SuSE: Weekly Summary 2008:025
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
______________________________________________________________________________
SUSE Security Summary Report
Announcement ID: SUSE-SR:2008:025
Date: Fri, 14 Nov 2008 15:00:00 +0000
Cross-References: CVE-2007-4324, CVE-2007-6243, CVE-2007-6716
CVE-2008-1673, CVE-2008-2812, CVE-2008-2931
CVE-2008-3272, CVE-2008-3525, CVE-2008-3527
CVE-2008-3528, CVE-2008-3651, CVE-2008-3652
CVE-2008-3833, CVE-2008-3873, CVE-2008-3963
CVE-2008-4097, CVE-2008-4098, CVE-2008-4210
CVE-2008-4302, CVE-2008-4401, CVE-2008-4503
CVE-2008-4546, CVE-2008-4576
Content of this advisory:
1) Solved Security Vulnerabilities:
- apache2
- ipsec-tools
- kernel-bigsmp
- flash-player
- mysql
- ktorrent
2) Pending Vulnerabilities, Solutions, and Work-Arounds:
none
3) Authenticity Verification and Additional Information
______________________________________________________________________________
1) Solved Security Vulnerabilities
To avoid flooding mailing lists with SUSE Security Announcements for minor
issues, SUSE Security releases weekly summary reports for the low profile
vulnerability fixes. The SUSE Security Summary Reports do not list or
download URLs like the SUSE Security Announcements that are released for
more severe vulnerabilities.
Fixed packages for the following incidents are already available on our FTP
server and via the YaST Online Update.
- apache2
The security update of apache2 released at 2008/11/05 packages its modules
differently (/usr/lib/apache2-prefork vs. /usr/lib/apache2-worker). This
can, in seldom cases, cause a services (like iPrint) stop working if it
expects the modules in a special directory.
New packages will be released as soon as possible.
- ipsec-tools
Remote attackers could exploit memory leaks in the 'racoon' daemon
to crash it (CVE-2008-3651, CVE-2008-3652)
Affected products: all
- kernel-bigsmp
This kernel update fixes various bugs and also several security issues:
CVE-2008-4576: Fixed a crash in SCTP INIT-ACK, on mismatch between SCTP
AUTH availability. This might be exploited remotely for a denial of
service (crash) attack.
CVE-2008-3833: The generic_file_splice_write function in fs/splice.c
in the Linux kernel does not properly strip setuid and setgid bits
when there is a write to a file, which allows local users to gain the
privileges of a different group, and obtain sensitive information or
possibly have unspecified other impact, by splicing into an inode in
order to create an executable file in a setgid directory.
CVE-2008-4210: fs/open.c in the Linux kernel before 2.6.22 does not
properly strip setuid and setgid bits when there is a write to a file,
which allows local users to gain the privileges of a different group, and
obtain sensitive information or possibly have unspecified other impact,
by creating an executable file in a setgid directory through the (1)
truncate or (2) ftruncate function in conjunction with memory-mapped I/O.
CVE-2008-4302: fs/splice.c in the splice subsystem in the Linux
kernel before 2.6.22.2 does not properly handle a failure of the
add_to_page_cache_lru function, and subsequently attempts to unlock a page
that was not locked, which allows local users to cause a denial of service
(kernel BUG and system crash), as demonstrated by the fio I/O tool.
CVE-2008-3528: The ext[234] filesystem code fails to properly handle
corrupted data structures. With a mounted filesystem image or partition
that have corrupted dir->i_size and dir->i_blocks, a user performing
either a read or write operation on the mounted image or partition can
lead to a possible denial of service by spamming the logfile.
CVE-2007-6716: fs/direct-io.c in the dio subsystem in the Linux kernel
did not properly zero out the dio struct, which allows local users to
cause a denial of service (OOPS), as demonstrated by a certain fio test.
CVE-2008-3525: Added missing capability checks in sbni_ioctl().
CVE-2008-3272: Fixed range checking in the snd_seq OSS ioctl, which
could be used to leak information from the kernel.
CVE-2008-2931: The do_change_type function in fs/namespace.c did not
verify that the caller has the CAP_SYS_ADMIN capability, which allows
local users to gain privileges or cause a denial of service by modifying
the properties of a mountpoint.
CVE-2008-2812: Various NULL ptr checks have been added to tty op
functions, which might have been used by local attackers to execute
code. We think that this affects only devices openable by root, so the
impact is limited.
CVE-2008-1673: Added range checking in ASN.1 handling for the CIFS and
SNMP NAT netfilter modules.
CVE-2008-3527: arch/i386/kernel/sysenter.c in the Virtual Dynamic Shared
Objects (vDSO) implementation in the Linux kernel before 2.6.21 did not
properly check boundaries, which allows local users to gain privileges
or cause a denial of service via unspecified vectors, related to the
install_special_mapping, syscall, and syscall32_nopage functions.
Affected products: openSUSE 10.2
- flash-player
This update of flash-player fixes several critical security vulner-
abilities that couls lead to remote system compromise.
(CVE-2007-6243, CVE-2008-3873, CVE-2007-4324, CVE-2008-4401,
CVE-2008-4503, CVE-2008-4546)
Affected products: openSUSE 10.2-11.0, Novell Linux Desktop 9,
SLED 10 SP1 and SP2
- mysql
Empty bit-strings in a query could crash the MySQL server (CVE-2008-3963).
Due to another flaw users could access tables of other users (CVE-2008-
4097, CVE-2008-4098).
Affected products: all (so far only released for SLES10, others will
follow)
- ktorrent
This update of ktorrent fixes several security issues.
Affected products: openSUSE 10.3-11.0
______________________________________________________________________________
2) Pending Vulnerabilities, Solutions, and Work-Arounds
none
______________________________________________________________________________
3) Authenticity Verification and Additional Information
- Announcement authenticity verification:
SUSE security announcements are published via mailing lists and on Web
sites. The authenticity and integrity of a SUSE security announcement is
guaranteed by a cryptographic signature in each announcement. All SUSE
security announcements are published with a valid signature.
To verify the signature of the announcement, save it as text into a file
and run the command
gpg --verify
References
![Dist Suse](/images/distros/dist-suse.gif)