Avis du CERT RENATER

Par défaut, cette page vous affichera les derniers messages envoyés par le CERT RENATER à la communauté. Vous pouvez affiner par année ou par type de message. Si aucun critère n'est précisé, seuls les derniers messages sont affichés
Date : Wed, 15 Dec 2010 09:17:55 +0100
Type : VULN
Sujet : CERT-Renater : 2010/VULN525 (SUSE: kernel Multiple vulnerabilities)
====================================================================                                   CERT-Renater

                        Note d'Information No. 2010/VULN525
_____________________________________________________________________

DATE                      : 15/12/2010

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : SUSE Linux Enterprise Desktop version 10 SP3,
                              SUSE Linux Enterprise Server version 10 SP3,
                              SLE SDK version 10 SP3.

======================================================================
http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00004.html
______________________________________________________________________

______________________________________________________________________________

                        SUSE Security Announcement

        Package:                kernel
        Announcement ID:        SUSE-SA:2010:060
        Date:                   Tue, 14 Dec 2010 12:00:00 +0000
        Affected Products:      SLE SDK 10 SP3
                                SUSE Linux Enterprise Desktop 10 SP3
                                SUSE Linux Enterprise Server 10 SP3
        Vulnerability Type:     remote denial of service
        CVSS v2 Base Score:     7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
        SUSE Default Package:   yes
        Cross-References:       CVE-2010-2226, CVE-2010-2248, CVE-2010-2942
                                CVE-2010-2946, CVE-2010-3067, CVE-2010-3086
                                CVE-2010-3310, CVE-2010-3437, CVE-2010-3442
                                CVE-2010-4072, CVE-2010-4073, CVE-2010-4078
                                CVE-2010-4080, CVE-2010-4081, CVE-2010-4083
                                CVE-2010-4157, CVE-2010-4158, CVE-2010-4162
                                CVE-2010-4164

    Content of This Advisory:
        1) Security Vulnerability Resolved:
             Linux kernel security update
           Problem Description
        2) Solution or Work-Around
        3) Special Instructions and Notes
        4) Package Location and Checksums
        5) Pending Vulnerabilities, Solutions, and Work-Arounds:
            See SUSE Security Summary Report.
        6) Authenticity Verification and Additional Information

______________________________________________________________________________

1) Problem Description and Brief Discussion

   This kernel update for the SUSE Linux Enterprise 10 SP3 kernel fixes
   several security issues and bugs.

   Following security issues were fixed:
   CVE-2010-3442: Multiple integer overflows in the snd_ctl_new
   function in sound/core/control.c in the Linux kernel before
   2.6.36-rc5-next-20100929 allow local users to cause a denial of
   service (heap memory corruption) or possibly have unspecified
   other impact via a crafted (1) SNDRV_CTL_IOCTL_ELEM_ADD or (2)
   SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl call.

   CVE-2010-3437: Integer signedness error in the pkt_find_dev_from_minor
   function in drivers/block/pktcdvd.c in the Linux kernel before
   2.6.36-rc6 allows local users to obtain sensitive information from
   kernel memory or cause a denial of service (invalid pointer dereference
   and system crash) via a crafted index value in a PKT_CTRL_CMD_STATUS
   ioctl call.

   CVE-2010-4078: Uninitialized stack memory disclosure in the
   FBIOGET_VBLANK ioctl in the sis and ivtv drivers could leak kernel
   memory to userspace.

   CVE-2010-4080 / CVE-2010-4081: Uninitialized stack memory disclosure
   in the rme9652 ALSA driver could leak kernel memory to userspace.

   CVE-2010-4073 / CVE-2010-4072 / CVE-2010-4083: Uninitialized stack
   memory disclosure in the SystemV IPC handling functions could leak
   kernel memory to userspace.

   CVE-2010-3067: Integer overflow in the do_io_submit function in
   fs/aio.c in the Linux kernel allowed local users to cause a denial
   of service or possibly have unspecified other impact via crafted use
   of the io_submit system call.

