AusCERT - ESB-2004.0812 -- Linux kernel IGMP vulnerabilities

HOME
About AusCERT
Membership
PKI Services
Training
Publications
Sec. Bulletins
Conferences
News & Media
Services
Web Log
Site Map
Site Help
Member login
ESB-2004.0812 -- Linux kernel IGMP vulnerabilities
Date: 22 December 2004
References: ESB-2004.0822 ESB-2005.0169

Click here for printable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

            ESB-2004.0812 -- Linux kernel IGMP vulnerabilities
                             22 December 2004

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Linux kernel 2.4 version 2.4.28 and prior
                   Linux kernel 2.6 version 2.6.9 and prior
Operating System:  Linux variants
Impact:            Root Compromise
                   Access Confidential Data
                   Denial of Service
Access:            Existing Account
                   Remote/Unauthenticated
CVE Names:         CAN-2004-1137

- --------------------------BEGIN INCLUDED TEXT--------------------

PROBLEM:  

	Two vulnerabilities in the IGMP (Internet Group Management Protocol) 
	code in the Linux kernel allow local privillege elevation and remote
	denial of service under conditions described below.

	1. The ip_mc_source() function is part of the user API for IGMP. Due to
	   an incorrectly validated parameter, a program running as an 
	   unprivelleged user is able to overwrite kernel memory.

	2. When an IGMP group query packet is accepted from the network, its 
           contents are not validated properly, allowing a malformed packet to
	   cause remote denial of service.


VERSIONS:

	2.6 kernel versions 2.6.9 and prior are vulnerable.
	2.4 kernel versions 2.4.28 and prior are also vulnerable.
	2.2.x kernels are not vulnerable.


IMPACT:

	1. On SMP systems, this vulnerability allows executing arbitrary code 
	   in kernel mode, allowing root compromise. 

	   On non-SMP systems this is most likely not possible, so the impact
	   is limited to local denial of service.

	   This vulnerability in conjunction with the ip_mc_?sfget() functions 
           also allows reading of blocks of kernel memory, which may contain 
           sensitive information such as passwords.

	2. The second vulnerability allows remote denial of service, if some 
           application on the system is using a multicast socket.
           If the files /proc/net/igmp and /proc/net/mcfilter both exist and
           are non-empty, then the system is vulnerable to this second 
	   vulnerability.

	More information is available in the original advisory. [1]


MITIGATION: 

	No official patch is yet available for this vulnerability. 

	Until a patch is available, AusCERT recommends that system 
        administrators restrict logon access to vulnerable systems, and 
        consider adding a firewall rule to block inbound IGMP packets
	(IP protocol number 2).


REFERENCES:
	
	[1] Linux kernel IGMP vulnerabilities
	    http://isec.pl/vulnerabilities/isec-0018-igmp.txt


- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBQcj7bSh9+71yA2DNAQKRCQP/cH6+EJUzXWd9OLQuOXmsnsIHTdWX5tdb
bmJjjbkwSnikNd2RGmNR0N6BuEyDaHjXB/vbHHBOIJX/8JC2GZFWF5GHUvd42G12
7FU9XJzh+iJnR1EAmHZ5bJHnRlsr0U0zagTK5Q7pcWXCJ7f/8CRmg3BScKkj5Tz5
8QWZvyZAlcE=
=cl2F
-----END PGP SIGNATURE-----