full-disclosure - [ MDVSA-2008:043 ] - Updated kernel packages fix multiple vulnerabilities and bugs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-id: <E1JOp7B-0003lm-9c@artemis.annvix.ca>
Date: Mon, 11 Feb 2008 23:59:37 -0700
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2008:043 ] - Updated kernel packages fix
 multiple vulnerabilities and bugs


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDVSA-2008:043
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : kernel
 Date    : February 11, 2008
 Affected: 2007.0, 2007.1
 _______________________________________________________________________
 
 Problem Description:
 
 A flaw in the vmsplice system call did not properly verify address
 arguments passed by user-space processes, which allowed local attackers
 to overwrite arbitrary kernel memory and gain root privileges.
 
 Mandriva urges all users to upgrade to these new kernels immediately
 as this flaw is being actively exploited.  This issue only affects
 2.6.17 and newer Linux kernels, so neither Corporate 3.0 nor Corporate
 4.0 are affected.
 
 To update your kernel, please follow the directions located at:
 
   http://www.mandriva.com/en/security/kernelupdate
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0600
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2007.0:
 c63758e3abeda7602d9a81890253d854  2007.0/i586/kernel-2.6.17.17mdv-1-1mdv2007.0.i586.rpm
 eb743ddfbb72aac4763ad008cb5bcad5  2007.0/i586/kernel-doc-2.6.17.17mdv-1-1mdv2007.0.i586.rpm
 974492b95aeb6349888ec4f9a6499fbf  2007.0/i586/kernel-enterprise-2.6.17.17mdv-1-1mdv2007.0.i586.rpm
 ad17be478e5debd28663e0e3e788fba7  2007.0/i586/kernel-legacy-2.6.17.17mdv-1-1mdv2007.0.i586.rpm
 12a369a4da1cf126ce0dbb61893b7476  2007.0/i586/kernel-source-2.6.17.17mdv-1-1mdv2007.0.i586.rpm
 2fd75aa15c00fd06882dc5a9c88c560d  2007.0/i586/kernel-source-stripped-2.6.17.17mdv-1-1mdv2007.0.i586.rpm
 44b699bd4418488011747c6f9d90cac5  2007.0/i586/kernel-xen0-2.6.17.17mdv-1-1mdv2007.0.i586.rpm
 c2cbe1e2e11cdd66b8e1e926603cac7b  2007.0/i586/kernel-xenU-2.6.17.17mdv-1-1mdv2007.0.i586.rpm 
 8e0c25c3078b3e08902767ee05e8c6eb  2007.0/SRPMS/kernel-2.6.17.17mdv-1-1mdv2007.0.src.rpm

 Mandriva Linux 2007.0/X86_64:
 c7875e488362c15ecb76e7d4d0a5aef8  2007.0/x86_64/kernel-2.6.17.17mdv-1-1mdv2007.0.x86_64.rpm
 e9f0a1008002ffe40bae5406249c5ff3  2007.0/x86_64/kernel-doc-2.6.17.17mdv-1-1mdv2007.0.x86_64.rpm
 36133c70f730c3e29bd03626630522c7  2007.0/x86_64/kernel-source-2.6.17.17mdv-1-1mdv2007.0.x86_64.rpm
 3441a1c0d0dca1bcd4b2ce0f70c776c7  2007.0/x86_64/kernel-source-stripped-2.6.17.17mdv-1-1mdv2007.0.x86_64.rpm
 2569a3b256c64bb44e2f7257e8b891db  2007.0/x86_64/kernel-xen0-2.6.17.17mdv-1-1mdv2007.0.x86_64.rpm
 568b997678edddc1af69defe02052229  2007.0/x86_64/kernel-xenU-2.6.17.17mdv-1-1mdv2007.0.x86_64.rpm 
 8e0c25c3078b3e08902767ee05e8c6eb  2007.0/SRPMS/kernel-2.6.17.17mdv-1-1mdv2007.0.src.rpm

