Summary
The remote host is missing an update to linux-2.6
announced via advisory DSA 1865-1.
Solution
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%201865-1
Insight
Several vulnerabilities have been discovered in the Linux kernel that may lead to denial of service or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems:
CVE-2009-1385
Neil Horman discovered a missing fix from the e1000 network driver. A remote user may cause a denial of service by way of a kernel panic triggered by specially crafted frame sizes.
CVE-2009-1389
Michael Tokarev discovered an issue in the r8169 network driver.
Remote users on the same LAN may cause a denial of service by way of a kernel panic triggered by receiving a large size frame.
CVE-2009-1630
Frank Filz discovered that local users may be able to execute files without execute permission when accessed via an nfs4 mount.
CVE-2009-1633
Jeff Layton and Suresh Jayaraman fixed several buffer overflows in the CIFS filesystem which allow remote servers to cause memory corruption.
CVE-2009-2692
Tavis Ormandy and Julien Tinnes discovered an issue with how the sendpage function is initialized in the proto_ops structure.
Local users can exploit this vulnerability to gain elevated privileges.
For the oldstable distribution (etch), this problem has been fixed in version 2.6.18.dfsg.1-24etch3.
We recommend that you upgrade your linux-2.6, fai-kernels, and
Severity
Classification
-
CVE CVE-2009-1385, CVE-2009-1389, CVE-2009-1630, CVE-2009-1633, CVE-2009-2692 -
CVSS Base Score: 7.8
AV:N/AC:L/Au:N/C:N/I:N/A:C
Related Vulnerabilities