Search...

Linux Kernel SCTP Receiver Application Small Message Saturation DoS

2006-05-06T15:54:55

ID OSVDB:26615
Type osvdb
Reporter OSVDB
Modified 2006-05-06T15:54:55

Description

No description provided by the source

References:

Vendor Specific News/Changelog Entry: http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=7c3ceb4fb9667f34f1599a062efecf4cdc4a4ce5 Vendor Specific Advisory URL Vendor Specific Advisory URL Vendor Specific Advisory URL Secunia Advisory ID:22417 Secunia Advisory ID:21465 Secunia Advisory ID:20716 RedHat RHSA: RHSA-2006:0575 ISS X-Force ID: 26433 CVE-2006-2275 Bugtraq ID: 17955

JSON Vulners Source

Initial Source

{"type": "osvdb", "published": "2006-05-06T15:54:55", "href": "https://vulners.com/osvdb/OSVDB:26615", "bulletinFamily": "software", "cvss": {"vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/", "score": 5.0}, "viewCount": 2, "edition": 1, "reporter": "OSVDB", "title": "Linux Kernel SCTP Receiver Application Small Message Saturation DoS", "affectedSoftware": [], "enchantments": {"score": {"value": 4.9, "vector": "NONE", "modified": "2017-04-28T13:20:23", "rev": 2}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2006-2275"]}, {"type": "nessus", "idList": ["UBUNTU_USN-302-1.NASL", "FEDORA_2006-572.NASL", "CENTOS_RHSA-2006-0575.NASL", "FEDORA_2006-573.NASL", "REDHAT-RHSA-2006-0575.NASL"]}, {"type": "ubuntu", "idList": ["USN-302-1"]}, {"type": "redhat", "idList": ["RHSA-2006:0575"]}, {"type": "centos", "idList": ["CESA-2006:0575"]}], "modified": "2017-04-28T13:20:23", "rev": 2}, "vulnersScore": 4.9}, "references": [], "id": "OSVDB:26615", "lastseen": "2017-04-28T13:20:23", "cvelist": ["CVE-2006-2275"], "modified": "2006-05-06T15:54:55", "description": "# No description provided by the source\n\n## References:\nVendor Specific News/Changelog Entry: http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=7c3ceb4fb9667f34f1599a062efecf4cdc4a4ce5\n[Vendor Specific Advisory URL](http://www.trustix.org/errata/2006/0026)\n[Vendor Specific Advisory URL](http://support.avaya.com/elmodocs2/security/ASA-2006-200.htm)\n[Vendor Specific Advisory URL](http://www.ubuntu.com/usn/usn-302-1)\n[Secunia Advisory ID:22417](https://secuniaresearch.flexerasoftware.com/advisories/22417/)\n[Secunia Advisory ID:21465](https://secuniaresearch.flexerasoftware.com/advisories/21465/)\n[Secunia Advisory ID:20716](https://secuniaresearch.flexerasoftware.com/advisories/20716/)\nRedHat RHSA: RHSA-2006:0575\nISS X-Force ID: 26433\n[CVE-2006-2275](https://vulners.com/cve/CVE-2006-2275)\nBugtraq ID: 17955\n"}

{"cve": [{"lastseen": "2020-10-03T11:48:15", "description": "Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (deadlock) via a large number of small messages to a receiver application that cannot process the messages quickly enough, which leads to \"spillover of the receive buffer.\"", "edition": 3, "cvss3": {}, "published": "2006-05-09T20:02:00", "title": "CVE-2006-2275", "type": "cve", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2006-2275"], "modified": "2017-10-11T01:30:00", "cpe": ["cpe:/a:lksctp:stream_control_transmission_protocol:2.6.16"], "id": "CVE-2006-2275", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-2275", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:a:lksctp:stream_control_transmission_protocol:2.6.16:*:*:*:*:*:*:*"]}], "nessus": [{"lastseen": "2021-01-12T10:05:59", "description": "This update rebases to the latest upstream -stable release\n(2.6.16.17), where a number of security problems have been fixed,\nnotably :\n\nSCTP: Validate the parameter length in HB-ACK chunk (CVE-2006-1857)\nSCTP: Respect the real chunk length when walking parameters\n(CVE-2006-1858) fs/locks.c: Fix lease_init (CVE-2006-1860) SCTP: Fix\nstate table entries for chunks received in CLOSED state.\n(CVE-2006-2271) SCTP: Fix panic's when receiving fragmented SCTP\ncontrol chunks. (CVE-2006-2272) SCTP: Prevent possible infinite\nrecursion with multiple bundled DATA. (CVE-2006-2274) SCTP: Allow\nspillover of receive buffer to avoid deadlock. (CVE-2006-2275)\n\nComplete changelogs for the -stable releases can be found at\n\nhttp://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.17\nhttp://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.16\nhttp://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.15\n\nFedora specific changes are detailed below.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 23, "published": "2007-01-17T00:00:00", "title": "Fedora Core 5 : kernel-2.6.16-1.2122_FC5 (2006-572)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2006-1858", "CVE-2006-2271", "CVE-2006-2275", "CVE-2006-1857", "CVE-2006-1860", "CVE-2006-2272", "CVE-2006-2274"], "modified": "2007-01-17T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:kernel-smp-devel", "p-cpe:/a:fedoraproject:fedora:kernel-smp", "p-cpe:/a:fedoraproject:fedora:kernel", "p-cpe:/a:fedoraproject:fedora:kernel-xen0", "p-cpe:/a:fedoraproject:fedora:kernel-doc", "p-cpe:/a:fedoraproject:fedora:kernel-kdump", "p-cpe:/a:fedoraproject:fedora:kernel-debuginfo", "p-cpe:/a:fedoraproject:fedora:kernel-devel", "cpe:/o:fedoraproject:fedora_core:5", "p-cpe:/a:fedoraproject:fedora:kernel-xen0-devel", "p-cpe:/a:fedoraproject:fedora:kernel-xenU-devel", "p-cpe:/a:fedoraproject:fedora:kernel-kdump-devel", "p-cpe:/a:fedoraproject:fedora:kernel-xenU"], "id": "FEDORA_2006-572.NASL", "href": "https://www.tenable.com/plugins/nessus/24109", "sourceData": "#%NASL_MIN_LEVEL 70300\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2006-572.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(24109);\n script_version(\"1.17\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_xref(name:\"FEDORA\", value:\"2006-572\");\n\n script_name(english:\"Fedora Core 5 : kernel-2.6.16-1.2122_FC5 (2006-572)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora Core host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update rebases to the latest upstream -stable release\n(2.6.16.17), where a number of security problems have been fixed,\nnotably :\n\nSCTP: Validate the parameter length in HB-ACK chunk (CVE-2006-1857)\nSCTP: Respect the real chunk length when walking parameters\n(CVE-2006-1858) fs/locks.c: Fix lease_init (CVE-2006-1860) SCTP: Fix\nstate table entries for chunks received in CLOSED state.\n(CVE-2006-2271) SCTP: Fix panic's when receiving fragmented SCTP\ncontrol chunks. (CVE-2006-2272) SCTP: Prevent possible infinite\nrecursion with multiple bundled DATA. (CVE-2006-2274) SCTP: Allow\nspillover of receive buffer to avoid deadlock. (CVE-2006-2275)\n\nComplete changelogs for the -stable releases can be found at\n\nhttp://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.17\nhttp://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.16\nhttp://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.15\n\nFedora specific changes are detailed below.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.15\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.16\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.17\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2006-May/000104.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?e2f6295f\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_attribute(attribute:\"risk_factor\", value:\"High\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel-kdump\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel-kdump-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel-smp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel-smp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel-xen0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel-xen0-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel-xenU\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel-xenU-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora_core:5\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2006/05/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2007/01/17\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2007-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^5([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 5.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC5\", reference:\"kernel-2.6.16-1.2122_FC5\")) flag++;\nif (rpm_check(release:\"FC5\", reference:\"kernel-debuginfo-2.6.16-1.2122_FC5\")) flag++;\nif (rpm_check(release:\"FC5\", reference:\"kernel-devel-2.6.16-1.2122_FC5\")) flag++;\nif (rpm_check(release:\"FC5\", reference:\"kernel-doc-2.6.16-1.2122_FC5\")) flag++;\nif (rpm_check(release:\"FC5\", reference:\"kernel-kdump-2.6.16-1.2122_FC5\")) flag++;\nif (rpm_check(release:\"FC5\", reference:\"kernel-kdump-devel-2.6.16-1.2122_FC5\")) flag++;\nif (rpm_check(release:\"FC5\", cpu:\"i386\", reference:\"kernel-smp-2.6.16-1.2122_FC5\")) flag++;\nif (rpm_check(release:\"FC5\", cpu:\"i386\", reference:\"kernel-smp-devel-2.6.16-1.2122_FC5\")) flag++;\nif (rpm_check(release:\"FC5\", reference:\"kernel-xen0-2.6.16-1.2122_FC5\")) flag++;\nif (rpm_check(release:\"FC5\", reference:\"kernel-xen0-devel-2.6.16-1.2122_FC5\")) flag++;\nif (rpm_check(release:\"FC5\", reference:\"kernel-xenU-2.6.16-1.2122_FC5\")) flag++;\nif (rpm_check(release:\"FC5\", reference:\"kernel-xenU-devel-2.6.16-1.2122_FC5\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel / kernel-debuginfo / kernel-devel / kernel-doc / etc\");\n}\n", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:C"}}, {"lastseen": "2021-01-12T10:05:59", "description": "This update rebases to the latest upstream -stable release\n(2.6.16.17), where a number of security problems have been fixed,\nnotably :\n\nSCTP: Validate the parameter length in HB-ACK chunk (CVE-2006-1857)\nSCTP: Respect the real chunk length when walking parameters\n(CVE-2006-1858) fs/locks.c: Fix lease_init (CVE-2006-1860) SCTP: Fix\nstate table entries for chunks received in CLOSED state.\n(CVE-2006-2271) SCTP: Fix panic's when receiving fragmented SCTP\ncontrol chunks. (CVE-2006-2272) SCTP: Prevent possible infinite\nrecursion with multiple bundled DATA. (CVE-2006-2274) SCTP: Allow\nspillover of receive buffer to avoid deadlock. (CVE-2006-2275)\n\nComplete changelogs for the -stable releases can be found at\n\nhttp://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.17\nhttp://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.16\nhttp://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.15\n\nFedora specific changes are detailed below\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 23, "published": "2007-01-17T00:00:00", "title": "Fedora Core 4 : kernel-2.6.16-1.2111_FC4 (2006-573)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2006-1858", "CVE-2006-2271", "CVE-2006-2275", "CVE-2006-1857", "CVE-2006-1860", "CVE-2006-2272", "CVE-2006-2274"], "modified": "2007-01-17T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:kernel-smp-devel", "p-cpe:/a:fedoraproject:fedora:kernel-smp", "p-cpe:/a:fedoraproject:fedora:kernel", "p-cpe:/a:fedoraproject:fedora:kernel-doc", "p-cpe:/a:fedoraproject:fedora:kernel-debuginfo", "p-cpe:/a:fedoraproject:fedora:kernel-devel", "cpe:/o:fedoraproject:fedora_core:4"], "id": "FEDORA_2006-573.NASL", "href": "https://www.tenable.com/plugins/nessus/24110", "sourceData": "#%NASL_MIN_LEVEL 70300\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2006-573.