Stay Secure with the Latest Linux Advisories

security advisorydenial of serviceinformation disclosure

Ubuntu 10.04 LTS: USN-1876-1 Moderate: Multiple Kernel Leaks

Several security issues were fixed in the kernel.. =========================================================================Ubuntu Security Notice USN-1876-1 June 14, 2013 linux vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 10.04 LTS Summary: Several security issues were fixed in the kernel. Software Description: - linux: Linux kernel Details: Andrew Honig reported a flaw in the way KVM (Kernel-based Virtual Machine) emulated the IOAPIC. A privileged guest user could exploit this flaw to read host memory or cause a denial of service (crash the host). (CVE-2013-1798) An information leak was discovered in the Linux kernel's rcvmsg path for ATM (Asynchronous Transfer Mode). A local user could exploit this flaw to examine potentially sensitive information from the kernel's stack memory. (CVE-2013-3222) An information leak was discovered in the Linux kernel's recvmsg path for ax25 address family. A local user could exploit this flaw to examine potentially sensitive information from the kernel's stack memory. (CVE-2013-3223) An information leak was discovered in the Linux kernel's recvmsg path for the bluetooth address family. A local user could exploit this flaw to examine potentially sensitive information from the kernel's stack memory. (CVE-2013-3224) An information leak was discovered in the Linux kernel's bluetooth rfcomm protocol support. A local user could exploit this flaw to examine potentially sensitive information from the kernel's stack memory. (CVE-2013-3225) An information leak was discovered in the Linux kernel's IRDA (infrared) support subsystem. A local user could exploit this flaw to examine potentially sensitive information from the kernel's stack memory. (CVE-2013-3228) An information leak was discovered in the Linux kernel's s390 - z/VM support. A local user could exploit this flaw to examinepotentially sensitive information from the kernel's stack memory. (CVE-2013-3229) An information leak was discovered in the Linux kernel's llc (Logical Link Layer 2) support. A local user could exploit this flaw to examine potentially sensitive information from the kernel's stack memory. (CVE-2013-3231) An information leak was discovered in the Linux kernel's receive message handling for the netrom address family. A local user could exploit this flaw to obtain sensitive information from the kernel's stack memory. (CVE-2013-3232) An information leak was discovered in the Linux kernel's Rose X.25 protocol layer. A local user could exploit this flaw to examine potentially sensitive information from the kernel's stack memory. (CVE-2013-3234) An information leak was discovered in the Linux kernel's TIPC (Transparent Inter Process Communication) protocol implementation. A local user could exploit this flaw to examine potentially sensitive information from the kernel's stack memory. (CVE-2013-3235) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 10.04 LTS: linux-image-2.6.32-48-386 2.6.32-48.110 linux-image-2.6.32-48-generic 2.6.32-48.110 linux-image-2.6.32-48-generic-pae 2.6.32-48.110 linux-image-2.6.32-48-ia64 2.6.32-48.110 linux-image-2.6.32-48-lpia 2.6.32-48.110 linux-image-2.6.32-48-powerpc 2.6.32-48.110 linux-image-2.6.32-48-powerpc-smp 2.6.32-48.110 linux-image-2.6.32-48-powerpc64-smp 2.6.32-48.110 linux-image-2.6.32-48-preempt 2.6.32-48.110 linux-image-2.6.32-48-server 2.6.32-48.110 linux-image-2.6.32-48-sparc64 2.6.32-48.110 linux-image-2.6.32-48-sparc64-smp 2.6.32-48.110 linux-image-2.6.32-48-versatile 2.6.32-48.110 linux-image-2.6.32-48-virtual 2.6.32-48.110 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updateshave been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. If you use linux-restricted-modules, you have to update that package as well to get modules which work with the new kernel version. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-server, linux-powerpc), a standard system upgrade will automatically perform this as well. References: https://ubuntu.com/security/notices/USN-1876-1 CVE-2013-1798, CVE-2013-3222, CVE-2013-3223, CVE-2013-3224, CVE-2013-3225, CVE-2013-3228, CVE-2013-3229, CVE-2013-3231, CVE-2013-3232, CVE-2013-3234, CVE-2013-3235 Package Information: https://launchpad.net/ubuntu/+source/linux/2.6.32-48.110 . Critical kernel vulnerabilities resolved with essential upgrade details for Ubuntu 10.04 LTS users.. Kernel Security, Ubuntu 10.04 LTS Update, Information Disclosure. . Severity: Important. LinuxSecurity.com Team

Jun 14, 2013 •Important Ubuntu