ID

VAR-201205-0016

CVE

CVE-2011-3188

TITLE

Linux Kernel of IPv4 When IPv6 Service disruption in implementations ( Network failure ) Vulnerabilities

DESCRIPTION

The (1) IPv4 and (2) IPv6 implementations in the Linux kernel before 3.1 use a modified MD4 algorithm to generate sequence numbers and Fragment Identification values, which makes it easier for remote attackers to cause a denial of service (disrupted networking) or hijack network sessions by predicting these values and sending crafted packets. ( Network failure ) May be left in a state or network sessions may be taken away. The NFSv4 implementation is one of the distributed file system protocols. (CVE-2009-4067) It was discovered that the Stream Control Transmission Protocol (SCTP) implementation incorrectly calculated lengths. ========================================================================== Ubuntu Security Notice USN-1239-1 October 25, 2011 linux-ec2 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 10.04 LTS Summary: Several security issues were fixed in the kernel. (CVE-2011-1576) Vasiliy Kulikov and Dan Rosenberg discovered that ecryptfs did not correctly check the origin of mount points. (CVE-2011-1833) Vasiliy Kulikov discovered that taskstats did not enforce access restrictions. A local attacker could exploit this to read certain information, leading to a loss of privacy. (CVE-2011-2494) Vasiliy Kulikov discovered that /proc/PID/io did not enforce access restrictions. A local attacker could exploit this to read certain information, leading to a loss of privacy. If a system was using Bluetooth, a remote attacker could send specially crafted traffic to crash the system or gain root privileges. (CVE-2011-2497) It was discovered that the EXT4 filesystem contained multiple off-by-one flaws. (CVE-2011-2695) Fernando Gont discovered that the IPv6 stack used predictable fragment identification numbers. (CVE-2011-2905) Time Warns discovered that long symlinks were incorrectly handled on Be filesystems. An attacker could use this flaw to possibly predict sequence numbers and inject packets. A remote attacker with a malicious server could exploit this to crash the system or possibly execute arbitrary code as the root user. (CVE-2011-3191) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 10.04 LTS: linux-image-2.6.32-319-ec2 2.6.32-319.39 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-server, linux-powerpc), a standard system upgrade will automatically perform this as well. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: kernel security and bug fix update Advisory ID: RHSA-2011:1419-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2011-1419.html Issue date: 2011-11-01 CVE Names: CVE-2011-3188 CVE-2011-3209 ===================================================================== 1. Summary: Updated kernel packages that fix two security issues and four bugs are now available for Red Hat Enterprise Linux 5.6 Extended Update Support. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux (v. 5.6.z server) - i386, ia64, noarch, ppc, s390x, x86_64 3. Description: The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issues: * The way IPv4 and IPv6 protocol sequence numbers and fragment IDs were generated could allow a man-in-the-middle attacker to inject packets and possibly hijack connections. Protocol sequence numbers and fragment IDs are now more random. (CVE-2011-3188, Moderate) * A flaw was found in the Linux kernel's clock implementation on 32-bit, SMP (symmetric multiprocessing) systems. A local, unprivileged user could use this flaw to cause a divide error fault, resulting in a denial of service. (CVE-2011-3209, Moderate) Red Hat would like to thank Dan Kaminsky for reporting CVE-2011-3188, and Yasuaki Ishimatsu for reporting CVE-2011-3209. In addition, this update fixes the following bugs: * When the Global File System 2 (GFS2) file system is suspended, its delete work queue is also suspended, along with any pending work on the queue. Prior to this update, if GFS2's transaction lock was demoted while the delete work queue was suspended, a deadlock could occur on the file system because the file system tried to flush the work queue in the lock demotion code. With this update, the delete work queue is no longer flushed by the lock demotion code, and a deadlock no longer