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(24110);\n script_version(\"1.17\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_xref(name:\"FEDORA\", value:\"2006-573\");\n\n script_name(english:\"Fedora Core 4 : kernel-2.6.16-1.2111_FC4 (2006-573)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora Core host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update rebases to the latest upstream -stable release\n(2.6.16.17), where a number of security problems have been fixed,\nnotably :\n\nSCTP: Validate the parameter length in HB-ACK chunk (CVE-2006-1857)\nSCTP: Respect the real chunk length when walking parameters\n(CVE-2006-1858) fs/locks.c: Fix lease_init (CVE-2006-1860) SCTP: Fix\nstate table entries for chunks received in CLOSED state.\n(CVE-2006-2271) SCTP: Fix panic's when receiving fragmented SCTP\ncontrol chunks. (CVE-2006-2272) SCTP: Prevent possible infinite\nrecursion with multiple bundled DATA. (CVE-2006-2274) SCTP: Allow\nspillover of receive buffer to avoid deadlock. (CVE-2006-2275)\n\nComplete changelogs for the -stable releases can be found at\n\nhttp://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.17\nhttp://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.16\nhttp://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.15\n\nFedora specific changes are detailed below\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.15\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.16\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.17\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2006-May/000105.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?46da8840\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_attribute(attribute:\"risk_factor\", value:\"High\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel-smp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel-smp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora_core:4\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2006/05/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2007/01/17\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2007-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^4([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 4.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC4\", reference:\"kernel-2.6.16-1.2111_FC4\")) flag++;\nif (rpm_check(release:\"FC4\", reference:\"kernel-debuginfo-2.6.16-1.2111_FC4\")) flag++;\nif (rpm_check(release:\"FC4\", reference:\"kernel-devel-2.6.16-1.2111_FC4\")) flag++;\nif (rpm_check(release:\"FC4\", reference:\"kernel-doc-2.6.16-1.2111_FC4\")) flag++;\nif (rpm_check(release:\"FC4\", reference:\"kernel-smp-2.6.16-1.2111_FC4\")) flag++;\nif (rpm_check(release:\"FC4\", reference:\"kernel-smp-devel-2.6.16-1.2111_FC4\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel / kernel-debuginfo / kernel-devel / kernel-doc / kernel-smp / etc\");\n}\n", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:C"}}, {"lastseen": "2021-01-06T09:25:00", "description": "Updated kernel packages are now available as part of ongoing support\nand maintenance of Red Hat Enterprise Linux version 4.\n\nThis update has been rated as having important security impact by the\nRed Hat Security Response Team.\n\nThe Linux kernel handles the basic functions of the operating system.\n\nThis is the fourth regular update to Red Hat Enterprise Linux 4.\n\nNew features introduced in this update include :\n\n* Device Mapper mirroring support\n\n* IDE diskdump support\n\n* x86, AMD64 and Intel EM64T: Multi-core scheduler support\nenhancements\n\n* Itanium: perfmon support for Montecito\n\n* much improved support for IBM x460\n\n* AMD PowerNow! patches to support Opteron Rev G\n\n* Vmalloc support > 64MB\n\nThe following device drivers have been upgraded to new versions :\n\nipmi: 33.11 to 33.13 ib_mthca: 0.06 to 0.08 bnx2: 1.4.30 to 1.4.38\nbonding: 2.6.1 to 2.6.3 e100: 3.4.8-k2-NAPI to 3.5.10-k2-NAPI e1000:\n6.1.16-k3-NAPI to 7.0.33-k2-NAPI sky2: 0.13 to 1.1 tg3: 3.43-rh to\n3.52-rh ipw2100: 1.1.0 to git-1.1.4 ipw2200: 1.0.0 to git-1.0.10\n3w-9xxx: 2.26.02.001 to 2.26.04.010 ips: 7.10.18 to 7.12.02\niscsi_sfnet: 4:0.1.11-2 to 4:0.1.11-3 lpfc: 0:8.0.16.18 to 0:8.0.16.27\nmegaraid_sas: 00.00.02.00 to 00.00.02.03-RH1 qla2xxx: 8.01.02-d4 to\n8.01.04-d7 qla6312: 8.01.02-d4 to 8.01.04-d7 sata_promise: 1.03 to\n1.04 sata_vsc: 1.1 to 1.2 ibmvscsic: 1.5.5 to 1.5.6 ipr: 2.0.11.1 to\n2.0.11.2\n\nAdded drivers :\n\ndcdbas: 5.6.0-2 sata_mv: 0.6 sata_qstor: 0.05 sata_uli: 0.5 skge: 1.1\nstex: 2.9.0.13 pdc_adma: 0.03\n\nThis update includes fixes for the security issues :\n\n* a flaw in the USB devio handling of device removal that allowed a\nlocal user to cause a denial of service (crash) (CVE-2005-3055,\nmoderate)\n\n* a flaw in the ACL handling of nfsd that allowed a remote user to\nbypass ACLs for readonly mounted NFS file systems (CVE-2005-3623,\nmoderate)\n\n* a flaw in the netfilter handling that allowed a local user with\nCAP_NET_ADMIN rights to cause a buffer overflow (CVE-2006-0038, low)\n\n* a flaw in the IBM S/390 and IBM zSeries strnlen_user() function that\nallowed a local user to cause a denial of service (crash) or to\nretrieve random kernel data (CVE-2006-0456, important)\n\n* a flaw in the keyctl functions that allowed a local user to cause a\ndenial of service (crash) or to read sensitive kernel memory\n(CVE-2006-0457, important)\n\n* a flaw in unaligned accesses handling on Itanium processors that\nallowed a local user to cause a denial of service (crash)\n(CVE-2006-0742, important)\n\n* a flaw in SELinux ptrace logic that allowed a local user with ptrace\npermissions to change the tracer SID to a SID of another process\n(CVE-2006-1052, moderate)\n\n* an info leak on AMD-based x86 and x86_64 systems that allowed a\nlocal user to retrieve the floating point exception state of a process\nrun by a different user (CVE-2006-1056, important)\n\n* a flaw in IPv4 packet output handling that allowed a remote user to\nbypass the zero IP ID countermeasure on systems with a disabled\nfirewall (CVE-2006-1242, low)\n\n* a minor info leak in socket option handling in the network code\n(CVE-2006-1343, low)\n\n* a flaw in the HB-ACK chunk handling of SCTP that allowed a remote\nuser to cause a denial of service (crash) (CVE-2006-1857, moderate)\n\n* a flaw in the SCTP implementation that allowed a remote user to\ncause a denial of service (deadlock) (CVE-2006-2275, moderate)\n\n* a flaw in the socket buffer handling that allowed a remote user to\ncause a denial of service (panic) (CVE-2006-2446, important)\n\n* a flaw in the signal handling access checking on PowerPC that\nallowed a local user to cause a denial of service (crash) or read\narbitrary kernel memory on 64-bit systems (CVE-2006-2448, important)\n\n* a flaw in the netfilter SCTP module when receiving a chunkless\npacket that allowed a remote user to cause a denial of service (crash)\n(CVE-2006-2934, important)\n\nThere were several bug fixes in various parts of the kernel. The\nongoing effort to resolve these problems has resulted in a marked\nimprovement in the reliability and scalability of Red Hat Enterprise\nLinux 4.", "edition": 27, "published": "2006-08-30T00:00:00", "title": "CentOS 4 : kernel (CESA-2006:0575)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2006-1056", "CVE-2006-0742", "CVE-2006-0457", "CVE-2006-2275", "CVE-2006-0038", "CVE-2006-1343", "CVE-2006-1242", "CVE-2006-2446", "CVE-2006-1857", "CVE-2005-3623", "CVE-2006-1052", "CVE-2006-2448", "CVE-2006-0456", "CVE-2005-3055", "CVE-2006-2934"], "modified": "2006-08-30T00:00:00", "cpe": ["p-cpe:/a:centos:centos:kernel-largesmp", "p-cpe:/a:centos:centos:kernel-hugemem", "p-cpe:/a:centos:centos:kernel-doc", "cpe:/o:centos:centos:4", "p-cpe:/a:centos:centos:kernel-smp", "p-cpe:/a:centos:centos:kernel-devel", "p-cpe:/a:centos:centos:kernel", "p-cpe:/a:centos:centos:kernel-smp-devel", "p-cpe:/a:centos:centos:kernel-largesmp-devel", "p-cpe:/a:centos:centos:kernel-hugemem-devel"], "id": "CENTOS_RHSA-2006-0575.NASL", "href": "https://www.tenable.com/plugins/nessus/22276", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2006:0575 and \n# CentOS Errata and Security Advisory 2006:0575 respectively.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(22276);\n script_version(\"1.20\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2005-3055\", \"CVE-2005-3623\", \"CVE-2006-0038\", \"CVE-2006-0456\", \"CVE-2006-0457\", \"CVE-2006-0742\", \"CVE-2006-1052\", \"CVE-2006-1056\", \"CVE-2006-1242\", \"CVE-2006-1343\", \"CVE-2006-1857\", \"CVE-2006-2275\", \"CVE-2006-2446\", \"CVE-2006-2448\", \"CVE-2006-2934\");\n script_bugtraq_id(16570, 17600);\n script_xref(name:\"RHSA\", value:\"2006:0575\");\n\n script_name(english:\"CentOS 4 : kernel (CESA-2006:0575)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote CentOS host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated kernel packages are now available as part of ongoing support\nand maintenance of Red Hat Enterprise Linux version 4.\n\nThis update has been rated as having important security impact by the\nRed Hat Security Response Team.\n\nThe Linux kernel handles the basic functions of the operating system.\n\nThis is the fourth regular update to Red Hat Enterprise Linux 4.\n\nNew features introduced in this update include :\n\n* Device Mapper mirroring support\n\n* IDE diskdump support\n\n* x86, AMD64 and Intel EM64T: Multi-core scheduler support\nenhancements\n\n* Itanium: perfmon support for Montecito\n\n* much improved support for IBM x460\n\n* AMD PowerNow! patches to support Opteron Rev G\n\n* Vmalloc support > 64MB\n\nThe following device drivers have been upgraded to new versions :\n\nipmi: 33.11 to 33.13 ib_mthca: 0.06 to 0.08 bnx2: 1.4.30 to 1.4.38\nbonding: 2.6.1 to 2.6.3 e100: 3.4.8-k2-NAPI to 3.5.10-k2-NAPI e1000:\n6.1.16-k3-NAPI to 7.0.33-k2-NAPI sky2: 0.13 to 1.1 tg3: 3.43-rh to\n3.52-rh ipw2100: 1.1.0 to git-1.1.4 ipw2200: 1.0.0 to git-1.0.10\n3w-9xxx: 2.26.02.001 to 2.26.04.010 ips: 7.10.18 to 7.12.02\niscsi_sfnet: 4:0.1.11-2 to 4:0.1.11-3 lpfc: 0:8.0.16.18 to 0:8.0.16.27\nmegaraid_sas: 00.00.02.00 to 00.00.02.03-RH1 qla2xxx: 8.01.02-d4 to\n8.01.04-d7 qla6312: 8.01.02-d4 to 8.01.04-d7 sata_promise: 1.03 to\n1.04 sata_vsc: 1.1 to 1.2 ibmvscsic: 1.5.5 to 1.5.6 ipr: 2.0.11.1 to\n2.0.11.2\n\nAdded drivers :\n\ndcdbas: 5.6.0-2 sata_mv: 0.6 sata_qstor: 0.05 sata_uli: 0.5 skge: 1.1\nstex: 2.9.0.13 pdc_adma: 0.03\n\nThis update includes fixes for the security issues :\n\n* a flaw in the USB devio handling of device removal that allowed a\nlocal user to cause a denial of service (crash) (CVE-2005-3055,\nmoderate)\n\n* a flaw in the ACL handling of nfsd that allowed a remote user to\nbypass ACLs for readonly mounted NFS file systems (CVE-2005-3623,\nmoderate)\n\n* a flaw in the netfilter handling that allowed a local user with\nCAP_NET_ADMIN rights to cause a buffer overflow (CVE-2006-0038, low)\n\n* a flaw in the IBM S/390 and IBM zSeries strnlen_user() function that\nallowed a local user to cause a denial of service (crash) or to\nretrieve random kernel data (CVE-2006-0456, important)\n\n* a flaw in the keyctl functions that allowed a local user to cause a\ndenial of service (crash) or to read sensitive kernel memory\n(CVE-2006-0457, important)\n\n* a flaw in unaligned accesses handling on Itanium processors that\nallowed a local user to cause a denial of service (crash)\n(CVE-2006-0742, important)\n\n* a flaw in SELinux ptrace logic that allowed a local user with ptrace\npermissions to change the tracer SID to a SID of another process\n(CVE-2006-1052, moderate)\n\n* an info leak on AMD-based x86 and x86_64 systems that allowed a\nlocal user to retrieve the floating point exception state of a process\nrun by a different user (CVE-2006-1056, important)\n\n* a flaw in IPv4 packet output handling that allowed a remote user to\nbypass the zero IP ID countermeasure on systems with a disabled\nfirewall (CVE-2006-1242, low)\n\n* a minor info leak in socket option handling in the network code\n(CVE-2006-1343, low)\n\n* a flaw in the HB-ACK chunk handling of SCTP that allowed a remote\nuser to cause a denial of service (crash) (CVE-2006-1857, moderate)\n\n* a flaw in the SCTP implementation that allowed a remote user to\ncause a denial of service (deadlock) (CVE-2006-2275, moderate)\n\n* a flaw in the socket buffer handling that allowed a remote user to\ncause a denial of service (panic) (CVE-2006-2446, important)\n\n* a flaw in the signal handling access checking on PowerPC that\nallowed a local user to cause a denial of service (crash) or read\narbitrary kernel memory on 64-bit systems (CVE-2006-2448, important)\n\n* a flaw in the netfilter SCTP module when receiving a chunkless\npacket that allowed a remote user to cause a denial of service (crash)\n(CVE-2006-2934, important)\n\nThere were several bug fixes in various parts of the kernel. The\nongoing effort to resolve these problems has resulted in a marked\nimprovement in the reliability and scalability of Red Hat Enterprise\nLinux 4.