| Description: | Description:
The remote host is missing an update to kernel
announced via advisory MDKSA-2004:066.
A number of vulnerabilities were discovered in the Linux kernel that
are corrected with this update:
Multiple vulnerabilities were found by the Sparse source checker that
could allow local users to elevate privileges or gain access to
kernel memory (CVE-2004-0495).
Missing Discretionary Access Controls (DAC) checks in the chown(2)
system call could allow an attacker with a local account to change the
group ownership of arbitrary files, which could lead to root privileges
on affected systems (CVE-2004-0497).
An information leak vulnerability that affects only ia64 systems was
fixed (CVE-2004-0565).
Insecure permissions on /proc/scsi/qla2300/HbaApiNode could allow a
local user to cause a DoS on the system
this only affects
Mandrakelinux 9.2 and below (CVE-2004-0587).
A vulnerability that could crash the kernel has also been fixed. This
crash, however, can only be exploited via root (in br_if.c).
The provided packages are patched to fix these vulnerabilities. All
users are encouraged to upgrade to these updated kernels.
To update your kernel, please follow the directions located at:
http://www.mandrakesoft.com/security/kernelupdate
Affected versions: 10.0, 9.1, 9.2, Corporate Server 2.1,
Multi Network Firewall 8.2
Solution:
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
http://www.securityspace.com/smysecure/catid.html?in=MDKSA-2004:066
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0495
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0497
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0565
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0587
Risk factor : High
CVSS Score:
7.2
|
