Linux Kernel Validation Flaw in sctp_getsockopt_hmac_ident() Lets Local Users Obtain Potentially Sensitive Information
|
|
SecurityTracker Alert ID: 1021000
|
|
SecurityTracker URL: http://securitytracker.com/id?1021000
|
|
CVE Reference: CVE-2008-4113
(Links to External Site)
|
Date: Oct 8 2008
|
Impact: Disclosure of system information, Disclosure of user information
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 2.6 prior to 2.6.26.4
|
Description: A vulnerability was reported in the Linux Kernel. A local user can obtain potentially sensitive information.
A local user can issue a specially crafted SCTP_HMAC_IDENT IOCTL request when the SCTP-AUTH extension is enabled to obtain potentially sensitive information.
The vulnerability resides in 'net/sctp/socket.c'.
|
Impact: A local user can obtain potentially sensitive information.
|
Solution: The vendor has issued a fix (2.6.26.4).
The vendor's advisory is available at:
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.26.4
|
Vendor URL: www.kernel.org/ (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Caldera/SCO), Linux (Conectiva), Linux (Debian), Linux (EnGarde), Linux (Gentoo), Linux (HP Secure OS), Linux (Immunix), Linux (Mandriva/Mandrake), Linux (Progeny Debian), Linux (Red Hat Enterprise), Linux (Red Hat Fedora), Linux (Red Hat Linux), Linux (SGI), Linux (Slackware), Linux (Sun), Linux (SuSE), Linux (Trustix), Linux (Turbo Linux), Linux (Ubuntu), Linux (Xandros)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
|
|
[Original Message Not Available for Viewing]
|
|