\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2006-August/013147.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?bf7d9ad3\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2006-August/013148.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?a853ded4\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected kernel packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(119, 189);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:kernel-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:kernel-hugemem\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:kernel-hugemem-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:kernel-largesmp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:kernel-largesmp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:kernel-smp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:kernel-smp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:4\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2005/09/26\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2006/08/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2006/08/30\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2006-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"CentOS Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/CentOS/release\", \"Host/CentOS/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/CentOS/release\");\nif (isnull(release) || \"CentOS\" >!< release) audit(AUDIT_OS_NOT, \"CentOS\");\nos_ver = pregmatch(pattern: \"CentOS(?: Linux)? release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"CentOS\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^4([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"CentOS 4.x\", \"CentOS \" + os_ver);\n\nif (!get_kb_item(\"Host/CentOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && \"ia64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"CentOS\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"CentOS-4\", cpu:\"i386\", reference:\"kernel-2.6.9-42.EL\")) flag++;\nif (rpm_check(release:\"CentOS-4\", cpu:\"x86_64\", reference:\"kernel-2.6.9-42.EL\")) flag++;\nif (rpm_check(release:\"CentOS-4\", cpu:\"i386\", reference:\"kernel-devel-2.6.9-42.EL\")) flag++;\nif (rpm_check(release:\"CentOS-4\", cpu:\"x86_64\", reference:\"kernel-devel-2.6.9-42.EL\")) flag++;\nif (rpm_check(release:\"CentOS-4\", cpu:\"i386\", reference:\"kernel-doc-2.6.9-42.EL\")) flag++;\nif (rpm_check(release:\"CentOS-4\", cpu:\"x86_64\", reference:\"kernel-doc-2.6.9-42.EL\")) flag++;\nif (rpm_check(release:\"CentOS-4\", cpu:\"i386\", reference:\"kernel-hugemem-2.6.9-42.EL\")) flag++;\nif (rpm_check(release:\"CentOS-4\", cpu:\"i386\", reference:\"kernel-hugemem-devel-2.6.9-42.EL\")) flag++;\nif (rpm_check(release:\"CentOS-4\", cpu:\"x86_64\", reference:\"kernel-largesmp-2.6.9-42.EL\")) flag++;\nif (rpm_check(release:\"CentOS-4\", cpu:\"x86_64\", reference:\"kernel-largesmp-devel-2.6.9-42.EL\")) flag++;\nif (rpm_check(release:\"CentOS-4\", cpu:\"i386\", reference:\"kernel-smp-2.6.9-42.EL\")) flag++;\nif (rpm_check(release:\"CentOS-4\", cpu:\"x86_64\", reference:\"kernel-smp-2.6.9-42.EL\")) flag++;\nif (rpm_check(release:\"CentOS-4\", cpu:\"i386\", reference:\"kernel-smp-devel-2.6.9-42.EL\")) flag++;\nif (rpm_check(release:\"CentOS-4\", cpu:\"x86_64\", reference:\"kernel-smp-devel-2.6.9-42.EL\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel / kernel-devel / kernel-doc / kernel-hugemem / etc\");\n}\n", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:C"}}, {"lastseen": "2021-01-17T13:05:38", "description": "Updated kernel packages are now available as part of ongoing support\nand maintenance of Red Hat Enterprise Linux version 4.\n\nThis update has been rated as having important security impact by the\nRed Hat Security Response Team.\n\nThe Linux kernel handles the basic functions of the operating system.\n\nThis is the fourth regular update to Red Hat Enterprise Linux 4.\n\nNew features introduced in this update include :\n\n* Device Mapper mirroring support\n\n* IDE diskdump support\n\n* x86, AMD64 and Intel EM64T: Multi-core scheduler support\nenhancements\n\n* Itanium: perfmon support for Montecito\n\n* much improved support for IBM x460\n\n* AMD PowerNow! patches to support Opteron Rev G\n\n* Vmalloc support > 64MB\n\nThe following device drivers have been upgraded to new versions :\n\nipmi: 33.11 to 33.13 ib_mthca: 0.06 to 0.08 bnx2: 1.4.30 to 1.4.38\nbonding: 2.6.1 to 2.6.3 e100: 3.4.8-k2-NAPI to 3.5.10-k2-NAPI e1000:\n6.1.16-k3-NAPI to 7.0.33-k2-NAPI sky2: 0.13 to 1.1 tg3: 3.43-rh to\n3.52-rh ipw2100: 1.1.0 to git-1.1.4 ipw2200: 1.0.0 to git-1.0.10\n3w-9xxx: 2.26.02.001 to 2.26.04.010 ips: 7.10.18 to 7.12.02\niscsi_sfnet: 4:0.1.11-2 to 4:0.1.11-3 lpfc: 0:8.0.16.18 to 0:8.0.16.27\nmegaraid_sas: 00.00.02.00 to 00.00.02.03-RH1 qla2xxx: 8.01.02-d4 to\n8.01.04-d7 qla6312: 8.01.02-d4 to 8.01.04-d7 sata_promise: 1.03 to\n1.04 sata_vsc: 1.1 to 1.2 ibmvscsic: 1.5.5 to 1.5.6 ipr: 2.0.11.1 to\n2.0.11.2\n\nAdded drivers :\n\ndcdbas: 5.6.0-2 sata_mv: 0.6 sata_qstor: 0.05 sata_uli: 0.5 skge: 1.1\nstex: 2.9.0.13 pdc_adma: 0.03\n\nThis update includes fixes for the security issues :\n\n* a flaw in the USB devio handling of device removal that allowed a\nlocal user to cause a denial of service (crash) (CVE-2005-3055,\nmoderate)\n\n* a flaw in the ACL handling of nfsd that allowed a remote user to\nbypass ACLs for readonly mounted NFS file systems (CVE-2005-3623,\nmoderate)\n\n* a flaw in the netfilter handling that allowed a local user with\nCAP_NET_ADMIN rights to cause a buffer overflow (CVE-2006-0038, low)\n\n* a flaw in the IBM S/390 and IBM zSeries strnlen_user() function that\nallowed a local user to cause a denial of service (crash) or to\nretrieve random kernel data (CVE-2006-0456, important)\n\n* a flaw in the keyctl functions that allowed a local user to cause a\ndenial of service (crash) or to read sensitive kernel memory\n(CVE-2006-0457, important)\n\n* a flaw in unaligned accesses handling on Itanium processors that\nallowed a local user to cause a denial of service (crash)\n(CVE-2006-0742, important)\n\n* a flaw in SELinux ptrace logic that allowed a local user with ptrace\npermissions to change the tracer SID to a SID of another process\n(CVE-2006-1052, moderate)\n\n* an info leak on AMD-based x86 and x86_64 systems that allowed a\nlocal user to retrieve the floating point exception state of a process\nrun by a different user (CVE-2006-1056, important)\n\n* a flaw in IPv4 packet output handling that allowed a remote user to\nbypass the zero IP ID countermeasure on systems with a disabled\nfirewall (CVE-2006-1242, low)\n\n* a minor info leak in socket option handling in the network code\n(CVE-2006-1343, low)\n\n* a flaw in the HB-ACK chunk handling of SCTP that allowed a remote\nuser to cause a denial of service (crash) (CVE-2006-1857, moderate)\n\n* a flaw in the SCTP implementation that allowed a remote user to\ncause a denial of service (deadlock) (CVE-2006-2275, moderate)\n\n* a flaw in the socket buffer handling that allowed a remote user to\ncause a denial of service (panic) (CVE-2006-2446, important)\n\n* a flaw in the signal handling access checking on PowerPC that\nallowed a local user to cause a denial of service (crash) or read\narbitrary kernel memory on 64-bit systems (CVE-2006-2448, important)\n\n* a flaw in the netfilter SCTP module when receiving a chunkless\npacket that allowed a remote user to cause a denial of service (crash)\n(CVE-2006-2934, important)\n\nThere were several bug fixes in various parts of the kernel. The\nongoing effort to resolve these problems has resulted in a marked\nimprovement in the reliability and scalability of Red Hat Enterprise\nLinux 4.", "edition": 27, "published": "2006-08-14T00:00:00", "title": "RHEL 4 : kernel (RHSA-2006:0575)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2006-1056", "CVE-2006-0742", "CVE-2006-0457", "CVE-2006-2275", "CVE-2006-0038", "CVE-2006-1343", "CVE-2006-1242", "CVE-2006-2446", "CVE-2006-1857", "CVE-2005-3623", "CVE-2006-1052", "CVE-2006-2448", "CVE-2006-0456", "CVE-2005-3055", "CVE-2006-2934"], "modified": "2006-08-14T00:00:00", "cpe": ["cpe:/o:redhat:enterprise_linux:4", "p-cpe:/a:redhat:enterprise_linux:kernel-largesmp-devel", "p-cpe:/a:redhat:enterprise_linux:kernel-smp-devel", "p-cpe:/a:redhat:enterprise_linux:kernel-devel", "p-cpe:/a:redhat:enterprise_linux:kernel-hugemem-devel", "p-cpe:/a:redhat:enterprise_linux:kernel-smp", "p-cpe:/a:redhat:enterprise_linux:kernel", "p-cpe:/a:redhat:enterprise_linux:kernel-hugemem", "p-cpe:/a:redhat:enterprise_linux:kernel-doc", "p-cpe:/a:redhat:enterprise_linux:kernel-largesmp"], "id": "REDHAT-RHSA-2006-0575.NASL", "href": "https://www.tenable.com/plugins/nessus/22221", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2006:0575. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(22221);\n script_version(\"1.30\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2005-3055\", \"CVE-2005-3623\", \"CVE-2006-0038\", \"CVE-2006-0456\", \"CVE-2006-0457\", \"CVE-2006-0742\", \"CVE-2006-1052\", \"CVE-2006-1056\", \"CVE-2006-1242\", \"CVE-2006-1343\", \"CVE-2006-1857\", \"CVE-2006-2275\", \"CVE-2006-2446\", \"CVE-2006-2448\", \"CVE-2006-2934\");\n script_bugtraq_id(16570, 17600);\n script_xref(name:\"RHSA\", value:\"2006:0575\");\n\n script_name(english:\"RHEL 4 : kernel (RHSA-2006:0575)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated kernel packages are now available as part of ongoing support\nand maintenance of Red Hat Enterprise Linux version 4.\n\nThis update has been rated as having important security impact by the\nRed Hat Security Response Team.\n\nThe Linux kernel handles the basic functions of the operating system.\n\nThis is the fourth regular update to Red Hat Enterprise Linux 4.