PT-2004-3738 · Linux+2 · Linux Kernel+2

Publicado 1970-01-01 · Atualizado 2017-10-11 · CVE-2004-1235

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions 2.4 through 2.4.29-rc2 Linux kernel versions 2.6 through 2.6.10 Debian GNU/Linux kernel-image-2.4.18-powerpc-xfs version Debian GNU/Linux kernel-image-2.4.18-sun4u version Debian GNU/Linux kernel-image-2.4.18-sun4u-smp version Debian GNU/Linux kernel-image-2.4.19-sparc version Debian GNU/Linux kernel-image-2.4.19-sun4u version Debian GNU/Linux kernel-image-2.4.19-sun4u-smp version Debian GNU/Linux kernel-headers-2.4.18-sparc version Debian GNU/Linux kernel-headers-2.4.19-sparc version Debian GNU/Linux kernel-patch-benh version

Description The issue involves multiple vulnerabilities in the Linux kernel and Debian GNU/Linux kernel packages, which can lead to breaches of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. A race condition in the load elf library and binfmt aout function calls for uselib in the Linux kernel allows local users to execute arbitrary code by manipulating the VMA descriptor.

Recommendations For Linux kernel versions 2.4 through 2.4.29-rc2, update to a version outside of this range to resolve the issue. For Linux kernel versions 2.6 through 2.6.10, update to a version outside of this range to resolve the issue. For Debian GNU/Linux kernel-image-2.4.18-powerpc-xfs, kernel-image-2.4.18-sun4u, kernel-image-2.4.18-sun4u-smp, kernel-image-2.4.19-sparc, kernel-image-2.4.19-sun4u, kernel-image-2.4.19-sun4u-smp, kernel-headers-2.4.18-sparc, kernel-headers-2.4.19-sparc, and kernel-patch-benh, update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the vulnerable kernel packages until a patch is available.

Exploit

Correção

Identificadores relacionados

BDU:2015-03380

BDU:2015-03381

BDU:2015-03382

BDU:2015-03383

BDU:2015-03384

BDU:2015-03385

BDU:2015-03576

BDU:2015-03577

CVE-2004-1235

DSA-1067-1

DSA-1069-1

DSA-1070-1

DSA-1082-1

RHSA-2005:043

RHSA-2005:092

RHSA-2005_043

RHSA-2005_092

Produtos afetados

Debian

Linux Kernel

Red Hat

Referências · 89

• 🔥 http://securityfocus.com/bid/12190 · Exploit
• 🔥 https://exploit-db.com/exploits/744 · Exploit
• 🔥 https://exploit-db.com/exploits/778 · Exploit
• 🔥 https://exploit-db.com/exploits/895 · Exploit
• http://redhat.com/support/errata/RHSA-2005-016.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0138 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2004-1235 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18800 · Nota
• https://bdu.fstec.ru/vul/2015-03576 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0997 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-03384 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1072 · Nota de Segurança
• http://redhat.com/support/errata/RHSA-2005-017.html · Aviso do Fabricante
• https://redhat.com/security/data/cve/CVE-2005-0180.html · Nota
• https://redhat.com/security/data/cve/CVE-2005-0179.html · Nota