PT-2004-3722 · Linux · Aa-Sources+7

Paul Starzetz + 1 · Publicado 1970-01-01 · Atualizado 2024-01-26 · CVE-2004-0427

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.4.26 Linux kernel versions prior to 2.6.6 aa-sources versions prior to 2.4.23-r2 kernel-image-2.4.18-powerpc-xfs version kernel-image-2.4.18-sun4u version kernel-image-2.4.18-sun4u-smp version kernel-image-2.4.19-sparc version kernel-image-2.4.19-sun4u version kernel-image-2.4.19-sun4u-smp version kernel-headers-2.4.18-sparc version kernel-headers-2.4.19-sparc version

Description The issue is related to multiple vulnerabilities in the Linux kernel, which can lead to a disruption of confidentiality, integrity, and availability of protected information. Exploitation of these vulnerabilities can be done remotely or locally, depending on the specific vulnerability. The do fork function in Linux 2.4.x and 2.6.x does not properly decrement the mm count counter when an error occurs after the mm struct for a child process has been activated, triggering a memory leak that allows local users to cause a denial of service via the clone system call.

Recommendations For Linux kernel versions prior to 2.4.26, update to version 2.4.26 or later. For Linux kernel versions prior to 2.6.6, update to version 2.6.6 or later. For aa-sources versions prior to 2.4.23-r2, update to version 2.4.23-r2 or later. For kernel-image-2.4.18-powerpc-xfs, kernel-image-2.4.18-sun4u, kernel-image-2.4.18-sun4u-smp, kernel-image-2.4.19-sparc, kernel-image-2.4.19-sun4u, kernel-image-2.4.19-sun4u-smp, kernel-headers-2.4.18-sparc, and kernel-headers-2.4.19-sparc, update to a non-vulnerable version. As a temporary workaround, consider restricting access to the clone system call to minimize the risk of exploitation.

Correção

Memory Leak

Enumeração de Fraquezas

CWE-401

Identificadores relacionados

BDU:2015-03380

BDU:2015-03381

BDU:2015-03382

BDU:2015-03383

BDU:2015-03384

BDU:2015-03385

BDU:2015-03576

BDU:2015-03577

BDU:2015-09455

CVE-2004-0427

DSA-1067-1

DSA-1069-1

DSA-1070-1

DSA-1082-1

RHSA-2004:255

Produtos afetados

Linux Kernel

Aa-Sources

Kernel-Headers-2.4.18-Sparc

Kernel-Headers-2.4.19-Sparc

Kernel-Image-2.4.18-Powerpc-Xfs

Kernel-Image-2.4.18-Sun4U

Kernel-Image-2.4.19-Sparc

Kernel-Image-2.4.19-Sun4U

Referências · 77

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0138 · Nota de Segurança
• http://security.gentoo.org/glsa/glsa-200407-02.xml · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-03576 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0997 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-03384 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1072 · Nota de Segurança
• http://mandriva.com/security/advisories?name=MDKSA-2004:037 · Aviso do Fabricante
• http://debian.org/security/2006/dsa-1069 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1070 · Nota de Segurança
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000846 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0001 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1234 · Nota de Segurança
• http://secunia.com/advisories/20163 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1073 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0003 · Nota de Segurança