PT-2008-3846 · Linux+1 · Linux Kernel+1

Publicado 2008-06-10 · Atualizado 2017-09-29 · CVE-2008-2358

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Linux kernel versions 2.6.17 through 2.6.20 Linux kernel version 2.6.18

Description: The issue is related to an integer overflow in the dccp feat change function, which can lead to a heap-based buffer overflow. This allows local users to gain privileges via an invalid feature length.

Recommendations: For Linux kernel versions 2.6.17 through 2.6.20, consider upgrading to a version that contains a fix for this issue. For Linux kernel version 2.6.18, consider upgrading to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2008-2358

DSA-1592-1

RHSA-2008:0519

RHSA-2008_0519

Produtos afetados

Linux Kernel

Red Hat

Referências · 23

• http://mandriva.com/security/advisories?name=MDVSA-2008:112 · Aviso do Fabricante
• http://secunia.com/advisories/30920 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00006.html · Aviso do Fabricante
• http://ubuntu.com/usn/usn-625-1 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2008-2729 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-2358 · Nota de Segurança
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=3022d734a54cbd2b65eea9a024564821101b4a9a;hp=f0f4c3432e5e1087b3a8c0e6bd4113d3c37497ff · Nota
• http://securitytracker.com/id?1020211 · Nota
• https://redhat.com/archives/fedora-package-announce/2008-July/msg00082.html · Aviso do Fabricante
• http://secunia.com/advisories/30849 · Aviso do Fabricante
• http://secunia.com/advisories/30000 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43034 · Nota
• https://access.redhat.com/errata/RHSA-2008:0519 · Nota
• http://debian.org/security/2008/dsa-1592 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=447389 · Nota