 Mandriva Linux 2007.1:
 0f1453e9367c4483e8a09d1f86abbfc7  2007.1/i586/kernel-2.6.17.17mdv-1-1mdv2007.1.i586.rpm
 04f805797e6ad66ce6e2ef4356c5ae20  2007.1/i586/kernel-doc-2.6.17.17mdv-1-1mdv2007.1.i586.rpm
 bddd4e3c46da24bab5107e36ebf052a9  2007.1/i586/kernel-doc-latest-2.6.17-17mdv.i586.rpm
 bc5309d6003dbf70cf08cc287c878911  2007.1/i586/kernel-enterprise-2.6.17.17mdv-1-1mdv2007.1.i586.rpm
 fc903c61146c16b45ba2f86f5f4e9318  2007.1/i586/kernel-enterprise-latest-2.6.17-17mdv.i586.rpm
 b0eba323c633baf341216fe5c000a852  2007.1/i586/kernel-latest-2.6.17-17mdv.i586.rpm
 3789dfc33bbcfd7a4643e623a3d3f887  2007.1/i586/kernel-legacy-2.6.17.17mdv-1-1mdv2007.1.i586.rpm
 a014d9595a4e80b3ff51976b59822acb  2007.1/i586/kernel-legacy-latest-2.6.17-17mdv.i586.rpm
 555822b1f7400be240d63aa993809fa5  2007.1/i586/kernel-source-2.6.17.17mdv-1-1mdv2007.1.i586.rpm
 d99f1b9db0461be5c7dc187b6e0e76aa  2007.1/i586/kernel-source-latest-2.6.17-17mdv.i586.rpm
 5f579b07b3b40cf3a2e7e30e0a3c7f24  2007.1/i586/kernel-source-stripped-2.6.17.17mdv-1-1mdv2007.1.i586.rpm
 fa83757c3f38fff305df8a212c264e04  2007.1/i586/kernel-source-stripped-latest-2.6.17-17mdv.i586.rpm
 2b380e48adf57862740a883acf8b5eed  2007.1/i586/kernel-xen0-2.6.17.17mdv-1-1mdv2007.1.i586.rpm
 80852864b2146eadc762235ec61e5a13  2007.1/i586/kernel-xen0-latest-2.6.17-17mdv.i586.rpm
 0cac0d1e82089622d3d3566720accb14  2007.1/i586/kernel-xenU-2.6.17.17mdv-1-1mdv2007.1.i586.rpm
 750d97ef65990e039ba6c5437e4301e5  2007.1/i586/kernel-xenU-latest-2.6.17-17mdv.i586.rpm 
 6761309040b1a1980bc95eca54f205b2  2007.1/SRPMS/kernel-2.6.17.17mdv-1-1mdv2007.1.src.rpm

 Mandriva Linux 2007.1/X86_64:
 01be7ee171bfd72f353b091492c21e54  2007.1/x86_64/kernel-2.6.17.17mdv-1-1mdv2007.1.x86_64.rpm
 722594b383eaa2eb1ab68d5f8916deb1  2007.1/x86_64/kernel-doc-2.6.17.17mdv-1-1mdv2007.1.x86_64.rpm
 2371fdd019b0aa8d6f789fa0d3964a10  2007.1/x86_64/kernel-doc-latest-2.6.17-17mdv.x86_64.rpm
 32309ca753c4eec5077f0e7c0389f82e  2007.1/x86_64/kernel-latest-2.6.17-17mdv.x86_64.rpm
 233a48b8e2d0f46a5e3518539e42806b  2007.1/x86_64/kernel-source-2.6.17.17mdv-1-1mdv2007.1.x86_64.rpm
 5b7514a844f49306c3b0eaa15cc9f4db  2007.1/x86_64/kernel-source-latest-2.6.17-17mdv.x86_64.rpm
 e91c84b6960f290eff377eb7240308cc  2007.1/x86_64/kernel-source-stripped-2.6.17.17mdv-1-1mdv2007.1.x86_64.rpm
 799051e2f4a45e8fa5266757ed1511f4  2007.1/x86_64/kernel-source-stripped-latest-2.6.17-17mdv.x86_64.rpm
 6c27f83a4a82e5c75e3ef9ac28fbba09  2007.1/x86_64/kernel-xen0-2.6.17.17mdv-1-1mdv2007.1.x86_64.rpm
 bf06381c466e20dd21d03e72d1135cc7  2007.1/x86_64/kernel-xen0-latest-2.6.17-17mdv.x86_64.rpm
 40aa16fc3a27f43035f011f09751da7a  2007.1/x86_64/kernel-xenU-2.6.17.17mdv-1-1mdv2007.1.x86_64.rpm
 e27a4aa2d2e8ef10e7fb5abb3811440e  2007.1/x86_64/kernel-xenU-latest-2.6.17-17mdv.x86_64.rpm 
 6761309040b1a1980bc95eca54f205b2  2007.1/SRPMS/kernel-2.6.17.17mdv-1-1mdv2007.1.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)

iD8DBQFHsRj6mqjQ0CJFipgRAv3AAJ9642rVYAE591l1f8W34W66/dEM5gCbB4dP
zRX2zkKZxAoOjowzX9Tb8rQ=
=mzup
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/