   CVE-2010-3310: Multiple integer signedness errors in net/rose/af_rose.c
   in the Linux kernel allowed local users to cause a denial of service
   (heap memory corruption) or possibly have unspecified other impact
   via a rose_getname function call, related to the rose_bind and
   rose_connect functions.

   CVE-2010-2226: The xfs_swapext function in fs/xfs/xfs_dfrag.c in the
   Linux kernel did not properly check the file descriptors passed to
   the SWAPEXT ioctl, which allowed local users to leverage write access
   and obtain read access by swapping one file into another file.

   CVE-2010-2946: fs/jfs/xattr.c in the Linux kernel did not properly
   handle a certain legacy format for storage of extended attributes,
   which might have allowed local users by bypass intended xattr namespace
   restrictions via an "os2." substring at the beginning of a name.

   CVE-2010-2942: The actions implementation in the network queuing
   functionality in the Linux kernel did not properly initialize
   certain structure members when performing dump operations, which
   allowed local users to obtain potentially sensitive information
   from kernel memory via vectors related to (1) the tcf_gact_dump
   function in net/sched/act_gact.c, (2) the tcf_mirred_dump
   function in net/sched/act_mirred.c, (3) the tcf_nat_dump function
   in net/sched/act_nat.c, (4) the tcf_simp_dump function in
   net/sched/act_simple.c, and (5) the tcf_skbedit_dump function in
   net/sched/act_skbedit.c.

   CVE-2010-2248: fs/cifs/cifssmb.c in the CIFS implementation in the
   Linux kernel allowed remote attackers to cause a denial of service
   (panic) via an SMB response packet with an invalid CountHigh value,
   as demonstrated by a response from an OS/2 server, related to the
   CIFSSMBWrite and CIFSSMBWrite2 functions.

   CVE-2010-4157: A 32bit vs 64bit integer mismatch in gdth_ioctl_alloc
   could lead to memory corruption in the GDTH driver.

   CVE-2010-4164: A remote (or local) attacker communicating over X.25
   could cause a kernel panic by attempting to negotiate malformed
   facilities.

   CVE-2010-3086: A missing lock prefix in the x86 futex code could be
   used by local attackers to cause a denial of service.

   CVE-2010-4158: A memory information leak in Berkley packet filter
   rules allowed local attackers to read uninitialized memory of the
   kernel stack.

   CVE-2010-4162: A local denial of service in the blockdevice layer
   was fixed.

2) Solution or Work-Around

   There is no known workaround, please install the update packages.

3) Special Instructions and Notes

   Please reboot the machine after installing the update.

4) Package Location and Checksums

   The preferred method for installing security updates is to use the YaST
   "Online Update" module or the "zypper" commandline tool. The package and
   patch management stack will detect which updates are required and
   automatically perform the necessary steps to verify and install them.

   Alternatively, download the update packages for your distribution manually
   and verify their integrity by the methods listed in Section 6 of this
   announcement. Then install the packages using the command

     rpm -Fhv 

   to apply the update, replacing  with the filename of the
   downloaded RPM package.

   Our maintenance customers are notified individually. The packages are
   offered for installation from the maintenance web:

   SUSE Linux Enterprise Desktop 10 SP3 for AMD64 and Intel EM64T
     http://download.novell.com/patch/finder/?keywordsg4eb707cae3a31be66788e116641a9a

   SUSE Linux Enterprise Server 10 SP3
     http://download.novell.com/patch/finder/?keywordsg4eb707cae3a31be66788e116641a9a
     http://download.novell.com/patch/finder/?keywords‹c9a9f71e0364816351d414eb3c9832
     http://download.novell.com/patch/finder/?keywordsÁ2e832d9f0b5b30c9d4e408ab99b34d
     http://download.novell.com/patch/finder/?keywordsz6102f48e04658e517624d16e7806bc
     http://download.novell.com/patch/finder/?keywords-433ce13217ec9e95c2b22bce28b8ed

