full-disclosure - [ MDVSA-2010:034-1 ] kernel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E1Ni9Vq-0000s6-2K@titan.mandriva.com>
Date: Thu, 18 Feb 2010 17:46:01 +0100
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2010:034-1 ] kernel


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                       MDVSA-2010:034-1
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : kernel
 Date    : February 18, 2010
 Affected: Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 Some vulnerabilities were discovered and corrected in the Linux
 2.6 kernel:
 
 Array index error in the gdth_read_event function in
 drivers/scsi/gdth.c in the Linux kernel before 2.6.32-rc8 allows
 local users to cause a denial of service or possibly gain privileges
 via a negative event index in an IOCTL request. (CVE-2009-3080)
 
 The collect_rx_frame function in drivers/isdn/hisax/hfc_usb.c in the
 Linux kernel before 2.6.32-rc7 allows attackers to have an unspecified
 impact via a crafted HDLC packet that arrives over ISDN and triggers
 a buffer under-read. (CVE-2009-4005)
 
 Additionally, the Linux kernel was updated to the stable release
 2.6.27.45.
 
 To update your kernel, please follow the directions located at:
 
   http://www.mandriva.com/en/security/kernelupdate

 Update:

 The virtualbox DKMS modules was not provided with MDVSA-2010:034
 for the Enterprise 5 product. This advisory provides the missing
 virtualbox packages.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3080
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4005
 https://qa.mandriva.com/55826
 https://qa.mandriva.com/55823
 _______________________________________________________________________

 Updated Packages:

 Mandriva Enterprise Server 5:
 1d25250893f3a105b61ed3e97b4b11f6  mes5/i586/vboxadd-kernel-2.6.27.45-desktop-1mnb-2.0.2-2.1mdv2009.0.i586.rpm
 75fa8d3b7e74383df1ff77c88be804ae  mes5/i586/vboxadd-kernel-2.6.27.45-desktop586-1mnb-2.0.2-2.1mdv2009.0.i586.rpm
 99737375be65536ddbdab6c7a38c29eb  mes5/i586/vboxadd-kernel-2.6.27.45-server-1mnb-2.0.2-2.1mdv2009.0.i586.rpm
 01c29a7defdb87120bbe4c136e0d2834  mes5/i586/vboxadd-kernel-desktop586-latest-2.0.2-1.20100217.2.1mdv2009.0.i586.rpm
 1c1bb7de641d0e1d799d37eceaf71377  mes5/i586/vboxadd-kernel-desktop-latest-2.0.2-1.20100217.2.1mdv2009.0.i586.rpm
 726a748944fa7bc3ffd8473b9ad56be1  mes5/i586/vboxadd-kernel-server-latest-2.0.2-1.20100217.2.1mdv2009.0.i586.rpm
 1a3fd940682e7cc613322deff2897dc1  mes5/i586/vboxvfs-kernel-2.6.27.45-desktop-1mnb-2.0.2-2.1mdv2009.0.i586.rpm
 98b29953f5df51d478167178518a8fe8  mes5/i586/vboxvfs-kernel-2.6.27.45-desktop586-1mnb-2.0.2-2.1mdv2009.0.i586.rpm
 d11d658ef60f7b2f7c34cc007e7cb342  mes5/i586/vboxvfs-kernel-2.6.27.45-server-1mnb-2.0.2-2.1mdv2009.0.i586.rpm
 84ed845747ad2c7304e7c9763a111b5d  mes5/i586/vboxvfs-kernel-desktop586-latest-2.0.2-1.20100217.2.1mdv2009.0.i586.rpm
 354ecd54dd0fba574a5ac99af8252f63  mes5/i586/vboxvfs-kernel-desktop-latest-2.0.2-1.20100217.2.1mdv2009.0.i586.rpm
 72a3a802f765e7540b80509b71f197b9  mes5/i586/vboxvfs-kernel-server-latest-2.0.2-1.20100217.2.1mdv2009.0.i586.rpm
 b9425dcc6fedfca34a450d332877cbb4  mes5/i586/virtualbox-kernel-2.6.27.45-desktop-1mnb-2.0.2-2.1mdv2009.0.i586.rpm
 fcfd06a59ad505a2f040b50c06d73620  mes5/i586/virtualbox-kernel-2.6.27.45-desktop586-1mnb-2.0.2-2.1mdv2009.0.i586.rpm
 0ef11f77b2c5582ab9590b5cc41c6fa5  mes5/i586/virtualbox-kernel-2.6.27.45-server-1mnb-2.0.2-2.1mdv2009.0.i586.rpm
 e6f996dd071ecd244e23480e4ea96d6c  mes5/i586/virtualbox-kernel-desktop586-latest-2.0.2-1.20100217.2.1mdv2009.0.i586.rpm
 3e6d11bc2a933340a154abcc7b242768  mes5/i586/virtualbox-kernel-desktop-latest-2.0.2-1.20100217.2.1mdv2009.0.i586.rpm
 8ec2403c7aa58d6ecc5ac8e72181d3aa  mes5/i586/virtualbox-kernel-server-latest-2.0.2-1.20100217.2.1mdv2009.0.i586.rpm

