CERT-MU :Advisories

Home | Search | FAQ | Site Map | Contact Us

|| Hotline : 800 2378 || To contact CERT-MU send e-mail on --> info[at]cert-mu.gov.mu || To report incident e-mail on --> incident[at]cert-mu.gov.mu || To report Vulnerabilities send e-mail on --> Vulnerability[at]cert-mu.gov.mu ||

Charter & Mission

CERT-MU Services

Constituency

Authority

Incident Reporting

Vulnerability Reporting

Incident Statistics Forms

Vol. 2, Feb 2012

Vol. 1, Oct 2011

World CERTs

Security Sites

Security Tools

Antivirus Resources

Email Abuse

Network Abuse

Anti-Spam Initiative

Cyber Security Portal

Safer Internet Day

Computer Security Day

National Computer Board

Authorized to use CERT(TM) - CERT is a mark owned by Carnegie Mellon University

CERT-MU AD-2010-4

Linux Kernel Multiple Vulnerabilities

Original issue date: 11 March, 2010

Overview

Multiple vulnerabilities have been reported in the Linux Kernel, which can be exploited by malicious, local users to cause a Denial of Service, disclose potentially sensitive information, manipulate certain data, bypass certain security issues, and gain escalated privileges.

Description

Linuxkernel 'print_fatal_signal' function Local Denial of Service Vulnerability
This information leakage vulnerability occurs when print-fatal-signals is enabled, (disabled by default)and allows dumping any memoryreachable by the kernel to the log by simply jumping to that address from user space is possible.

Linux Kernel Local ebtables Rules Manipulation Vulnerability
This vulnerability is due to the improper restrictions on valid users with CAP_NET_ADMIN capability by the do_ebt_set_ctl() and do_ebt_get_ctl() functions in ebtables modules inthe netfilter subsystem (net/bridge/netfilter/ebtables.c). By modifying the ebtables application local users can bypass access restrictions and configure arbitrary network traffic filtering.

Linux Kernel 'mmap()' and 'mremap()' Denial Of Service Vulnerabilities
This vulnerability exists in the mmap/mremap function when mapping memory addresses leading to denial of service condition or privilege escalation.

Software Affected