PT-2012-1505 · Linux+2 · Linux Kernel+2

Gustavo F. Padovan + 1 · Publicado 2011-05-31 · Atualizado 2023-02-13 · CVE-2011-1078

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Baixa

Vetor base

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.6.39

Description The issue is related to the sco sock getsockopt old function in the Linux kernel, which does not properly initialize a certain structure. This allows local users to potentially obtain sensitive information from kernel stack memory via the SCO CONNINFO option.

Recommendations For versions prior to 2.6.39, update to version 2.6.39 or later to resolve the issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CESA-2012_1156

CVE-2011-1078

DSA-2240-1

DSA-2264-1

RHSA-2011:0500

RHSA-2011:0833

RHSA-2011_0833

RHSA-2012:1156

RHSA-2012_1156

Produtos afetados

Centos

Linux Kernel

Red Hat

Referências · 10

• https://github.com/torvalds/linux/commit/c4c896e1471aec3b004a693c689f60be3b17ac86 · Correção
• http://openwall.com/lists/oss-security/2011/03/01/10 · Nota
• http://downloads.avaya.com/css/P8/documents/100145416 · Nota
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c4c896e1471aec3b004a693c689f60be3b17ac86 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-1078 · Nota de Segurança
• https://linux.oracle.com/errata/ELSA-2012-1156.html · Aviso do Fabricante
• http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39 · Nota
• http://rhn.redhat.com/errata/RHSA-2011-0833.html · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2012-1156.html · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=681259 · Nota