rPath Security Advisory: 2006-0162-1
Published: 2006-08-31
Products: rPath Linux 1
Rating: Major
Exposure Level Classification:
Local Root Deterministic Privilege Escalation
Updated Versions:
kernel=/conary.rpath.com@rpl:devel//1/2.6.17.11-1-0.1
References:
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2935
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4145
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3745
https://issues.rpath.com/browse/RPL-611
https://issues.rpath.com/browse/RPL-524
Description:
Previous versions of the kernel package are subject to several
vulnerabilities. Certain malformed UDF filesystems can cause the
system to crash (denial of service). Malformed CDROM firmware or
USB storage devices (such as USB keys) could cause system crash
(denial of service), and if they were intentionally malformed, can
cause arbitrary code to run with elevated privileges. In addition,
the SCTP protocol is subject to a remote system crash (denial of
service) attack, but rPath Linux does not include the tools required
to configure the SCTP protocol, so rPath Linux is not configured
by default to be vulnerable to this attack.
This update requires a system reboot to implement the fixes.
