Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 496
Alerts This Week
Warning Icon 1 496

Ubuntu 10.04 LTS USN-2375-1 Critical: Kernel Denial of Service Issues

ubuntu
Calendar Grey October 9, 2014
Scroller Ubuntu
Ubuntu Security Notice USN-2376-1 concerns severe kernel flaws necessitating prompt updates.
Several security issues were fixed in the kernel.

Summary

Several security issues were fixed in the kernel.

Software Description:

- linux-ec2: Linux kernel for EC2

Details:

Ben Hawkes reported some off by one errors for report descriptors in the

Linux kernel's HID stack. A physically proximate attacker could exploit

these flaws to cause a denial of service (out-of-bounds write) via a

specially crafted device. (CVE-2014-3184)

Several bounds check flaws allowing for buffer overflows were discovered in

the Linux kernel's Whiteheat USB serial driver. A physically proximate

attacker could exploit these flaws to cause a denial of service (system

crash) via a specially crafted device. (CVE-2014-3185)

A flaw was discovered in the Linux kernel's UDF filesystem (used on some

CD-ROMs and DVDs) when processing indirect ICBs. An attacker who can cause

CD, DVD or image file with a specially crafted inode to be mounted can

cause a denial of service (infinite loop or stack consumption).

(CVE-2014-6410)

Topics%20covered

Topics Covered

security advisory denial of service critical Ubuntu kernel system update linux-ec2

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 10.04 LTS:
  linux-image-2.6.32-371-ec2      2.6.32-371.87

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.

References

https://ubuntu.com/security/notices/USN-2375-1

CVE-2014-3184, CVE-2014-3185, CVE-2014-6410

Severity
critical
Lowest
Low
Medium
High
Critical

October 09, 2014

Topics%20covered

Topics Covered

security advisory denial of service critical Ubuntu kernel system update linux-ec2

Package Information

https://launchpad.net/ubuntu/+source/linux-ec2/2.6.32-371.87

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.