-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                         ESB-2007.0228 -- [Linux]
                   Multiple Linux kernel vulnerabilities
                               5 April 2007

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              kernel
Publisher:            Mandriva
Operating System:     Linux variants
Impact:               Execute Arbitrary Code/Commands
                      Increased Privileges
                      Inappropriate Access
                      Denial of Service
Access:               Existing Account
CVE Names:            CVE-2007-1592 CVE-2007-1388 CVE-2007-1217
                      CVE-2007-1000 CVE-2007-0958 CVE-2007-0772
                      CVE-2007-0005 CVE-2006-6056 CVE-2004-1073

Ref:                  ESB-2007.0063
                      ESB-2007.0171

Original Bulletin:    
http://www.mandriva.com/security/advisories?name=MDKSA-2007:060

Comment: This advisory references vulnerabilities in the Linux kernel that
         also affect distributions other than Mandriva. It is recommended
         that administrators running Linux check for an updated version of
         the kernel for their system.
         
         Note that one of these DoS vulnerabilities (CVE-2007-0772) is
         remotely exploitable, while all others are local, as per the above
         impact.

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDKSA-2007:078
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : kernel
 Date    : April 4, 2007
 Affected: 2007.0
 _______________________________________________________________________
 
 Problem Description:
 
 Some vulnerabilities were discovered and corrected in the Linux
 2.6 kernel:
 
 When SELinux hooks are enabled, the kernel could allow a local user
 to cause a DoS (crash) via a malformed file stream that triggers a
 NULL pointer derefernece (CVE-2006-6056).
 
 Multiple buffer overflows in the (1) read and (2) write handlers in
 the Omnikey CardMan 4040 driver in the Linux kernel before 2.6.21-rc3
 allow local users to gain privileges. (CVE-2007-0005)
 
 The Linux kernel version 2.6.13 to 2.6.20.1 allowed a remote attacker to
 cause a DoS (oops) via a crafted NFSACL2 ACCESS request that triggered
 a free of an incorrect pointer (CVE-2007-0772).
 
 A local user could read unreadable binaries by using the interpreter
 (PT_INTERP) functionality and triggering a core dump; a variant of
 CVE-2004-1073 (CVE-2007-0958).
 
 The ipv6_getsockopt_sticky function in net/ipv6/ipv6_sockglue.c in the
 Linux kernel before 2.6.20.2 allows local users to read arbitrary
 kernel memory via certain getsockopt calls that trigger a NULL
 dereference. (CVE-2007-1000)
 
 Buffer overflow in the bufprint function in capiutil.c in libcapi,
 as used in Linux kernel 2.6.9 to 2.6.20 and isdn4k-utils, allows local
 users to cause a denial of service (crash) and possibly gain privileges
 via a crafted CAPI packet. (CVE-2007-1217)
 
 The do_ipv6_setsockopt function in net/ipv6/ipv6_sockglue.c in Linux
 kernel 2.6.17, and possibly other versions, allows local users to cause
 a denial of service (oops) by calling setsockopt with the IPV6_RTHDR
 option name and possibly a zero option length or invalid option value,
 which triggers a NULL pointer dereference. (CVE-2007-1388)
 
 net/ipv6/tcp_ipv6.c in Linux kernel 2.4 and 2.6.x up to 2.6.21-rc3
 inadvertently copies the ipv6_fl_socklist from a listening TCP socket
 to child sockets, which allows local users to cause a denial of service
 (OOPS) or double-free by opening a listeing IPv6 socket, attaching a
 flow label, and connecting to that socket. (CVE-2007-1592)
 
 The provided packages are patched to fix these vulnerabilities.
 All users are encouraged to upgrade to these updated kernels immediately
 and reboot to effect the fixes.
 