\n\nNew features introduced in this update include :\n\n* Device Mapper mirroring support\n\n* IDE diskdump support\n\n* x86, AMD64 and Intel EM64T: Multi-core scheduler support\nenhancements\n\n* Itanium: perfmon support for Montecito\n\n* much improved support for IBM x460\n\n* AMD PowerNow! patches to support Opteron Rev G\n\n* Vmalloc support > 64MB\n\nThe following device drivers have been upgraded to new versions :\n\nipmi: 33.11 to 33.13 ib_mthca: 0.06 to 0.08 bnx2: 1.4.30 to 1.4.38\nbonding: 2.6.1 to 2.6.3 e100: 3.4.8-k2-NAPI to 3.5.10-k2-NAPI e1000:\n6.1.16-k3-NAPI to 7.0.33-k2-NAPI sky2: 0.13 to 1.1 tg3: 3.43-rh to\n3.52-rh ipw2100: 1.1.0 to git-1.1.4 ipw2200: 1.0.0 to git-1.0.10\n3w-9xxx: 2.26.02.001 to 2.26.04.010 ips: 7.10.18 to 7.12.02\niscsi_sfnet: 4:0.1.11-2 to 4:0.1.11-3 lpfc: 0:8.0.16.18 to 0:8.0.16.27\nmegaraid_sas: 00.00.02.00 to 00.00.02.03-RH1 qla2xxx: 8.01.02-d4 to\n8.01.04-d7 qla6312: 8.01.02-d4 to 8.01.04-d7 sata_promise: 1.03 to\n1.04 sata_vsc: 1.1 to 1.2 ibmvscsic: 1.5.5 to 1.5.6 ipr: 2.0.11.1 to\n2.0.11.2\n\nAdded drivers :\n\ndcdbas: 5.6.0-2 sata_mv: 0.6 sata_qstor: 0.05 sata_uli: 0.5 skge: 1.1\nstex: 2.9.0.13 pdc_adma: 0.03\n\nThis update includes fixes for the security issues :\n\n* a flaw in the USB devio handling of device removal that allowed a\nlocal user to cause a denial of service (crash) (CVE-2005-3055,\nmoderate)\n\n* a flaw in the ACL handling of nfsd that allowed a remote user to\nbypass ACLs for readonly mounted NFS file systems (CVE-2005-3623,\nmoderate)\n\n* a flaw in the netfilter handling that allowed a local user with\nCAP_NET_ADMIN rights to cause a buffer overflow (CVE-2006-0038, low)\n\n* a flaw in the IBM S/390 and IBM zSeries strnlen_user() function that\nallowed a local user to cause a denial of service (crash) or to\nretrieve random kernel data (CVE-2006-0456, important)\n\n* a flaw in the keyctl functions that allowed a local user to cause a\ndenial of service (crash) or to read sensitive kernel memory\n(CVE-2006-0457, important)\n\n* a flaw in unaligned accesses handling on Itanium processors that\nallowed a local user to cause a denial of service (crash)\n(CVE-2006-0742, important)\n\n* a flaw in SELinux ptrace logic that allowed a local user with ptrace\npermissions to change the tracer SID to a SID of another process\n(CVE-2006-1052, moderate)\n\n* an info leak on AMD-based x86 and x86_64 systems that allowed a\nlocal user to retrieve the floating point exception state of a process\nrun by a different user (CVE-2006-1056, important)\n\n* a flaw in IPv4 packet output handling that allowed a remote user to\nbypass the zero IP ID countermeasure on systems with a disabled\nfirewall (CVE-2006-1242, low)\n\n* a minor info leak in socket option handling in the network code\n(CVE-2006-1343, low)\n\n* a flaw in the HB-ACK chunk handling of SCTP that allowed a remote\nuser to cause a denial of service (crash) (CVE-2006-1857, moderate)\n\n* a flaw in the SCTP implementation that allowed a remote user to\ncause a denial of service (deadlock) (CVE-2006-2275, moderate)\n\n* a flaw in the socket buffer handling that allowed a remote user to\ncause a denial of service (panic) (CVE-2006-2446, important)\n\n* a flaw in the signal handling access checking on PowerPC that\nallowed a local user to cause a denial of service (crash) or read\narbitrary kernel memory on 64-bit systems (CVE-2006-2448, important)\n\n* a flaw in the netfilter SCTP module when receiving a chunkless\npacket that allowed a remote user to cause a denial of service (crash)\n(CVE-2006-2934, important)\n\nThere were several bug fixes in various parts of the kernel. The\nongoing effort to resolve these problems has resulted in a marked\nimprovement in the reliability and scalability of Red Hat Enterprise\nLinux 4.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2005-3055\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2005-3623\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-0038\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-0456\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-0457\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-0742\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-1052\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-1056\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-1242\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-1343\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-1857\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-2275\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-2446\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-2448\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-2934\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2006:0575\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(119, 189);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-hugemem\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-hugemem-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-largesmp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-largesmp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-smp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-smp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:4\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2005/09/26\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2006/08/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2006/08/14\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2006-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\ninclude(\"ksplice.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^4([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 4.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2005-3055\", \"CVE-2005-3623\", \"CVE-2006-0038\", \"CVE-2006-0456\", \"CVE-2006-0457\", \"CVE-2006-0742\", \"CVE-2006-1052\", \"CVE-2006-1056\", \"CVE-2006-1242\", \"CVE-2006-1343\", \"CVE-2006-1857\", \"CVE-2006-2275\", \"CVE-2006-2446\", \"CVE-2006-2448\", \"CVE-2006-2934\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for RHSA-2006:0575\");\n }\n else\n {\n __rpm_report = ksplice_reporting_text();\n }\n}\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2006:0575\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL4\", reference:\"kernel-2.6.9-42.EL\")) flag++;\n if (rpm_check(release:\"RHEL4\", reference:\"kernel-devel-2.6.9-42.EL\")) flag++;\n if (rpm_check(release:\"RHEL4\", reference:\"kernel-doc-2.6.9-42.EL\")) flag++;\n if (rpm_check(release:\"RHEL4\", cpu:\"i686\", reference:\"kernel-hugemem-2.6.9-42.EL\")) flag++;\n if (rpm_check(release:\"RHEL4\", cpu:\"i686\", reference:\"kernel-hugemem-devel-2.6.9-42.EL\")) flag++;\n if (rpm_check(release:\"RHEL4\", cpu:\"x86_64\", reference:\"kernel-largesmp-2.6.9-42.EL\")) flag++;\n if (rpm_check(release:\"RHEL4\", cpu:\"x86_64\", reference:\"kernel-largesmp-devel-2.6.9-42.EL\")) flag++;\n if (rpm_check(release:\"RHEL4\", cpu:\"i686\", reference:\"kernel-smp-2.6.9-42.EL\")) flag++;\n if (rpm_check(release:\"RHEL4\", cpu:\"x86_64\", reference:\"kernel-smp-2.6.9-42.EL\")) flag++;\n if (rpm_check(release:\"RHEL4\", cpu:\"i686\", reference:\"kernel-smp-devel-2.6.9-42.EL\")) flag++;\n if (rpm_check(release:\"RHEL4\", cpu:\"x86_64\", reference:\"kernel-smp-devel-2.6.9-42.EL\")) flag++;\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel / kernel-devel / kernel-doc / kernel-hugemem / etc\");\n }\n}\n", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:C"}}, {"lastseen": "2021-01-20T15:29:55", "description": "An integer overflow was discovered in the do_replace() function. A\nlocal user process with the CAP_NET_ADMIN capability could exploit\nthis to execute arbitrary commands with full root privileges. However,\nnone of Ubuntu's supported packages use this capability with any\nnon-root user, so this only affects you if you use some third party\nsoftware like the OpenVZ virtualization system. (CVE-2006-0038)\n\nOn EMT64 CPUs, the kernel did not properly handle uncanonical return\naddresses. A local user could exploit this to trigger a kernel crash.\n(CVE-2006-0744)\n\nAl Viro discovered a local Denial of Service in the sysfs write buffer\nhandling. By writing a block with a length exactly equal to the\nprocessor's page size to any writable file in /sys, a local attacker\ncould cause a kernel crash. (CVE-2006-1055)\n\nJan Beulich discovered an information leak in the handling of\nregisters for the numeric coprocessor when running on AMD processors.\nThis allowed processes to see the coprocessor execution state of other\nprocesses, which could reveal sensitive data in the case of\ncryptographic computations. (CVE-2006-1056)\n\nMarcel Holtmann discovered that the sys_add_key() did not check that a\nnew user key is added to a proper keyring. By attempting to add a key\nto a normal user key (which is not a keyring), a local attacker could\nexploit this to crash the kernel. (CVE-2006-1522)\n\nIngo Molnar discovered that the SCTP protocol connection tracking\nmodule in netfilter got stuck in an infinite loop on certain empty\npacket chunks. A remote attacker could exploit this to cause the\ncomputer to hang. (CVE-2006-1527)\n\nThe SCSI I/O driver did not correctly handle the VM_IO flag for memory\nmapped pages used for data transfer. A local user could exploit this\nto cause a kernel crash. (CVE-2006-1528)\n\nThe choose_new_parent() contained obsolete debugging code. A local\nuser could exploit this to cause a kernel crash. (CVE-2006-1855)\n\nKostik Belousov discovered that the readv() and writev() functions did\nnot query LSM modules for access permission. This could be exploited\nto circumvent access restrictions defined by LSM modules such as\nSELinux or AppArmor. (CVE-2006-1856)\n\nThe SCTP driver did not properly verify certain parameters when\nreceiving a HB-ACK chunk. By sending a specially crafted packet to an\nSCTP socket, a remote attacker could exploit this to trigger a buffer\noverflow, which could lead to a crash or possibly even arbitrary code\nexecution. (CVE-2006-1857)\n\nThe sctp_walk_params() function in the SCTP driver incorrectly used\nrounded values for bounds checking instead of the precise values. By\nsending a specially crafted packet to an SCTP socket, a remote\nattacker could exploit this to crash the kernel. (CVE-2006-1858)\n\nBjoern Steinbrink reported a memory leak in the __setlease() function.\nA local attacker could exploit this to exhaust kernel memory and\nrender the computer unusable (Denial of Service). (CVE-2006-1859)\n\nDaniel Hokka Zakrisson discovered that the lease_init() did not\nproperly handle locking. A local attacker could exploit this to cause\na kernel deadlock (Denial of Service). (CVE-2006-1860)\n\nMark Moseley discovered that the CIFS file system driver did not\nfilter out '..\\\\' path components. A local attacker could exploit this\nto break out of a chroot environment on a mounted SMB share.\n(CVE-2006-1863) The same vulnerability applies to the older smb file\nsystem. (CVE-2006-1864)\n\nHugh Dickins discovered that the mprotect() function allowed an user\nto change a read-only shared memory attachment to become writable,\nwhich bypasses IPC (inter-process communication) permissions.