PT-2008-6912 · Linux+1 · Linux-Image+3

Eugene Teo · Published 1970-01-01 · Updated 2017-08-08 · CVE-2008-3915

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions linux-headers versions 2.6.24-etchnhalf.1-r5k-ip32 through 2.6.24-etchnhalf.1-r5k-ip32 linux-headers versions 2.6.24-etchnhalf.1-all-mips through 2.6.24-etchnhalf.1-all-mips linux-headers versions 2.6.24-etchnhalf.1-r4k-ip22 through 2.6.24-etchnhalf.1-r4k-ip22 linux-image versions 2.6.24-etchnhalf.1-r5k-ip32 through 2.6.24-etchnhalf.1-r5k-ip32 linux-image versions 2.6.24-etchnhalf.1-r4k-ip22 through 2.6.24-etchnhalf.1-r4k-ip22 Linux kernel versions prior to 2.6.26.4

Description The issue concerns multiple vulnerabilities in the Linux kernel and related packages in the Debian GNU/Linux operating system. These vulnerabilities can be exploited remotely and may lead to a breach of confidentiality, integrity, and availability of protected information. The vulnerabilities can be exploited when NFSv4 is enabled, related to decoding an NFSv4 acl, and may have an unknown impact.

Recommendations For linux-headers versions 2.6.24-etchnhalf.1-r5k-ip32, consider updating to a version that includes the necessary security patches. For linux-headers versions 2.6.24-etchnhalf.1-all-mips, consider updating to a version that includes the necessary security patches. For linux-headers versions 2.6.24-etchnhalf.1-r4k-ip22, consider updating to a version that includes the necessary security patches. For linux-image versions 2.6.24-etchnhalf.1-r5k-ip32, consider updating to a version that includes the necessary security patches. For linux-image versions 2.6.24-etchnhalf.1-r4k-ip22, consider updating to a version that includes the necessary security patches. For Linux kernel versions prior to 2.6.26.4, consider updating to version 2.6.26.4 or later to address the buffer overflow issue in nfsd when NFSv4 is enabled.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-02636

BDU:2015-02637

BDU:2015-02638

BDU:2015-02639

BDU:2015-02640

CVE-2008-3915

DSA-1636-1

RHSA-2008:0857

Affected Products

Debian

Linux Kernel

Linux-Headers

Linux-Image

References · 29

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3276 · Security Note
• https://bdu.fstec.ru/vul/2015-02636 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3535 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3534 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3275 · Security Note
• https://bdu.fstec.ru/vul/2015-02640 · Security Note
• https://bdu.fstec.ru/vul/2015-02639 · Security Note
• https://bdu.fstec.ru/vul/2015-02638 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3526 · Security Note
• http://debian.org/security/2008/dsa-1636 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3792 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2008-3915 · Security Note
• https://bdu.fstec.ru/vul/2015-02637 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3272 · Security Note
• http://ubuntu.com/usn/usn-659-1 · Vendor Advisory