Oval Definition:oval:org.mitre.oval:def:6841
Revision Date:2014-06-23Version:22
Title:DSA-2003 linux-2.6 -- privilege escalation/denial of service
Description:NOTE: This kernel update marks the final planned kernel security update for the 2.6.18 kernel in the Debian release "etch". Although security support for "etch" officially ended on Feburary 15th, 2010, this update was already in preparation before that date. A final update that includes fixes for these issues in the 2.6.24 kernel is also in preparation and will be released shortly. Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems: Dave Jones reported an issue in the gdth SCSI driver. A missing check for negative offsets in an ioctl call could be exploited by local users to create a denial of service or potentially gain elevated privileges. Trond Myklebust reported an issue where a malicious NFS server could cause a denial of service condition on its clients by returning incorrect attributes during an open call. Roel Kluin discovered an issue in the hfc_usb driver, an ISDN driver for Colognechip HFC-S USB chip. A potential read overflow exists which may allow remote users to cause a denial of service condition. Amerigo Wang discovered an issue in the HFS filesystem that would allow a denial of service by a local user who has sufficient privileges to mount a specially crafted filesystem. Anana V. Avati discovered an issue in the fuse subsystem. If the system is sufficiently low on memory, a local user can cause the kernel to dereference an invalid pointer resulting in a denial of service and potentially an escalation of privileges. Fabian Yamaguchi reported an issue in the e1000 driver for Intel gigabit network adapters which allow remote users to bypass packet filters using specially crafted ethernet frames. Florian Westphal reported a lack of capability checking in the ebtables netfilter subsystem. If the ebtables module is loaded, local users can add and modify ebtables rules. Sebastian Krahmer discovered an issue in the netlink connector subsystem that permits local users to allocate large amounts of system memory resulting in a denial of service. Ramon de Carvalho Valle discovered an issue in the sys_move_pages interface, limited to amd64, ia64 and powerpc64 flavors in Debian. Local users can exploit this issue to cause a denial of service or gain access to sensitive kernel memory. Jermome Marchand reported an issue in the futex subsystem that allows a local user to force an invalid futex state which results in a denial of service. This update also fixes a regression introduced by a previous security update that caused problems booting on certain s390 systems.
Family:unixClass:patch
Status:ACCEPTEDReference(s):CVE-2009-3080
CVE-2009-3726
CVE-2009-4005
CVE-2009-4020
CVE-2009-4021
CVE-2009-4536
CVE-2010-0007
CVE-2010-0410
CVE-2010-0415
CVE-2010-0622
DSA-2003
Platform(s):Debian GNU/Linux 4.0
Product(s):linux-2.6
Definition Synopsis
  • Debian GNU/Linux 4.0 is installed.
  • AND Architecture section
  • Architecture independent section
  • Installed architecture is all
  • AND Packages section
  • linux-support-2.6.18-6 is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-patch-debian-2.6.18 is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-source-2.6.18 is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-manual-2.6.18 is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-tree-2.6.18 is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-doc-2.6.18 is earlier than 2.6.18.dfsg.1-26etch2
  • OR Architecture dependent section
  • Installed architecture is s390
  • AND Packages section
  • linux-headers-2.6.18-6-vserver-s390x is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-headers-2.6.18-6-all is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-image-2.6.18-6-s390-tape is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-image-2.6.18-6-s390x is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-image-2.6.18-6-vserver-s390x is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-image-2.6.18-6-s390 is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-headers-2.6.18-6-vserver is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-headers-2.6.18-6-all-s390 is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-headers-2.6.18-6 is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-headers-2.6.18-6-s390x is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-headers-2.6.18-6-s390 is earlier than 2.6.18.dfsg.1-26etch2
  • OR Architecture dependent section
  • Installed architecture is amd64
  • AND Packages section
  • linux-image-2.6.18-6-xen-amd64 is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-headers-2.6.18-6-all is earlier than 2.6.18.dfsg.1-26etch2
  • OR xen-linux-system-2.6.18-6-xen-amd64 is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-image-2.6.18-6-amd64 is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-modules-2.6.18-6-xen-vserver-amd64 is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-image-2.6.18-6-xen-vserver-amd64 is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-headers-2.6.18-6-xen-amd64 is earlier than 2.6.18.dfsg.1-26etch2
  • OR xen-linux-system-2.6.18-6-xen-vserver-amd64 is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-headers-2.6.18-6-amd64 is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-headers-2.6.18-6-xen is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-headers-2.6.18-6-xen-vserver-amd64 is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-modules-2.6.18-6-xen-amd64 is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-headers-2.6.18-6-vserver-amd64 is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-headers-2.6.18-6-all-amd64 is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-headers-2.6.18-6 is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-headers-2.6.18-6-vserver is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-headers-2.6.18-6-xen-vserver is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-image-2.6.18-6-vserver-amd64 is earlier than 2.6.18.dfsg.1-26etch2
  • OR Supported platform section
  • Installed architecture is hppa
  • AND Packages section
  • linux-headers-2.6.18-6-parisc64 is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-headers-2.6.18-6-all is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-headers-2.6.18-6-parisc is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-image-2.6.18-6-parisc64 is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-headers-2.6.18-6-parisc-smp is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-image-2.6.18-6-parisc64-smp is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-image-2.6.18-6-parisc is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-headers-2.6.18-6 is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-headers-2.6.18-6-parisc64-smp is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-headers-2.6.18-6-all-hppa is earlier than 2.6.18.dfsg.1-26etch2
  • OR linux-image-2.6.18-6-parisc-smp is earlier than 2.6.18.dfsg.1-26etch2
  • BACK