\n(CVE-2006-2071)\n\nThe SCTP (Stream Control Transmission Protocol) driver triggered a\nkernel panic on unexpected packets while the session was in the CLOSED\nstate, instead of silently ignoring the packets. A remote attacker\ncould exploit this to crash the computer. (CVE-2006-2271)\n\nThe SCTP driver did not handle control chunks if they arrived in\nfragmented packets. By sending specially crafted packets to an SCTP\nsocket, a remote attacker could exploit this to crash the target\nmachine. (CVE-2006-2272)\n\nThe SCTP driver did not correctly handle packets containing more than\none DATA fragment. By sending specially crafted packets to an SCTP\nsocket, a remote attacker could exploit this to crash the target\nmachine. (CVE-2006-2274)\n\nThe SCTP driver did not correcly buffer incoming packets. By sending a\nlarge number of small messages to a receiver application that cannot\nprocess the messages quickly enough, a remote attacker could exploit\nthis to cause a deadlock in the target machine (Denial of Service).\n(CVE-2006-2275)\n\nPatrick McHardy discovered that the snmp_trap_decode() function did\nnot correctly handle memory allocation in some error conditions. By\nsending specially crafted packets to a machine which uses the SNMP\nnetwork address translation (NAT), a remote attacker could exploit\nthis to crash that machine. (CVE-2006-2444)\n\nIn addition, the Ubuntu 6.06 LTS update fixes a range of bugs.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 28, "published": "2007-11-10T00:00:00", "title": "Ubuntu 5.04 / 5.10 / 6.06 LTS : linux-source-2.6.10/2.6.12/2.6.15 vulnerabilities (USN-302-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2006-1056", "CVE-2006-1858", "CVE-2006-1522", "CVE-2006-1527", "CVE-2006-2271", "CVE-2006-2275", "CVE-2006-0038", "CVE-2006-1859", "CVE-2006-1855", "CVE-2006-2444", "CVE-2006-1055", "CVE-2006-1857", "CVE-2006-1863", "CVE-2006-0744", "CVE-2006-1528", "CVE-2006-1860", "CVE-2006-1856", "CVE-2006-2071", "CVE-2006-1864", "CVE-2006-2272", "CVE-2006-2274"], "modified": "2007-11-10T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:linux-headers-amd64-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-amd64-server", "p-cpe:/a:canonical:ubuntu_linux:linux-amd64-server", "p-cpe:/a:canonical:ubuntu_linux:nvidia-glx", "p-cpe:/a:canonical:ubuntu_linux:linux-headers-amd64-xeon", "p-cpe:/a:canonical:ubuntu_linux:linux-kernel-devel", "p-cpe:/a:canonical:ubuntu_linux:avm-fritz-kernel-source", "p-cpe:/a:canonical:ubuntu_linux:linux-restricted-modules-common", "p-cpe:/a:canonical:ubuntu_linux:fglrx-control", "p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-amd64-xeon", "p-cpe:/a:canonical:ubuntu_linux:linux-doc", "p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6", "p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-amd64-server", "p-cpe:/a:canonical:ubuntu_linux:linux-restricted-modules-2.6-amd64-k8", "p-cpe:/a:canonical:ubuntu_linux:nvidia-glx-legacy-dev", "p-cpe:/a:canonical:ubuntu_linux:linux-doc-2.6.12", "p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-server", "p-cpe:/a:canonical:ubuntu_linux:linux-headers-686", "p-cpe:/a:canonical:ubuntu_linux:linux-restricted-modules-2.6-386", "p-cpe:/a:canonical:ubuntu_linux:fglrx-kernel-source", "p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-amd64-xeon", "p-cpe:/a:canonical:ubuntu_linux:linux-686", "p-cpe:/a:canonical:ubuntu_linux:xorg-driver-fglrx", "p-cpe:/a:canonical:ubuntu_linux:linux-image-amd64-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-patch-ubuntu-2.6.12", "p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-amd64-server", "p-cpe:/a:canonical:ubuntu_linux:linux-restricted-modules-amd64-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-doc-2.6.10", "p-cpe:/a:canonical:ubuntu_linux:linux-amd64-k8-smp", "p-cpe:/a:canonical:ubuntu_linux:linux-restricted-modules-686", "p-cpe:/a:canonical:ubuntu_linux:linux", "p-cpe:/a:canonical:ubuntu_linux:linux-tree-2.6.12", "p-cpe:/a:canonical:ubuntu_linux:linux-386", "p-cpe:/a:canonical:ubuntu_linux:linux-restricted-modules-386", "p-cpe:/a:canonical:ubuntu_linux:nvidia-legacy-kernel-source", "p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-amd64-k8", "cpe:/o:canonical:ubuntu_linux:5.04", "p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-686-smp", "p-cpe:/a:canonical:ubuntu_linux:linux-amd64-k8", "p-cpe:/a:canonical:ubuntu_linux:linux-tree-2.6.10", "p-cpe:/a:canonical:ubuntu_linux:linux-patch-ubuntu-2.6.10", "p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-amd64-generic", "p-cpe:/a:canonical:ubuntu_linux:nvidia-kernel-source", "p-cpe:/a:canonical:ubuntu_linux:linux-image-686", "p-cpe:/a:canonical:ubuntu_linux:nvidia-glx-dev", "p-cpe:/a:canonical:ubuntu_linux:avm-fritz-firmware", "p-cpe:/a:canonical:ubuntu_linux:linux-headers-386", "p-cpe:/a:canonical:ubuntu_linux:linux-image-server", "p-cpe:/a:canonical:ubuntu_linux:linux-headers-server", "p-cpe:/a:canonical:ubuntu_linux:linux-image-amd64-k8", "p-cpe:/a:canonical:ubuntu_linux:linux-amd64-xeon", "p-cpe:/a:canonical:ubuntu_linux:linux-restricted-modules-2.6-686", "p-cpe:/a:canonical:ubuntu_linux:linux-restricted-modules-2.6-amd64-xeon", "p-cpe:/a:canonical:ubuntu_linux:linux-source-2.6.12", "p-cpe:/a:canonical:ubuntu_linux:linux-amd64-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-restricted-modules-amd64-k8", "p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-686-smp", "p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-386", "p-cpe:/a:canonical:ubuntu_linux:avm-fritz-firmware-2.6.15-25", "p-cpe:/a:canonical:ubuntu_linux:linux-image-386", "p-cpe:/a:canonical:ubuntu_linux:linux-headers-amd64-server", "cpe:/o:canonical:ubuntu_linux:5.10", "p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-amd64-generic", "p-cpe:/a:canonical:ubuntu_linux:nvidia-glx-legacy", "p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-amd64-k8", "p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-amd64-k8-smp", "p-cpe:/a:canonical:ubuntu_linux:linux-source-2.6.15", "p-cpe:/a:canonical:ubuntu_linux:linux-restricted-modules-amd64-xeon", "p-cpe:/a:canonical:ubuntu_linux:linux-server", "p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-686", "p-cpe:/a:canonical:ubuntu_linux:linux-image-amd64-xeon", "p-cpe:/a:canonical:ubuntu_linux:linux-doc-2.6.15", "p-cpe:/a:canonical:ubuntu_linux:linux-restricted-modules-2.6-amd64-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-686", "p-cpe:/a:canonical:ubuntu_linux:linux-headers-amd64-k8", "p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-server", "p-cpe:/a:canonical:ubuntu_linux:xorg-driver-fglrx-dev", "p-cpe:/a:canonical:ubuntu_linux:linux-686-smp", "p-cpe:/a:canonical:ubuntu_linux:linux-source-2.6.10", "p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-amd64-k8-smp", "p-cpe:/a:canonical:ubuntu_linux:linux-source", "p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-386", "cpe:/o:canonical:ubuntu_linux:6.06:-:lts"], "id": "UBUNTU_USN-302-1.NASL", "href": "https://www.tenable.com/plugins/nessus/27877", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-302-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(27877);\n script_version(\"1.23\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2006-0038\", \"CVE-2006-0744\", \"CVE-2006-1055\", \"CVE-2006-1056\", \"CVE-2006-1522\", \"CVE-2006-1527\", \"CVE-2006-1528\", \"CVE-2006-1855\", \"CVE-2006-1856\", \"CVE-2006-1857\", \"CVE-2006-1858\", \"CVE-2006-1859\", \"CVE-2006-1860\", \"CVE-2006-1863\", \"CVE-2006-1864\", \"CVE-2006-2071\", \"CVE-2006-2271\", \"CVE-2006-2272\", \"CVE-2006-2274\", \"CVE-2006-2275\", \"CVE-2006-2444\");\n script_bugtraq_id(17600, 18081);\n script_xref(name:\"USN\", value:\"302-1\");\n\n script_name(english:\"Ubuntu 5.04 / 5.10 / 6.06 LTS : linux-source-2.6.10/2.6.12/2.6.15 vulnerabilities (USN-302-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"An integer overflow was discovered in the do_replace() function. A\nlocal user process with the CAP_NET_ADMIN capability could exploit\nthis to execute arbitrary commands with full root privileges. However,\nnone of Ubuntu's supported packages use this capability with any\nnon-root user, so this only affects you if you use some third party\nsoftware like the OpenVZ virtualization system. (CVE-2006-0038)\n\nOn EMT64 CPUs, the kernel did not properly handle uncanonical return\naddresses. A local user could exploit this to trigger a kernel crash.\n(CVE-2006-0744)\n\nAl Viro discovered a local Denial of Service in the sysfs write buffer\nhandling. By writing a block with a length exactly equal to the\nprocessor's page size to any writable file in /sys, a local attacker\ncould cause a kernel crash. (CVE-2006-1055)\n\nJan Beulich discovered an information leak in the handling of\nregisters for the numeric coprocessor when running on AMD processors.\nThis allowed processes to see the coprocessor execution state of other\nprocesses, which could reveal sensitive data in the case of\ncryptographic computations. (CVE-2006-1056)\n\nMarcel Holtmann discovered that the sys_add_key() did not check that a\nnew user key is added to a proper keyring. By attempting to add a key\nto a normal user key (which is not a keyring), a local attacker could\nexploit this to crash the kernel. (CVE-2006-1522)\n\nIngo Molnar discovered that the SCTP protocol connection tracking\nmodule in netfilter got stuck in an infinite loop on certain empty\npacket chunks. A remote attacker could exploit this to cause the\ncomputer to hang. (CVE-2006-1527)\n\nThe SCSI I/O driver did not correctly handle the VM_IO flag for memory\nmapped pages used for data transfer. A local user could exploit this\nto cause a kernel crash. (CVE-2006-1528)\n\nThe choose_new_parent() contained obsolete debugging code. A local\nuser could exploit this to cause a kernel crash. (CVE-2006-1855)\n\nKostik Belousov discovered that the readv() and writev() functions did\nnot query LSM modules for access permission. This could be exploited\nto circumvent access restrictions defined by LSM modules such as\nSELinux or AppArmor. (CVE-2006-1856)\n\nThe SCTP driver did not properly verify certain parameters when\nreceiving a HB-ACK chunk. By sending a specially crafted packet to an\nSCTP socket, a remote attacker could exploit this to trigger a buffer\noverflow, which could lead to a crash or possibly even arbitrary code\nexecution. (CVE-2006-1857)\n\nThe sctp_walk_params() function in the SCTP driver incorrectly used\nrounded values for bounds checking instead of the precise values. By\nsending a specially crafted packet to an SCTP socket, a remote\nattacker could exploit this to crash the kernel. (CVE-2006-1858)\n\nBjoern Steinbrink reported a memory leak in the __setlease() function.\nA local attacker could exploit this to exhaust kernel memory and\nrender the computer unusable (Denial of Service). (CVE-2006-1859)\n\nDaniel Hokka Zakrisson discovered that the lease_init() did not\nproperly handle locking. A local attacker could exploit this to cause\na kernel deadlock (Denial of Service). (CVE-2006-1860)\n\nMark Moseley discovered that the CIFS file system driver did not\nfilter out '..\\\\' path components. A local attacker could exploit this\nto break out of a chroot environment on a mounted SMB share.\n(CVE-2006-1863) The same vulnerability applies to the older smb file\nsystem. (CVE-2006-1864)\n\nHugh Dickins discovered that the mprotect() function allowed an user\nto change a read-only shared memory attachment to become writable,\nwhich bypasses IPC (inter-process communication) permissions.