SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |    Help    |   

SecurityTracker
Archives


Your Ad Here
 
Click to Sign Up
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com
Sign Up!





Category:  OS (Linux)  >  Linux Kernel Vendors:  kernel.org
Linux Kernel SCTP-AUTH API Bugs Let Local Users Obtain Information and Deny Service
SecurityTracker Alert ID:  1020854
SecurityTracker URL:  http://securitytracker.com/id?1020854
CVE Reference:  CVE-2008-3792   (Links to External Site)
Date:  Sep 11 2008
Impact:  Denial of service via local system, Disclosure of system information, Disclosure of user information
Fix Available:  Yes   Vendor Confirmed:  Yes  
Version(s): 2.6.26.3 and prior versions
Description:  A vulnerability was reported in the Linux Kernel. A local user can cause denial of service conditions. A local user can obtain potentially sensitive information.

A local user can invoke a specially crafted SCTP_HMAC_IDENT IOCTL call to gain access to potentially sensitive information.

A local user can also invoke specially crafted SCTP-AUTH API commands to trigger several null pointer dereferences and cause a kernel panic.

The vulnerabilities reside in 'net/sctp/socket.c'.

The vendor was notified on August 20, 2008.

Tobias Klein reported this vulnerability.

The original advisory is available at:

http://www.trapkit.de/advisories/TKADV2008-007.txt
Impact:  A local user can cause denial of service conditions on the target system.

A local user can obtain potentially sensitive information.
Solution:  The vendor has issued a fixed version (2.6.26.4).

The vendor's advisory is available at:

http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.26.4
Vendor URL:  www.kernel.org/ (Links to External Site)
Cause:  Access control error, State error
Underlying OS:  Linux (Caldera/SCO), Linux (Conectiva), Linux (Debian), Linux (EnGarde), Linux (Gentoo), Linux (HP Secure OS), Linux (Immunix), Linux (Mandriva/Mandrake), Linux (Progeny Debian), Linux (Red Hat Enterprise), Linux (Red Hat Fedora), Linux (Red Hat Linux), Linux (SGI), Linux (Slackware), Linux (Sun), Linux (SuSE), Linux (Trustix), Linux (Turbo Linux), Linux (Ubuntu), Linux (Xandros)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Oct 8 2008 (Red Hat Issues Fix) Linux Kernel SCTP-AUTH API Bugs Let Local Users Obtain Information and Deny Service   (bugzilla@redhat.com)
Red Hat has released a fix for Red Hat Enterprise MRG.


 Source Message Contents
Date:  Thu, 11 Sep 2008 08:17:08 -0400
Subject:  Linux Kernel

 
 
http://www.trapkit.de/advisories/TKADV2008-007.txt
 
CVE-2008-3792


Go to the Top of This SecurityTracker Archive Page



Home   |    View Topics   |    Search   |    Contact Us   |    Help

Copyright 2007, SecurityGlobal.net LLC