 In addition to these security fixes, other fixes have been included
 such as:
 
   - Suspend to disk speed improvements
   - Add nmi watchdog support for core2
   - Add atl1 driver
   - Update KVM
   - Add acer_acpi
   - Update asus_acpi
   - Fix suspend on r8169, i8259A
   - Fix suspend when using ondemand governor
   - Add ide acpi support
   - Add suspend/resume support for sata_nv chipsets.
   - USB: Let USB-Serial option driver handle anydata devices (#29066)
   - USB: Add PlayStation 2 Trance Vibrator driver
   - Fix bogus delay loop in video/aty/mach64_ct.c
   - Add MCP61 support (#29398)
   - USB: fix floppy drive SAMSUNG SFD-321U/EP detected 8 times bug
   - Improve keyboard handling on Apple MacBooks
   - Add -latest patch
   - Workaround a possible binutils bug in smp alternatives
   - Add forcedeth support
   - Fix potential deadlock in driver core (USB hangs at boot time
   #24683)
 
 To update your kernel, please follow the directions located at:
 
   http://www.mandriva.com/en/security/kernelupdate
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6056
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0005
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0772
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0958
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1000
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1217
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1388
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1592
 http://qa.mandriva.com/show_bug.cgi?id=29066
 http://qa.mandriva.com/show_bug.cgi?id=29398
 http://qa.mandriva.com/show_bug.cgi?id=24683
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2007.0:
 84459fea8b1b4548fea8864694feb5e9  2007.0/i586/kernel-2.6.17.13mdv-1-1mdv2007.0.i586.rpm
 4f2ae01ccf337c0c538c1e8d4b41bb84  2007.0/i586/kernel-doc-2.6.17.13mdv-1-1mdv2007.0.i586.rpm
 a432c277b621f02670692a83fd9cf4cd  2007.0/i586/kernel-enterprise-2.6.17.13mdv-1-1mdv2007.0.i586.rpm
 f1a62fd01f7b14aef9d55bfe57fb352c  2007.0/i586/kernel-legacy-2.6.17.13mdv-1-1mdv2007.0.i586.rpm
 2a46a4009273f725e6f3ba66073d6186  2007.0/i586/kernel-source-2.6.17.13mdv-1-1mdv2007.0.i586.rpm
 b954cacf1af9775900c0180c66f731b2  2007.0/i586/kernel-source-stripped-2.6.17.13mdv-1-1mdv2007.0.i586.rpm
 750b4e67fe1be3c87802297a7745ab1f  2007.0/i586/kernel-xen0-2.6.17.13mdv-1-1mdv2007.0.i586.rpm
 2d28253eafc9c7dadb116e571dce00d5  2007.0/i586/kernel-xenU-2.6.17.13mdv-1-1mdv2007.0.i586.rpm 
 25f757eb5d57317dc91ddd37f37e8abb  2007.0/SRPMS/kernel-2.6.17.13mdv-1-1mdv2007.0.src.rpm

 Mandriva Linux 2007.0/X86_64:
 e1ca731fc7376199172238e5d92063a4  2007.0/x86_64/kernel-2.6.17.13mdv-1-1mdv2007.0.x86_64.rpm
 8c02b29e58f8fbc6f90693ccc3e0855a  2007.0/x86_64/kernel-doc-2.6.17.13mdv-1-1mdv2007.0.x86_64.rpm
 f0d98a19885831fc0323c8d2dac615db  2007.0/x86_64/kernel-source-2.6.17.13mdv-1-1mdv2007.0.x86_64.rpm
 cc53d2abaf5aaa284cda0327516bc9c5  2007.0/x86_64/kernel-source-stripped-2.6.17.13mdv-1-1mdv2007.0.x86_64.rpm
 77e4a2f83a8ce5b652b2847cac8467ce  2007.0/x86_64/kernel-xen0-2.6.17.13mdv-1-1mdv2007.0.x86_64.rpm
 bbe4780078b5ffd6cf9e47ae6920518f  2007.0/x86_64/kernel-xenU-2.6.17.13mdv-1-1mdv2007.0.x86_64.rpm 
 25f757eb5d57317dc91ddd37f37e8abb  2007.0/SRPMS/kernel-2.6.17.13mdv-1-1mdv2007.0.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQFGE/qkmqjQ0CJFipgRAhFJAKDxW476ewc4Ixk8MAhK0AQFW+RKCQCg4LsO
PC34rll1d2d3D2uKqPw1h+o=
=Fjgh
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRhR1Oyh9+71yA2DNAQLxkQQAi2MWsTVRpR1ER2NmkhpyiXbRuiQKevMp
dFZa5UjxYKLbGqiL0uYYC6oJM+CJyz3rJwP7SVWXn88KgnCq2XUTM8lw4sL1M4ip
lkInr+7biCfgI5mpxrB62ybmCIx+AQcZje6YC0iC8F4x14hWYdrJpx3BGsgAWu++
WkqOZgsYKUc=
=4UBP
-----END PGP SIGNATURE-----