\n(CVE-2006-2071)\n\nThe SCTP (Stream Control Transmission Protocol) driver triggered a\nkernel panic on unexpected packets while the session was in the CLOSED\nstate, instead of silently ignoring the packets. A remote attacker\ncould exploit this to crash the computer. (CVE-2006-2271)\n\nThe SCTP driver did not handle control chunks if they arrived in\nfragmented packets. By sending specially crafted packets to an SCTP\nsocket, a remote attacker could exploit this to crash the target\nmachine. (CVE-2006-2272)\n\nThe SCTP driver did not correctly handle packets containing more than\none DATA fragment. By sending specially crafted packets to an SCTP\nsocket, a remote attacker could exploit this to crash the target\nmachine. (CVE-2006-2274)\n\nThe SCTP driver did not correcly buffer incoming packets. By sending a\nlarge number of small messages to a receiver application that cannot\nprocess the messages quickly enough, a remote attacker could exploit\nthis to cause a deadlock in the target machine (Denial of Service).\n(CVE-2006-2275)\n\nPatrick McHardy discovered that the snmp_trap_decode() function did\nnot correctly handle memory allocation in some error conditions. By\nsending specially crafted packets to a machine which uses the SNMP\nnetwork address translation (NAT), a remote attacker could exploit\nthis to crash that machine. (CVE-2006-2444)\n\nIn addition, the Ubuntu 6.06 LTS update fixes a range of bugs.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/302-1/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_cwe_id(20, 119, 189);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:avm-fritz-firmware\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:avm-fritz-firmware-2.6.15-25\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:avm-fritz-kernel-source\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:fglrx-control\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:fglrx-kernel-source\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-386\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-686\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-686-smp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-amd64-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-amd64-k8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-amd64-k8-smp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-amd64-server\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-amd64-xeon\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-doc-2.6.10\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-doc-2.6.12\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-doc-2.6.15\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-386\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-686\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-686-smp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-amd64-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-amd64-k8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-amd64-k8-smp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-amd64-server\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-amd64-xeon\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-server\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-headers-386\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-headers-686\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-headers-amd64-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-headers-amd64-k8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-headers-amd64-server\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-headers-amd64-xeon\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-headers-server\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-386\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-686\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-686-smp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-amd64-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-amd64-k8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-amd64-k8-smp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-amd64-server\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-amd64-xeon\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-server\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-386\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-686\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-amd64-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-amd64-k8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-amd64-server\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-amd64-xeon\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-server\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-patch-ubuntu-2.6.10\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-patch-ubuntu-2.6.12\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-restricted-modules-2.6-386\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-restricted-modules-2.6-686\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-restricted-modules-2.6-amd64-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-restricted-modules-2.6-amd64-k8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-restricted-modules-2.6-amd64-xeon\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-restricted-modules-386\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-restricted-modules-686\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-restricted-modules-amd64-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-restricted-modules-amd64-k8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-restricted-modules-amd64-xeon\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-restricted-modules-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-server\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-source\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-source-2.6.10\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-source-2.6.12\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-source-2.6.15\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-tree-2.6.10\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-tree-2.6.12\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:nvidia-glx\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:nvidia-glx-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:nvidia-glx-legacy\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:nvidia-glx-legacy-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:nvidia-kernel-source\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:nvidia-legacy-kernel-source\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:xorg-driver-fglrx\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:xorg-driver-fglrx-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:5.04\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:5.10\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:6.06:-:lts\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2006/03/22\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2006/06/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2007/11/10\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2006-2019 Canonical, Inc. / NASL script (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! ereg(pattern:\"^(5\\.04|5\\.10|6\\.06)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 5.04 / 5.10 / 6.06\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2006-0038\", \"CVE-2006-0744\", \"CVE-2006-1055\", \"CVE-2006-1056\", \"CVE-2006-1522\", \"CVE-2006-1527\", \"CVE-2006-1528\", \"CVE-2006-1855\", \"CVE-2006-1856\", \"CVE-2006-1857\", \"CVE-2006-1858\", \"CVE-2006-1859\", \"CVE-2006-1860\", \"CVE-2006-1863\", \"CVE-2006-1864\", \"CVE-2006-2071\", \"CVE-2006-2271\", \"CVE-2006-2272\", \"CVE-2006-2274\", \"CVE-2006-2275\", \"CVE-2006-2444\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-302-1\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nflag = 0;\n\nif (ubuntu_check(osver:\"5.04\", pkgname:\"linux-doc-2.6.10\", pkgver:\"2.6.10-34.20\")) flag++;\nif (ubuntu_check(osver:\"5.04\", pkgname:\"linux-headers-2.6.10-6\", pkgver:\"2.6.10-34.20\")) flag++;\nif (ubuntu_check(osver:\"5.04\", pkgname:\"linux-headers-2.6.10-6-386\", pkgver:\"2.6.10-34.20\")) flag++;\nif (ubuntu_check(osver:\"5.04\", pkgname:\"linux-headers-2.6.10-6-686\", pkgver:\"2.6.10-34.20\")) flag++;\nif (ubuntu_check(osver:\"5.04\", pkgname:\"linux-headers-2.6.10-6-686-smp\", pkgver:\"2.6.10-34.20\")) flag++;\nif (ubuntu_check(osver:\"5.04\", pkgname:\"linux-headers-2.6.10-6-amd64-generic\", pkgver:\"2.6.10-34.20\")) flag++;\nif (ubuntu_check(osver:\"5.04\", pkgname:\"linux-headers-2.6.10-6-amd64-k8\", pkgver:\"2.6.10-34.20\")) flag++;\nif (ubuntu_check(osver:\"5.04\", pkgname:\"linux-headers-2.6.10-6-amd64-k8-smp\", pkgver:\"2.6.10-34.20\")) flag++;\nif (ubuntu_check(osver:\"5.04\", pkgname:\"linux-headers-2.6.10-6-amd64-xeon\", pkgver:\"2.6.10-34.20\")) flag++;\nif (ubuntu_check(osver:\"5.04\", pkgname:\"linux-image-2.6.10-6-386\", pkgver:\"2.6.10-34.20\")) flag++;\nif (ubuntu_check(osver:\"5.04\", pkgname:\"linux-image-2.6.10-6-686\", pkgver:\"2.6.10-34.20\")) flag++;\nif (ubuntu_check(osver:\"5.04\", pkgname:\"linux-image-2.6.10-6-686-smp\", pkgver:\"2.6.10-34.20\")) flag++;\nif (ubuntu_check(osver:\"5.04\", pkgname:\"linux-image-2.6.10-6-amd64-generic\", pkgver:\"2.6.10-34.20\")) flag++;\nif (ubuntu_check(osver:\"5.04\", pkgname:\"linux-image-2.6.10-6-amd64-k8\", pkgver:\"2.6.10-34.20\")) flag++;\nif (ubuntu_check(osver:\"5.04\", pkgname:\"linux-image-2.6.10-6-amd64-k8-smp\", pkgver:\"2.6.10-34.20\")) flag++;\nif (ubuntu_check(osver:\"5.04\", pkgname:\"linux-image-2.6.10-6-amd64-xeon\", pkgver:\"2.6.10-34.20\")) flag++;\nif (ubuntu_check(osver:\"5.04\", pkgname:\"linux-patch-ubuntu-2.6.10\", pkgver:\"2.6.10-34.20\")) flag++;\nif (ubuntu_check(osver:\"5.04\", pkgname:\"linux-source-2.6.10\", pkgver:\"2.6.10-34.20\")) flag++;\nif (ubuntu_check(osver:\"5.04\", pkgname:\"linux-tree-2.6.10\", pkgver:\"2.6.10-34.20\")) flag++;\nif (ubuntu_check(osver:\"5.10\", pkgname:\"linux-doc-2.6.12\", pkgver:\"2.6.12-10.34\")) flag++;\nif (ubuntu_check(osver:\"5.10\", pkgname:\"linux-headers-2.6.12-10\", pkgver:\"2.6.12-10.34\")) flag++;\nif (ubuntu_check(osver:\"5.10\", pkgname:\"linux-headers-2.6.12-10-386\", pkgver:\"2.6.12-10.34\")) flag++;\nif (ubuntu_check(osver:\"5.10\", pkgname:\"linux-headers-2.6.12-10-686\", pkgver:\"2.6.12-10.34\")) flag++;\nif (ubuntu_check(osver:\"5.10\", pkgname:\"linux-headers-2.6.12-10-686-smp\", pkgver:\"2.6.12-10.34\")) flag++;\nif (ubuntu_check(osver:\"5.10\", pkgname:\"linux-headers-2.6.12-10-amd64-generic\", pkgver:\"2.6.12-10.34\")) flag++;\nif (ubuntu_check(osver:\"5.10\", pkgname:\"linux-headers-2.6.12-10-amd64-k8\", pkgver:\"2.6.12-10.34\")) flag++;\nif (ubuntu_check(osver:\"5.10\", pkgname:\"linux-headers-2.6.12-10-amd64-k8-smp\", pkgver:\"2.6.12-10.34\")) flag++;\nif (ubuntu_check(osver:\"5.10\", pkgname:\"linux-headers-2.6.12-10-amd64-xeon\", pkgver:\"2.6.12-10.34\")) flag++;\nif (ubuntu_check(osver:\"5.10\", pkgname:\"linux-image-2.6.12-10-386\", pkgver:\"2.6.12-10.34\")) flag++;\nif (ubuntu_check(osver:\"5.10\", pkgname:\"linux-image-2.6.12-10-686\", pkgver:\"2.6.12-10.34\")) flag++;\nif (ubuntu_check(osver:\"5.10\", pkgname:\"linux-image-2.6.12-10-686-smp\", pkgver:\"2.6.12-10.34\")) flag++;\nif (ubuntu_check(osver:\"5.10\", pkgname:\"linux-image-2.6.12-10-amd64-generic\", pkgver:\"2.6.12-10.34\")) flag++;\nif (ubuntu_check(osver:\"5.10\", pkgname:\"linux-image-2.6.12-10-amd64-k8\", pkgver:\"2.6.12-10.34\")) flag++;\nif (ubuntu_check(osver:\"5.10\", pkgname:\"linux-image-2.6.12-10-amd64-k8-smp\", pkgver:\"2.6.12-10.34\")) flag++;\nif (ubuntu_check(osver:\"5.10\", pkgname:\"linux-image-2.6.12-10-amd64-xeon\", pkgver:\"2.6.12-10.34\")) flag++;\nif (ubuntu_check(osver:\"5.10\", pkgname:\"linux-patch-ubuntu-2.6.12\", pkgver:\"2.6.12-10.34\")) flag++;\nif (ubuntu_check(osver:\"5.10\", pkgname:\"linux-source-2.6.12\", pkgver:\"2.6.12-10.34\")) flag++;\nif (ubuntu_check(osver:\"5.10\", pkgname:\"linux-tree-2.6.12\", pkgver:\"2.6.12-10.34\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"avm-fritz-firmware\", pkgver:\"2.6.15.23\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"avm-fritz-firmware-2.6.15-25\", pkgver:\"2.6.15.11-2\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"avm-fritz-kernel-source\", pkgver:\"2.6.15.11-2\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"fglrx-control\", pkgver:\"2.6.15.11-2\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"fglrx-kernel-source\", pkgver:\"2.6.15.11-2\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux\", pkgver:\"2.6.15.23\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-386\", pkgver:\"2.6.15.23\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-686\", pkgver:\"2.6.15.23\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-686-smp\", pkgver:\"2.6.15.23\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-amd64-generic\", pkgver:\"2.6.15.23\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-amd64-k8\", pkgver:\"2.6.15.23\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-amd64-k8-smp\", pkgver:\"2.6.15.23\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-amd64-server\", pkgver:\"2.6.15.23\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-amd64-xeon\", pkgver:\"2.6.15.23\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-doc\", pkgver:\"2.6.15.23\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-doc-2.6.15\", pkgver:\"2.6.15-25.43\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-headers-2.6.15-25\", pkgver:\"2.6.15-25.43\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-headers-2.6.15-25-386\", pkgver:\"2.6.15-25.43\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-headers-2.6.15-25-686\", pkgver:\"2.6.15-25.43\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-headers-2.6.15-25-amd64-generic\", pkgver:\"2.6.15-25.43\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-headers-2.6.15-25-amd64-k8\", pkgver:\"2.6.15-25.43\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-headers-2.6.15-25-amd64-server\", pkgver:\"2.6.15-25.43\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-headers-2.6.15-25-amd64-xeon\", pkgver:\"2.6.15-25.43\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-headers-2.6.15-25-server\", pkgver:\"2.6.15-25.43\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-headers-386\", pkgver:\"2.6.15.23\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-headers-686\", pkgver:\"2.6.15.23\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-headers-amd64-generic\", pkgver:\"2.6.15.23\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-headers-amd64-k8\", pkgver:\"2.6.15.23\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-headers-amd64-server\", pkgver:\"2.6.15.23\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-headers-amd64-xeon\", pkgver:\"2.6.15.23\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-headers-server\", pkgver:\"2.6.15.23\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-image-2.6.15-25-386\", pkgver:\"2.6.15-25.43\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-image-2.6.15-25-686\", pkgver:\"2.6.15-25.43\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-image-2.6.15-25-amd64-generic\", pkgver:\"2.6.15-25.43\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-image-2.6.15-25-amd64-k8\", pkgver:\"2.6.15-25.43\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-image-2.6.15-25-amd64-server\", pkgver:\"2.6.15-25.43\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-image-2.6.15-25-amd64-xeon\", pkgver:\"2.6.15-25.43\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-image-2.6.15-25-server\", pkgver:\"2.6.15-25.43\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-image-386\", pkgver:\"2.6.15.23\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-image-686\", pkgver:\"2.6.15.23\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-image-amd64-generic\", pkgver:\"2.6.15.23\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-image-amd64-k8\", pkgver:\"2.6.15.23\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-image-amd64-server\", pkgver:\"2.6.15.23\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-image-amd64-xeon\", pkgver:\"2.6.15.23\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-image-server\", pkgver:\"2.6.15.23\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-kernel-devel\", pkgver:\"2.6.15-25.43\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-restricted-modules-2.6.15-25-386\", pkgver:\"2.6.15.11-2\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-restricted-modules-2.6.15-25-686\", pkgver:\"2.6.15.11-2\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-restricted-modules-2.6.15-25-amd64-generic\", pkgver:\"2.6.15.11-2\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-restricted-modules-2.6.15-25-amd64-k8\", pkgver:\"2.6.15.11-2\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-restricted-modules-2.6.15-25-amd64-xeon\", pkgver:\"2.6.15.11-2\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-restricted-modules-386\", pkgver:\"2.6.15.23\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-restricted-modules-686\", pkgver:\"2.6.15.23\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-restricted-modules-amd64-generic\", pkgver:\"2.6.15.23\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-restricted-modules-amd64-k8\", pkgver:\"2.6.15.23\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-restricted-modules-amd64-xeon\", pkgver:\"2.6.15.23\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-restricted-modules-common\", pkgver:\"2.6.15.11-2\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-server\", pkgver:\"2.6.15.23\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-source\", pkgver:\"2.6.15.23\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"linux-source-2.6.15\", pkgver:\"2.6.15-25.43\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"nvidia-glx\", pkgver:\"2.6.15.11-2\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"nvidia-glx-dev\", pkgver:\"2.6.15.11-2\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"nvidia-glx-legacy\", pkgver:\"2.6.15.11-2\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"nvidia-glx-legacy-dev\", pkgver:\"2.6.15.11-2\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"nvidia-kernel-source\", pkgver:\"1.0.8762+2.6.15.11-2\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"nvidia-legacy-kernel-source\", pkgver:\"1.0.7174+2.6.15.11-2\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"xorg-driver-fglrx\", pkgver:\"2.6.15.11-2\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"xorg-driver-fglrx-dev\", pkgver:\"2.6.15.11-2\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"avm-fritz-firmware / avm-fritz-firmware-2.6.15-25 / etc\");\n}\n", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:C"}}], "centos": [{"lastseen": "2019-12-20T18:24:31", "bulletinFamily": "unix", "cvelist": ["CVE-2006-1056", "CVE-2006-0742", "CVE-2006-0457", "CVE-2006-2275", "CVE-2006-0038", "CVE-2006-1343", "CVE-2006-1242", "CVE-2006-2446", "CVE-2006-1857", "CVE-2005-3623", "CVE-2006-1052", "CVE-2006-2448", "CVE-2006-0456", "CVE-2005-3055", "CVE-2006-2934"], "description": "**CentOS Errata and Security Advisory** CESA-2006:0575\n\n\nNew features introduced in this update include:\r\n\r\n* Device Mapper mirroring support\r\n\r\n* IDE diskdump support\r\n\r\n* x86, AMD64 and Intel EM64T: Multi-core scheduler support enhancements\r\n\r\n* Itanium: perfmon support for Montecito\r\n\r\n* much improved support for IBM x460\r\n\r\n* AMD PowerNow! patches to support Opteron Rev G\r\n\r\n* Vmalloc support > 64MB\r\n\r\nThe following device drivers have been upgraded to new versions:\r\n\r\nipmi: 33.11 to 33.13\r\nib_mthca: 0.06 to 0.08\r\nbnx2: 1.4.30 to 1.4.38\r\nbonding: 2.6.1 to 2.6.3\r\ne100: 3.4.8-k2-NAPI to 3.5.10-k2-NAPI\r\ne1000: 6.1.16-k3-NAPI to 7.0.33-k2-NAPI\r\nsky2: 0.13 to 1.1\r\ntg3: 3.43-rh to 3.52-rh\r\nipw2100: 1.1.0 to git-1.1.4\r\nipw2200: 1.0.0 to git-1.0.10\r\n3w-9xxx: 2.26.02.001 to 2.26.04.010\r\nips: 7.10.18 to 7.12.02\r\niscsi_sfnet: 4:0.1.11-2 to 4:0.1.11-3\r\nlpfc: 0:8.0.16.18 to 0:8.0.16.27\r\nmegaraid_sas: 00.00.02.00 to 00.00.02.03-RH1\r\nqla2xxx: 8.01.02-d4 to 8.01.04-d7\r\nqla6312: 8.01.02-d4 to 8.01.04-d7\r\nsata_promise: 1.03 to 1.04\r\nsata_vsc: 1.1 to 1.2\r\nibmvscsic: 1.5.5 to 1.5.6\r\nipr: 2.0.11.1 to 2.0.11.2\r\n\r\nAdded drivers:\r\n\r\ndcdbas: 5.6.0-2\r\nsata_mv: 0.6\r\nsata_qstor: 0.05\r\nsata_uli: 0.5\r\nskge: 1.1\r\nstex: 2.9.0.13\r\npdc_adma: 0.03\r\n\r\nThis update includes fixes for the security issues:\r\n\r\n* a flaw in the USB devio handling of device removal that allowed a\r\nlocal user to cause a denial of service (crash) (CVE-2005-3055,\r\nmoderate)\r\n\r\n* a flaw in the ACL handling of nfsd that allowed a remote user to\r\nbypass ACLs for readonly mounted NFS file systems (CVE-2005-3623,\r\nmoderate)\r\n\r\n* a flaw in the netfilter handling that allowed a local user with\r\nCAP_NET_ADMIN rights to cause a buffer overflow (CVE-2006-0038, low)\r\n\r\n* a flaw in the IBM S/390 and IBM zSeries strnlen_user() function that\r\nallowed a local user to cause a denial of service (crash) or to retrieve\r\nrandom kernel data (CVE-2006-0456, important)\r\n\r\n* a flaw in the keyctl functions that allowed a local user to cause a\r\ndenial of service (crash) or to read sensitive kernel memory\r\n(CVE-2006-0457, important)\r\n\r\n* a flaw in unaligned accesses handling on Itanium processors that\r\nallowed a local user to cause a denial of service (crash)\r\n(CVE-2006-0742, important)\r\n\r\n* a flaw in SELinux ptrace logic that allowed a local user with ptrace\r\npermissions to change the tracer SID to a SID of another process\r\n(CVE-2006-1052, moderate)\r\n\r\n* an info leak on AMD-based x86 and x86_64 systems that allowed a local\r\nuser to retrieve the floating point exception state of a process run by a\r\ndifferent user (CVE-2006-1056, important)\r\n\r\n* a flaw in IPv4 packet output handling that allowed a remote user to\r\nbypass the zero IP ID countermeasure on systems with a disabled firewall\r\n(CVE-2006-1242, low)\r\n\r\n* a minor info leak in socket option handling in the network code\r\n(CVE-2006-1343, low)\r\n\r\n* a flaw in the HB-ACK chunk handling of SCTP that allowed a remote user to\r\ncause a denial of service (crash) (CVE-2006-1857, moderate)\r\n\r\n* a flaw in the SCTP implementation that allowed a remote user to cause a\r\ndenial of service (deadlock) (CVE-2006-2275, moderate)\r\n\r\n* a flaw in the socket buffer handling that allowed a remote user to cause\r\na denial of service (panic) (CVE-2006-2446, important)\r\n\r\n* a flaw in the signal handling access checking on PowerPC that allowed a\r\nlocal user to cause a denial of service (crash) or read arbitrary kernel\r\nmemory on 64-bit systems (CVE-2006-2448, important)\r\n\r\n* a flaw in the netfilter SCTP module when receiving a chunkless packet\r\nthat allowed a remote user to cause a denial of service (crash)\r\n(CVE-2006-2934, important)\r\n\r\nThere were several bug fixes in various parts of the kernel. The ongoing\r\neffort to resolve these problems has resulted in a marked improvement\r\nin the reliability and scalability of Red Hat Enterprise Linux 4.