   SLE SDK 10 SP3
     http://download.novell.com/patch/finder/?keywordsg4eb707cae3a31be66788e116641a9a
     http://download.novell.com/patch/finder/?keywordsÁ2e832d9f0b5b30c9d4e408ab99b34d
     http://download.novell.com/patch/finder/?keywordsz6102f48e04658e517624d16e7806bc
     http://download.novell.com/patch/finder/?keywords-433ce13217ec9e95c2b22bce28b8ed

   SUSE Linux Enterprise Desktop 10 SP3
     http://download.novell.com/patch/finder/?keywordsg4eb707cae3a31be66788e116641a9a
     http://download.novell.com/patch/finder/?keywords-433ce13217ec9e95c2b22bce28b8ed

   SUSE Linux Enterprise Desktop 10 SP3 for x86
     http://download.novell.com/patch/finder/?keywords-433ce13217ec9e95c2b22bce28b8ed

______________________________________________________________________________

5) Pending Vulnerabilities, Solutions, and Work-Arounds:

   See SUSE Security Summary Report.
______________________________________________________________________________

6) Authenticity Verification and Additional Information

  - Announcement authenticity verification:

    SUSE security announcements are published via mailing lists and on Web
    sites. The authenticity and integrity of a SUSE security announcement is
    guaranteed by a cryptographic signature in each announcement. All SUSE
    security announcements are published with a valid signature.

    To verify the signature of the announcement, save it as text into a file
    and run the command

      gpg --verify 

    replacing  with the name of the file where you saved the
    announcement. The output for a valid signature looks like:

      gpg: Signature made  using RSA key ID 3D25D3D9
      gpg: Good signature from "SuSE Security Team "

    where  is replaced by the date the document was signed.

    If the security team's key is not contained in your key ring, you can
    import it from the first installation CD. To import the key, use the
    command

      gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc

  - Package authenticity verification:

    SUSE update packages are available on many mirror FTP servers all over the
    world. While this service is considered valuable and important to the free
    and open source software community, the authenticity and the integrity of
    a package needs to be verified to ensure that it has not been tampered
    with.

    The internal rpm package signatures provide an easy way to verify the
    authenticity of an RPM package. Use the command

     rpm -v --checksig 

    to verify the signature of the package, replacing  with the
    filename of the RPM package downloaded. The package is unmodified if it
    contains a valid signature from build@suse.de with the key ID 9C800ACA.

    This key is automatically imported into the RPM database (on
    RPMv4-based distributions) and the gpg key ring of 'root' during
    installation. You can also find it on the first installation CD and at
    the end of this announcement.

  - SUSE runs two security mailing lists to which any interested party may
    subscribe:

    opensuse-security@opensuse.org
        -   General Linux and SUSE security discussion.
            All SUSE security announcements are sent to this list.
            To subscribe, send an e-mail to
                .

    opensuse-security-announce@opensuse.org
        -   SUSE's announce-only mailing list.
            Only SUSE's security announcements are sent to this list.
            To subscribe, send an e-mail to
                .

    =====================================================================
    SUSE's security contact is  or .
    The  public key is listed below.
    =====================================================================
______________________________________________________________________________

    The information in this advisory may be distributed or reproduced,
    provided that the advisory is not modified in any way. In particular, the
    clear text signature should show proof of the authenticity of the text.

    SUSE Linux Products GmbH provides no warranties of any kind whatsoever
    with respect to the information contained in this security advisory.

Type Bits/KeyID     Date       User ID
pub  2048R/3D25D3D9 1999-03-06 SuSE Security Team 
pub  1024D/9C800ACA 2000-10-19 SuSE Package Signing Key 
======================================================================

          =========================================================
          Les serveurs de référence du CERT-Renater
          http://www.urec.fr/securite
          http://www.cru.fr/securite
          http://www.renater.fr
          =========================================================
          + CERT-RENATER          | tel : 01-53-94-20-44          +
          + 23 - 25 Rue Daviel    | fax : 01-53-94-20-41          +
          + 75013 Paris           | email: certsvp@renater.fr     +
          =========================================================