| Description: | Description:
The remote host is missing an update to kernel
announced via advisory MDKSA-2007:216.
Some vulnerabilities were discovered and corrected in the Linux
2.6 kernel:
A typo in the Linux kernel caused RTA_MAX to be used as an array size
instead of RTN_MAX, which lead to an out of bounds access by certain
functions (CVE-2007-2172).
The IPv6 protocol allowed remote attackers to cause a denial of
service via crafted IPv6 type 0 route headers that create network
amplification between two routers (CVE-2007-2242).
The random number feature did not properly seed pools when there was
no entropy, or used an incorrect cast when extracting entropy, which
could cause the random number generator to provide the same values
after reboots on systems without an entropy source (CVE-2007-2453).
A memory leak in the PPPoE socket implementation allowed local users
to cause a denial of service (memory consumption) by creating a
socket using connect, and releasing it before the PPPIOCGCHAN ioctl
is initialized (CVE-2007-2525).
A stack-based buffer overflow in the random number generator could
allow local root users to cause a denial of service or gain privileges
by setting the default wakeup threshold to a value greater than the
output pool size (CVE-2007-3105).
The hugetlb_vmtruncate_list() and hugetlb_vmtruncate() functions in the
Linux kernel perform certain pio_tree calculations using HPAGE_SIZE
intead of PAGE_SIZE units, which may allow local users to cause a
denial of service (panic) via unspecified vectors (CVE-2007-4133).
To update your kernel, please follow the directions located at:
http://www.mandriva.com/en/security/kernelupdate
Affected: Corporate 3.0, Multi Network Firewall 2.0
Solution:
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
http://www.securityspace.com/smysecure/catid.html?in=MDKSA-2007:216
Risk factor : High
CVSS Score:
7.8
|
