| Description: | Description:
The remote host is missing updates announced in
advisory FLSA-2004:1284.
Paul Starzetz discovered a flaw in return value checking in mremap() in
the Linux kernel versions 2.4.24 and previous that may allow a local
attacker to gain root privileges. No exploit is currently available
however this issue is exploitable. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CVE-2004-0077
to this issue.
The Vicam USB driver in kernel versions prior to 2.4.25 does not use the
copy_from_user function to access userspace, which crosses security
boundaries. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CVE-2004-0075 to this issue.
Arjan van de Ven discovered a flaw in ncp_lookup() in ncpfs that could
allow local privilege escalation. ncpfs is only used to allow a system
to mount volumes of NetWare servers or print to NetWare printers. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2004-0010 to this issue.
Alan Cox found issues in the R128 Direct Render Infrastructure that
could allow local privilege escalation. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CVE-2004-0003
to this issue.
All users are advised to upgrade to these errata packages, which contain
backported security patches that correct these issues.
Fedora Legacy would like to thank Paul Starzetz from ISEC for reporting
the issue CVE-2004-0077, and Dominic Hargreaves for providing
backported rpms for all issues.
Affected platforms:
Redhat 7.2
Redhat 7.3
Redhat 8
Solution:
http://www.securityspace.com/smysecure/catid.html?in=FLSA-2004:1284
Risk factor : High
CVSS Score:
7.2
|