 Mandriva Enterprise Server 5/X86_64:
 fe74817799deab87af423dd280fd3299  mes5/x86_64/vboxadd-kernel-2.6.27.45-desktop-1mnb-2.0.2-2.1mdv2009.0.x86_64.rpm
 fd4390597e5801350e66b229548da2a3  mes5/x86_64/vboxadd-kernel-2.6.27.45-server-1mnb-2.0.2-2.1mdv2009.0.x86_64.rpm
 08a8d30b75ef39b1e4b9ead21df205d1  mes5/x86_64/vboxadd-kernel-desktop-latest-2.0.2-1.20100217.2.1mdv2009.0.x86_64.rpm
 f6d36dee0a4f8b709fd56c1447eaefda  mes5/x86_64/vboxadd-kernel-server-latest-2.0.2-1.20100217.2.1mdv2009.0.x86_64.rpm
 9c925080e86e84e6224544f9d40f473b  mes5/x86_64/vboxvfs-kernel-2.6.27.45-desktop-1mnb-2.0.2-2.1mdv2009.0.x86_64.rpm
 c8dddc58d0d52cd9091b8dd23df4af02  mes5/x86_64/vboxvfs-kernel-2.6.27.45-server-1mnb-2.0.2-2.1mdv2009.0.x86_64.rpm
 28c20e20b96317c16de254a863b2bb9b  mes5/x86_64/vboxvfs-kernel-desktop-latest-2.0.2-1.20100217.2.1mdv2009.0.x86_64.rpm
 ff34f21a8621a48e959f5c3e5a227f70  mes5/x86_64/vboxvfs-kernel-server-latest-2.0.2-1.20100217.2.1mdv2009.0.x86_64.rpm
 01c07d08e77dd8e383bb37b2fdf88c8d  mes5/x86_64/virtualbox-kernel-2.6.27.45-desktop-1mnb-2.0.2-2.1mdv2009.0.x86_64.rpm
 15257d8715d44c1972473e79996284f7  mes5/x86_64/virtualbox-kernel-2.6.27.45-server-1mnb-2.0.2-2.1mdv2009.0.x86_64.rpm
 d9dc5587b173b8c79d89104186de3d4d  mes5/x86_64/virtualbox-kernel-desktop-latest-2.0.2-1.20100217.2.1mdv2009.0.x86_64.rpm
 d5349b67c41f880db828018f45a4a7c7  mes5/x86_64/virtualbox-kernel-server-latest-2.0.2-1.20100217.2.1mdv2009.0.x86_64.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFLfUo/mqjQ0CJFipgRAg9wAJ0bBFMOpvMcBqmyFiufrENL/Tb7YQCcCpqk
J0CJ8nxh6k89jANLE6fSbkY=
=nOzk
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/