----------------------------------------------------------------------

Bist Du interessiert an einem neuen Job in IT-Sicherheit?


Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT-
Sicherheit:
http://secunia.com/secunia_vacancies/

----------------------------------------------------------------------

TITLE:
Linux Kernel "sendmsg()" and "raw_sendmsg()" Vulnerabilities

SECUNIA ADVISORY ID:
SA16747

VERIFY ADVISORY:
http://secunia.com/advisories/16747/

CRITICAL:
Less critical

IMPACT:
Exposure of sensitive information, Privilege escalation, DoS

WHERE:
Local system

REVISION:
1.1 originally posted 2005-09-09

OPERATING SYSTEM:
Linux Kernel 2.6.x
http://secunia.com/product/2719/
Linux Kernel 2.4.x
http://secunia.com/product/763/

DESCRIPTION:
Alexander Viro has reported two vulnerabilities in the Linux kernel,
which potentially can be exploited by malicious, local users to
disclose certain sensitive information, cause a DoS (Denial of
Service) or gain escalated privileges.

1) A boundary error in "sendmsg()" when copying 32bit "msg_control"
contents from user-space to the kernel can be exploited to cause a
buffer overflow. This may allow a malicious user to gain root
privileges and execute arbitrary code with kernel privileges.

2) An error in the "raw_sendmsg()" function may allow a malicious
user to read kernel memory contents and disclose certain information,
or to manipulate certain hardware state to cause a DoS.

The vulnerabilities have been reported in version 2.4.21 and 2.6.9.
Other versions may also be affected.

SOLUTION:
Secunia is currently not aware of an official patch or updated
version fixing this vulnerability.

Grant only trusted users access to affected systems.

PROVIDED AND/OR DISCOVERED BY:
Alexander Viro

CHANGELOG:
2005-09-09: Added information about additional vulnerability.

ORIGINAL ADVISORY:
Red Hat:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=166248
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=166249
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=166830

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------