\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2006-August/025185.html\nhttp://lists.centos.org/pipermail/centos-announce/2006-August/025186.html\n\n**Affected packages:**\nkernel\nkernel-devel\nkernel-doc\nkernel-hugemem\nkernel-hugemem-devel\nkernel-largesmp\nkernel-largesmp-devel\nkernel-smp\nkernel-smp-devel\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2006-0575.html", "edition": 4, "modified": "2006-08-24T00:20:15", "published": "2006-08-24T00:20:09", "href": "http://lists.centos.org/pipermail/centos-announce/2006-August/025185.html", "id": "CESA-2006:0575", "title": "kernel security update", "type": "centos", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:C"}}], "redhat": [{"lastseen": "2019-08-13T18:45:22", "bulletinFamily": "unix", "cvelist": ["CVE-2005-3055", "CVE-2005-3623", "CVE-2006-0038", "CVE-2006-0456", "CVE-2006-0457", "CVE-2006-0742", "CVE-2006-1052", "CVE-2006-1056", "CVE-2006-1242", "CVE-2006-1343", "CVE-2006-1857", "CVE-2006-2275", "CVE-2006-2446", "CVE-2006-2448", "CVE-2006-2934"], "description": "New features introduced in this update include:\r\n\r\n* Device Mapper mirroring support\r\n\r\n* IDE diskdump support\r\n\r\n* x86, AMD64 and Intel EM64T: Multi-core scheduler support enhancements\r\n\r\n* Itanium: perfmon support for Montecito\r\n\r\n* much improved support for IBM x460\r\n\r\n* AMD PowerNow! patches to support Opteron Rev G\r\n\r\n* Vmalloc support > 64MB\r\n\r\nThe following device drivers have been upgraded to new versions:\r\n\r\nipmi: 33.11 to 33.13\r\nib_mthca: 0.06 to 0.08\r\nbnx2: 1.4.30 to 1.4.38\r\nbonding: 2.6.1 to 2.6.3\r\ne100: 3.4.8-k2-NAPI to 3.5.10-k2-NAPI\r\ne1000: 6.1.16-k3-NAPI to 7.0.33-k2-NAPI\r\nsky2: 0.13 to 1.1\r\ntg3: 3.43-rh to 3.52-rh\r\nipw2100: 1.1.0 to git-1.1.4\r\nipw2200: 1.0.0 to git-1.0.10\r\n3w-9xxx: 2.26.02.001 to 2.26.04.010\r\nips: 7.10.18 to 7.12.02\r\niscsi_sfnet: 4:0.1.11-2 to 4:0.1.11-3\r\nlpfc: 0:8.0.16.18 to 0:8.0.16.27\r\nmegaraid_sas: 00.00.02.00 to 00.00.02.03-RH1\r\nqla2xxx: 8.01.02-d4 to 8.01.04-d7\r\nqla6312: 8.01.02-d4 to 8.01.04-d7\r\nsata_promise: 1.03 to 1.04\r\nsata_vsc: 1.1 to 1.2\r\nibmvscsic: 1.5.5 to 1.5.6\r\nipr: 2.0.11.1 to 2.0.11.2\r\n\r\nAdded drivers:\r\n\r\ndcdbas: 5.6.0-2\r\nsata_mv: 0.6\r\nsata_qstor: 0.05\r\nsata_uli: 0.5\r\nskge: 1.1\r\nstex: 2.9.0.13\r\npdc_adma: 0.03\r\n\r\nThis update includes fixes for the security issues:\r\n\r\n* a flaw in the USB devio handling of device removal that allowed a\r\nlocal user to cause a denial of service (crash) (CVE-2005-3055,\r\nmoderate)\r\n\r\n* a flaw in the ACL handling of nfsd that allowed a remote user to\r\nbypass ACLs for readonly mounted NFS file systems (CVE-2005-3623,\r\nmoderate)\r\n\r\n* a flaw in the netfilter handling that allowed a local user with\r\nCAP_NET_ADMIN rights to cause a buffer overflow (CVE-2006-0038, low)\r\n\r\n* a flaw in the IBM S/390 and IBM zSeries strnlen_user() function that\r\nallowed a local user to cause a denial of service (crash) or to retrieve\r\nrandom kernel data (CVE-2006-0456, important)\r\n\r\n* a flaw in the keyctl functions that allowed a local user to cause a\r\ndenial of service (crash) or to read sensitive kernel memory\r\n(CVE-2006-0457, important)\r\n\r\n* a flaw in unaligned accesses handling on Itanium processors that\r\nallowed a local user to cause a denial of service (crash)\r\n(CVE-2006-0742, important)\r\n\r\n* a flaw in SELinux ptrace logic that allowed a local user with ptrace\r\npermissions to change the tracer SID to a SID of another process\r\n(CVE-2006-1052, moderate)\r\n\r\n* an info leak on AMD-based x86 and x86_64 systems that allowed a local\r\nuser to retrieve the floating point exception state of a process run by a\r\ndifferent user (CVE-2006-1056, important)\r\n\r\n* a flaw in IPv4 packet output handling that allowed a remote user to\r\nbypass the zero IP ID countermeasure on systems with a disabled firewall\r\n(CVE-2006-1242, low)\r\n\r\n* a minor info leak in socket option handling in the network code\r\n(CVE-2006-1343, low)\r\n\r\n* a flaw in the HB-ACK chunk handling of SCTP that allowed a remote user to\r\ncause a denial of service (crash) (CVE-2006-1857, moderate)\r\n\r\n* a flaw in the SCTP implementation that allowed a remote user to cause a\r\ndenial of service (deadlock) (CVE-2006-2275, moderate)\r\n\r\n* a flaw in the socket buffer handling that allowed a remote user to cause\r\na denial of service (panic) (CVE-2006-2446, important)\r\n\r\n* a flaw in the signal handling access checking on PowerPC that allowed a\r\nlocal user to cause a denial of service (crash) or read arbitrary kernel\r\nmemory on 64-bit systems (CVE-2006-2448, important)\r\n\r\n* a flaw in the netfilter SCTP module when receiving a chunkless packet\r\nthat allowed a remote user to cause a denial of service (crash)\r\n(CVE-2006-2934, important)\r\n\r\nThere were several bug fixes in various parts of the kernel. The ongoing\r\neffort to resolve these problems has resulted in a marked improvement\r\nin the reliability and scalability of Red Hat Enterprise Linux 4.", "modified": "2017-09-08T12:10:35", "published": "2006-08-10T04:00:00", "id": "RHSA-2006:0575", "href": "https://access.redhat.com/errata/RHSA-2006:0575", "type": "redhat", "title": "(RHSA-2006:0575) Updated kernel packages available for Red Hat Enterprise Linux 4 Update 4", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:C"}}], "ubuntu": [{"lastseen": "2020-07-09T00:30:33", "bulletinFamily": "unix", "cvelist": ["CVE-2006-1056", "CVE-2006-1858", "CVE-2006-1522", "CVE-2006-1527", "CVE-2006-2271", "CVE-2006-2275", "CVE-2006-0038", "CVE-2006-1859", "CVE-2006-1855", "CVE-2006-2444", "CVE-2006-1055", "CVE-2006-1857", "CVE-2006-1863", "CVE-2006-0744", "CVE-2006-1528", "CVE-2006-1860", "CVE-2006-1856", "CVE-2006-2071", "CVE-2006-1864", "CVE-2006-2272", "CVE-2006-2274"], "description": "An integer overflow was discovered in the do_replace() function. A \nlocal user process with the CAP_NET_ADMIN capability could exploit \nthis to execute arbitrary commands with full root privileges. \nHowever, none of Ubuntu's supported packages use this capability with \nany non-root user, so this only affects you if you use some third \nparty software like the OpenVZ virtualization system. (CVE-2006-0038)\n\nOn EMT64 CPUs, the kernel did not properly handle uncanonical return \naddresses. A local user could exploit this to trigger a kernel crash. \n(CVE-2006-0744)\n\nAl Viro discovered a local Denial of Service in the sysfs write buffer \nhandling. By writing a block with a length exactly equal to the \nprocessor's page size to any writable file in /sys, a local attacker \ncould cause a kernel crash. (CVE-2006-1055)\n\nJan Beulich discovered an information leak in the handling of \nregisters for the numeric coprocessor when running on AMD processors. \nThis allowed processes to see the coprocessor execution state of \nother processes, which could reveal sensitive data in the case of \ncryptographic computations. (CVE-2006-1056)\n\nMarcel Holtmann discovered that the sys_add_key() did not check that \na new user key is added to a proper keyring. By attempting to add a \nkey to a normal user key (which is not a keyring), a local attacker \ncould exploit this to crash the kernel. (CVE-2006-1522)\n\nIngo Molnar discovered that the SCTP protocol connection tracking \nmodule in netfilter got stuck in an infinite loop on certain empty \npacket chunks. A remote attacker could exploit this to cause the \ncomputer to hang. (CVE-2006-1527)\n\nThe SCSI I/O driver did not correctly handle the VM_IO flag for memory \nmapped pages used for data transfer. A local user could exploit this \nto cause a kernel crash. (CVE-2006-1528)\n\nThe choose_new_parent() contained obsolete debugging code. A local \nuser could exploit this to cause a kernel crash. (CVE-2006-1855)\n\nKostik Belousov discovered that the readv() and writev() functions did \nnot query LSM modules for access permission. This could be exploited \nto circumvent access restrictions defined by LSM modules such as \nSELinux or AppArmor. (CVE-2006-1856)\n\nThe SCTP driver did not properly verify certain parameters when \nreceiving a HB-ACK chunk. By sending a specially crafted packet to an \nSCTP socket, a remote attacker could exploit this to trigger a buffer \noverflow, which could lead to a crash or possibly even arbitrary code \nexecution. (CVE-2006-1857)\n\nThe sctp_walk_params() function in the SCTP driver incorrectly used \nrounded values for bounds checking instead of the precise values. By \nsending a specially crafted packet to an SCTP socket, a remote \nattacker could exploit this to crash the kernel. (CVE-2006-1858)\n\nBjoern Steinbrink reported a memory leak in the __setlease() function. \nA local attacker could exploit this to exhaust kernel memory and \nrender the computer unusable (Denial of Service). (CVE-2006-1859)\n\nDaniel Hokka Zakrisson discovered that the lease_init() did not \nproperly handle locking. A local attacker could exploit this to cause \na kernel deadlock (Denial of Service). (CVE-2006-1860)\n\nMark Moseley discovered that the CIFS file system driver did not \nfilter out \"..\\\" path components. A local attacker could exploit this \nto break out of a chroot environment on a mounted SMB share. \n(CVE-2006-1863) The same vulnerability applies to the older smb file \nsystem. (CVE-2006-1864)\n\nHugh Dickins discovered that the mprotect() function allowed an user \nto change a read-only shared memory attachment to become writable, \nwhich bypasses IPC (inter-process communication) permissions. \n(CVE-2006-2071)\n\nThe SCTP (Stream Control Transmission Protocol) driver triggered a \nkernel panic on unexpected packets while the session was in the CLOSED \nstate, instead of silently ignoring the packets. A remote attacker \ncould exploit this to crash the computer. (CVE-2006-2271)\n\nThe SCTP driver did not handle control chunks if they arrived in \nfragmented packets. By sending specially crafted packets to an SCTP \nsocket, a remote attacker could exploit this to crash the target \nmachine. (CVE-2006-2272)\n\nThe SCTP driver did not correctly handle packets containing more than \none DATA fragment. By sending specially crafted packets to an SCTP \nsocket, a remote attacker could exploit this to crash the target \nmachine. (CVE-2006-2274)\n\nThe SCTP driver did not correcly buffer incoming packets. By sending a \nlarge number of small messages to a receiver application that cannot \nprocess the messages quickly enough, a remote attacker could exploit \nthis to cause a deadlock in the target machine (Denial of Service). \n(CVE-2006-2275)\n\nPatrick McHardy discovered that the snmp_trap_decode() function did \nnot correctly handle memory allocation in some error conditions. By \nsending specially crafted packets to a machine which uses the SNMP \nnetwork address translation (NAT), a remote attacker could exploit \nthis to crash that machine. (CVE-2006-2444)\n\nIn addition, the Ubuntu 6.06 LTS update fixes a range of bugs.", "edition": 6, "modified": "2006-06-15T00:00:00", "published": "2006-06-15T00:00:00", "id": "USN-302-1", "href": "https://ubuntu.com/security/notices/USN-302-1", "title": "Linux kernel vulnerabilities", "type": "ubuntu", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:C"}}]}