| Description: | Description:
The remote host is missing an update to kernel
announced via advisory MDKSA-2003:074.
Multiple vulnerabilities were discovered and fixed in the Linux kernel.
* CVE-2003-0001: Multiple ethernet network card drivers do not pad
frames with null bytes which allows remote attackers to obtain
information from previous packets or kernel memory by using
special malformed packets.
* CVE-2003-0244: The route cache implementation in the 2.4 kernel and
the Netfilter IP conntrack module allows remote attackers to cause a
Denial of Service (DoS) via CPU consumption due to packets with
forged source addresses that cause a large number of hash table
collisions related to the PREROUTING chain.
* CVE-2003-0246: The ioperm implementation in 2.4.20 and earlier
kernels does not properly restrict privileges, which allows local
users to gain read or write access to certain I/O ports.
* CVE-2003-0247: A vulnerability in the TTY layer of the 2.4 kernel
allows attackers to cause a kernel oops resulting in a DoS.
* CVE-2003-0248: The mxcsr code in the 2.4 kernel allows attackers to
modify CPU state registers via a malformed address.
* CVE-2003-0462: A file read race existed in the execve() system call.
Kernels for 9.1/x86 are also available (see MDKSA-2003:066).
MandrakeSoft encourages all users to upgrade to these new kernels.
For full instructions on how to properly upgrade your kernel, please
review http://www.mandrakesecure.net/en/docs/magic.php.
Affected versions: 8.2, 9.0, Corporate Server 2.1,
Multi Network Firewall 8.2
Solution:
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
https://secure1.securityspace.com/smysecure/catid.html?in=MDKSA-2003:074
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0001
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0244
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0246
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0247
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0248
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0462
http://marc.theaimsgroup.com/?l=bugtraq&m=105664924024009&w=2
Risk factor : Critical
CVSS Score:
10.0
|
