Referenced CVEs:
CVE-2006-6058, CVE-2007-4133, CVE-2007-4567, CVE-2007-4849, CVE-2007-4997, CVE-2007-5093, CVE-2007-5500, CVE-2007-5501


Description:
=========================================================== Ubuntu Security Notice USN-558-1 December 19, 2007linux-source-2.6.17/20/22 vulnerabilitiesCVE-2006-6058, CVE-2007-4133, CVE-2007-4567, CVE-2007-4849,CVE-2007-4997, CVE-2007-5093, CVE-2007-5500, CVE-2007-5501===========================================================A security issue affects the following Ubuntu releases:Ubuntu 6.10Ubuntu 7.04Ubuntu 7.10This advisory also applies to the corresponding versions ofKubuntu, Edubuntu, and Xubuntu.The problem can be corrected by upgrading your system to thefollowing package versions:Ubuntu 6.10: linux-image-2.6.17-12-386 2.6.17.1-12.42 linux-image-2.6.17-12-generic 2.6.17.1-12.42 linux-image-2.6.17-12-hppa32 2.6.17.1-12.42 linux-image-2.6.17-12-hppa64 2.6.17.1-12.42 linux-image-2.6.17-12-itanium 2.6.17.1-12.42 linux-image-2.6.17-12-mckinley 2.6.17.1-12.42 linux-image-2.6.17-12-powerpc 2.6.17.1-12.42 linux-image-2.6.17-12-powerpc-smp 2.6.17.1-12.42 linux-image-2.6.17-12-powerpc64-smp 2.6.17.1-12.42 linux-image-2.6.17-12-server 2.6.17.1-12.42 linux-image-2.6.17-12-server-bigiron 2.6.17.1-12.42 linux-image-2.6.17-12-sparc64 2.6.17.1-12.42 linux-image-2.6.17-12-sparc64-smp 2.6.17.1-12.42Ubuntu 7.04: linux-image-2.6.20-16-386 2.6.20-16.33 linux-image-2.6.20-16-generic 2.6.20-16.33 linux-image-2.6.20-16-hppa32 2.6.20-16.33 linux-image-2.6.20-16-hppa64 2.6.20-16.33 linux-image-2.6.20-16-itanium 2.6.20-16.33 linux-image-2.6.20-16-lowlatency 2.6.20-16.33 linux-image-2.6.20-16-mckinley 2.6.20-16.33 linux-image-2.6.20-16-powerpc 2.6.20-16.33 linux-image-2.6.20-16-powerpc-smp 2.6.20-16.33 linux-image-2.6.20-16-powerpc64-smp 2.6.20-16.33 linux-image-2.6.20-16-server 2.6.20-16.33 linux-image-2.6.20-16-server-bigiron 2.6.20-16.33 linux-image-2.6.20-16-sparc64 2.6.20-16.33 linux-image-2.6.20-16-sparc64-smp 2.6.20-16.33Ubuntu 7.10: linux-image-2.6.22-14-386 2.6.22-14.47 linux-image-2.6.22-14-cell 2.6.22-14.47 linux-image-2.6.22-14-generic 2.6.22-14.47 linux-image-2.6.22-14-hppa32 2.6.22-14.47 linux-image-2.6.22-14-hppa64 2.6.22-14.47 linux-image-2.6.22-14-itanium 2.6.22-14.47 linux-image-2.6.22-14-lpia 2.6.22-14.47 linux-image-2.6.22-14-lpiacompat 2.6.22-14.47 linux-image-2.6.22-14-mckinley 2.6.22-14.47 linux-image-2.6.22-14-powerpc 2.6.22-14.47 linux-image-2.6.22-14-powerpc-smp 2.6.22-14.47 linux-image-2.6.22-14-powerpc64-smp 2.6.22-14.47 linux-image-2.6.22-14-rt 2.6.22-14.47 linux-image-2.6.22-14-server 2.6.22-14.47 linux-image-2.6.22-14-sparc64 2.6.22-14.47 linux-image-2.6.22-14-sparc64-smp 2.6.22-14.47 linux-image-2.6.22-14-ume 2.6.22-14.47 linux-image-2.6.22-14-virtual 2.6.22-14.47 linux-image-2.6.22-14-xen 2.6.22-14.47After a standard system upgrade you need to reboot your computer toeffect the necessary changes.Details follow:The minix filesystem did not properly validate certain filesystem values.If a local attacker could trick the system into attempting to mount acorrupted minix filesystem, the kernel could be made to hang for longperiods of time, resulting in a denial of service. (CVE-2006-6058)Certain calculations in the hugetlb code were not correct. A localattacker could exploit this to cause a kernel panic, leading to a denialof service. (CVE-2007-4133)Eric Sesterhenn and Victor Julien discovered that the hop-by-hop IPv6extended header was not correctly validated. If a system was configuredfor IPv6, a remote attacker could send a specially crafted IPv6 packetand cause the kernel to panic, leading to a denial of service. Thiswas only vulnerable in Ubuntu 7.04. (CVE-2007-4567)Permissions were not correctly stored on JFFS2 ACLs. For systems usingACLs on JFFS2, a local attacker may gain access to private files.(CVE-2007-4849)Chris Evans discovered that the 802.11 network stack did not correctlyhandle certain QOS frames. A remote attacker on the local wireless networkcould send specially crafted packets that would panic the kernel, resultingin a denial of service. (CVE-2007-4997)The Philips USB Webcam driver did not correctly handle disconnects.If a local attacker tricked another user into disconnecting a webcamunsafely, the kernel could hang or consume CPU resources, leading toa denial of service. (CVE-2007-5093)Scott James Remnant discovered that the waitid function could be madeto hang the system. A local attacker could execute a specially craftedprogram which would leave the system unresponsive, resulting in a denialof service. (CVE-2007-5500)Ilpo Järvinen discovered that it might be possible for the TCP stackto panic the kernel when receiving a crafted ACK response. Only Ubuntu7.10 contained the vulnerable code, and it is believed not to havebeen exploitable. (CVE-2007-5501)When mounting the same remote NFS share to separate local locations, thefirst location's mount options would apply to all subsequent mounts of thesame NFS share. In some configurations, this could lead to incorrectlyconfigured permissions, allowing local users to gain additional accessto the mounted share. (https://launchpad.net/bugs/164231)





More...