Rapid7 Vulnerability & Exploit Database

RHSA-2003:198: kernel security update

Back to Search

RHSA-2003:198: kernel security update

Severity
8
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Published
08/27/2003
Created
07/25/2018
Added
10/28/2005
Modified
06/21/2018

Description

Updated kernel packages that address several security vulnerabilites are now available for the IA64 architecture. [Updated 28 August 2003] Changed the CVE name listed in description from the incorrect CAN-2002-0247 to CAN-2003-0247

The Linux kernel handles the basic functions of the operating system. Al Viro found a security issue in the tty layer in which any user could cause a kernel oops. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0247 to this issue. A vulnerability in the kernel's TCP/IP fragment reassembly handling allows remote attackers to cause a denial of service (CPU consumption) via packets that cause a large number of hash table collisions. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0364 to this issue. Paul Starzetz discovered a file read race condition in the execve() system call, which could cause a local crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0462 to this issue. The /proc file system under Linux allows local users to obtain sensitive information by opening various entries in /proc/self before executing a setuid program. This causes the program to fail to change the ownership and permissions of already-opened entries. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0501 to this issue. The STP protocol is known to have no security, which could allow attackers to alter the bridge topology. STP is now turned off by default. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0550 to this issue. The STP input processing is lax in its length checking, which could lead to a denial of service (DoS). The kernel contained in this erratum improves STP input processing. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0551 to this issue. Jerry Kreuscher discovered that the Forwarding table could be spoofed by sending forged packets with bogus source addresses that are the same as the local host. The Common Vulnerabilities and Exposures project cve.mitre.org) has assigned the name CAN-2003-0552 to this issue. An integer signedness error in the decode_fh function of nfs3xdr.c allows remote attackers to cause a denial of service (kernel panic) via a negative size value within XDR data of an NFSv3 procedure call. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0619 to this issue. The C-Media PCI sound driver in unpatched kernel versions prior to 2.4.21 accesses userspace without using the get_user function, which is a potential security hole. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0699 to this issue. In addition, a number of bugfixes and updates have been applied to the IA32 emulation layer. All users should upgrade to these errata packages, which contain patches to the 2.4.18 kernel that address these issues.

Solution(s)

  • redhat-upgrade-kernel
  • redhat-upgrade-kernel-doc
  • redhat-upgrade-kernel-smp
  • redhat-upgrade-kernel-source

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;