", reference:"kernel-2.6.8.1.25mdk-1-1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.1", cpu:"i386", reference:"kernel-enterprise-2.6.8.1.25mdk-1-1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.1", cpu:"i386", reference:"kernel-i586-up-1GB-2.6.8.1.25mdk-1-1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.1", cpu:"i386", reference:"kernel-i686-up-64GB-2.6.8.1.25mdk-1-1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.1", reference:"kernel-secure-2.6.8.1.25mdk-1-1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.1", reference:"kernel-smp-2.6.8.1.25mdk-1-1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.1", reference:"kernel-source-2.6-2.6.8.1-25mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.1", reference:"kernel-source-stripped-2.6-2.6.8.1-25mdk", yank:"mdk")) flag++;
    
    if (rpm_check(release:"MDK10.2", reference:"kernel-2.6.11.12mdk-1-1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.2", cpu:"i386", reference:"kernel-i586-up-1GB-2.6.11.12mdk-1-1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.2", cpu:"i386", reference:"kernel-i686-up-4GB-2.6.11.12mdk-1-1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.2", reference:"kernel-smp-2.6.11.12mdk-1-1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.2", reference:"kernel-source-2.6-2.6.11-12mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.2", reference:"kernel-source-stripped-2.6-2.6.11-12mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.2", cpu:"i386", reference:"kernel-xbox-2.6.11.12mdk-1-1mdk", yank:"mdk")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    

Oval

  • accepted2013-04-29T04:09:54.297-04:00
    classvulnerability
    contributors
    • nameAharon Chernin
      organizationSCAP.com, LLC
    • nameDragos Prisaca
      organizationG2, Inc.
    definition_extensions
    • commentThe operating system installed on the system is Red Hat Enterprise Linux 3
      ovaloval:org.mitre.oval:def:11782
    • commentCentOS Linux 3.x
      ovaloval:org.mitre.oval:def:16651
    descriptionThe elf_core_dump function in binfmt_elf.c for Linux kernel 2.x.x to 2.2.27-rc2, 2.4.x to 2.4.31-pre1, and 2.6.x to 2.6.12-rc4 allows local users to execute arbitrary code via an ELF binary that, in certain conditions involving the create_elf_tables function, causes a negative length argument to pass a signed integer comparison, leading to a buffer overflow.
    familyunix
    idoval:org.mitre.oval:def:10909
    statusaccepted
    submitted2010-07-09T03:56:16-04:00
    titleThe elf_core_dump function in binfmt_elf.c for Linux kernel 2.x.x to 2.2.27-rc2, 2.4.x to 2.4.31-pre1, and 2.6.x to 2.6.12-rc4 allows local users to execute arbitrary code via an ELF binary that, in certain conditions involving the create_elf_tables function, causes a negative length argument to pass a signed integer comparison, leading to a buffer overflow.
    version26
  • accepted2005-08-18T07:37:00.000-04:00
    classvulnerability
    contributors
    nameJay Beale
    organizationBastille Linux
    descriptionThe elf_core_dump function in binfmt_elf.c for Linux kernel 2.x.x to 2.2.27-rc2, 2.4.x to 2.4.31-pre1, and 2.6.x to 2.6.12-rc4 allows local users to execute arbitrary code via an ELF binary that, in certain conditions involving the create_elf_tables function, causes a negative length argument to pass a signed integer comparison, leading to a buffer overflow.
    familyunix
    idoval:org.mitre.oval:def:1122
    statusaccepted
    submitted2005-06-29T12:00:00.000-04:00
    titleLinux Kernel elf_core_dump() Buffer Overflow
    version4

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/39133/isec-0023-coredump.txt
idPACKETSTORM:39133
last seen2016-12-05
published2005-08-07
reporterPaul Starzetz
sourcehttps://packetstormsecurity.com/files/39133/isec-0023-coredump.txt.html
titleisec-0023-coredump.txt

Redhat

advisories
  • rhsa
    idRHSA-2005:472
  • rhsa
    idRHSA-2005:529
  • rhsa
    idRHSA-2005:551
rpms
  • kernel-0:2.4.21-32.0.1.EL
  • kernel-BOOT-0:2.4.21-32.0.1.EL
  • kernel-debuginfo-0:2.4.21-32.0.1.EL
  • kernel-doc-0:2.4.21-32.0.1.EL
  • kernel-hugemem-0:2.4.21-32.0.1.EL
  • kernel-hugemem-unsupported-0:2.4.21-32.0.1.EL
  • kernel-smp-0:2.4.21-32.0.1.EL
  • kernel-smp-unsupported-0:2.4.21-32.0.1.EL
  • kernel-source-0:2.4.21-32.0.1.EL
  • kernel-unsupported-0:2.4.21-32.0.1.EL