Debian Security Advisory DSA 1289-1 (linux-2.6)

Published: 2008-01-17 22:17:11
CVE Author: NIST National Vulnerability Database (NVD)

CVSS Base Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N

Recommendations:
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%201289-1

Technical Details:
Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2007-1496 Michal Miroslaw reported a DoS vulnerability (crash) in netfilter. A remote attacker can cause a NULL pointer dereference in the nfnetlink_log function. CVE-2007-1497 Patrick McHardy reported an vulnerability in netfilter that may allow attackers to bypass certain firewall rules. The nfctinfo value of reassembled IPv6 packet fragments were incorrectly initalized to 0 which allowed these packets to become tracked as ESTABLISHED. CVE-2007-1861 Jaco Kroon reported a bug in which NETLINK_FIB_LOOKUP Linux Distribution Packages were incorrectly routed back to the kernel resulting in an infinite recursion condition. Local users can exploit this behavior to cause a DoS (crash). This problem has been fixed in the stable distribution in version 2.6.18.dfsg.1-12etch2. The following matrix lists additional Linux Distribution Packages that were rebuilt for compatibility with or to take advantage of this update: Debian 4.0 (etch) fai-kernels 1.17+etch2 user-mode-linux 2.6.18-1um-2etch2 kernel-patch-openvz 028.18.1etch1 We recommend that you upgrade your kernel Linux Distribution Package immediately and reboot

Summary:
The remote host is missing an update to linux-2.6 announced via advisory DSA 1289-1.

Detection Type:
Linux Distribution Package

Solution Type:
Vendor Patch

NIST (National Institute of Standards and Technology) NVD (National Vulnerability Database)

https://nvd.nist.gov/vuln/detail/CVE-2007-1496
https://nvd.nist.gov/vuln/detail/CVE-2007-1497
https://nvd.nist.gov/vuln/detail/CVE-2007-1861

Search
Severity
Medium
CVSS Score
5.0

You never have to pay for a vulnerability scanning and management software again.

Tired of paying a subscription 'per asset' or 'per IP'? Well you can officially cancel your current subscription. Mageni provides a free, open source and enterprise-ready vulnerability scanning and management platform which helps you to find, prioritize, remediate and manage your vulnerabilities. It is free and always will be.