occurs. Instead, the work queue is flushed by the unmount operation, so that pending work is properly completed. (BZ#733678) * A previously applied patch introduced a regression for third-party file systems that do not set the FS_HAS_IODONE2 flag, specifically, Oracle Cluster File System 2 (OCFS2). The patch removed a call to the aio_complete function, resulting in no completion events being processed, causing user-space applications to become unresponsive. This update reintroduces the aio_complete function call, fixing this issue. (BZ#734156) * Certain devices support multiple operation modes. For example, EMC CLARiiON disk arrays support ALUA mode and their own vendor specific mode for failover. In Red Hat Enterprise Linux 5.5, a bug was discovered that prevented tools such as multipath from being able to select the device/hardware handler plug-in to use. This resulted in the application (for example, multipath) not working properly. With this update, the kernel has been modified to allow applications to select the device/hardware handler to use, thus resolving this issue. (BZ#739900) * This update improves the performance of delete/unlink operations in a GFS2 file system with large files by adding a layer of metadata read-ahead for indirect blocks. (BZ#743805) Users should upgrade to these updated packages, which contain backported patches to resolve these issues. The system must be rebooted for this update to take effect. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/kb/docs/DOC-11259 To install kernel packages manually, use "rpm -ivh [package]". Do not use "rpm -Uvh" as that will remove the running kernel binaries from your system. You may use "rpm -e" to remove old kernels after determining that the new kernel functions properly on your system. 5. Bugs fixed (http://bugzilla.redhat.com/): 732658 - CVE-2011-3188 kernel: net: improve sequence number generation 732878 - CVE-2011-3209 kernel: panic occurs when clock_gettime() is called 733678 - GFS2: recovery stuck on transaction lock [rhel-5.6.z] 739900 - scsi_dh_emc gives "error attaching hardware handler" for EMC active-active SANs [rhel-5.6.z] 6. Package List: Red Hat Enterprise Linux (v. 5.6.z server): Source: kernel-2.6.18-238.28.1.el5.src.rpm i386: kernel-2.6.18-238.28.1.el5.i686.rpm kernel-PAE-2.6.18-238.28.1.el5.i686.rpm kernel-PAE-debuginfo-2.6.18-238.28.1.el5.i686.rpm kernel-PAE-devel-2.6.18-238.28.1.el5.i686.rpm kernel-debug-2.6.18-238.28.1.el5.i686.rpm kernel-debug-debuginfo-2.6.18-238.28.1.el5.i686.rpm kernel-debug-devel-2.6.18-238.28.1.el5.i686.rpm kernel-debuginfo-2.6.18-238.28.1.el5.i686.rpm kernel-debuginfo-common-2.6.18-238.28.1.el5.i686.rpm kernel-devel-2.6.18-238.28.1.el5.i686.rpm kernel-headers-2.6.18-238.28.1.el5.i386.rpm kernel-xen-2.6.18-238.28.1.el5.i686.rpm kernel-xen-debuginfo-2.6.18-238.28.1.el5.i686.rpm kernel-xen-devel-2.6.18-238.28.1.el5.i686.rpm ia64: kernel-2.6.18-238.28.1.el5.ia64.rpm kernel-debug-2.6.18-238.28.1.el5.ia64.rpm kernel-debug-debuginfo-2.6.18-238.28.1.el5.ia64.rpm kernel-debug-devel-2.6.18-238.28.1.el5.ia64.rpm kernel-debuginfo-2.6.18-238.28.1.el5.ia64.rpm kernel-debuginfo-common-2.6.18-238.28.1.el5.ia64.rpm kernel-devel-2.6.18-238.28.1.el5.ia64.rpm kernel-headers-2.6.18-238.28.1.el5.ia64.rpm kernel-xen-2.6.18-238.28.1.el5.ia64.rpm kernel-xen-debuginfo-2.6.18-238.28.1.el5.ia64.rpm kernel-xen-devel-2.6.18-238.28.1.el5.ia64.rpm noarch: kernel-doc-2.6.18-238.28.1.el5.noarch.rpm ppc: kernel-2.6.18-238.28.1.el5.ppc64.rpm kernel-debug-2.6.18-238.28.1.el5.ppc64.rpm kernel-debug-debuginfo-2.6.18-238.28.1.el5.ppc64.rpm kernel-debug-devel-2.6.18-238.28.1.el5.ppc64.rpm kernel-debuginfo-2.6.18-238.28.1.el5.ppc64.rpm kernel-debuginfo-common-2.6.18-238.28.1.el5.ppc64.rpm kernel-devel-2.6.18-238.28.1.el5.ppc64.rpm kernel-headers-2.6.18-238.28.1.el5.ppc.rpm kernel-headers-2.6.18-238.28.1.el5.ppc64.rpm kernel-kdump-2.6.18-238.28.1.el5.ppc64.rpm kernel-kdump-debuginfo-2.6.18-238.28.1.el5.ppc64.rpm kernel-kdump-devel-2.6.18-238.28.1.el5.ppc64.rpm s390x: kernel-2.6.18-238.28.1.el5.s390x.rpm kernel-debug-2.6.18-238.28.1.el5.s390x.rpm kernel-debug-debuginfo-2.6.18-238.28.1.el5.s390x.rpm kernel-debug-devel-2.6.18-238.28.1.el5.s390x.rpm kernel-debuginfo-2.6.18-238.28.1.el5.s390x.rpm kernel-debuginfo-common-2.6.18-238.28.1.el5.s390x.rpm kernel-devel-2.6.18-238.28.1.el5.s390x.rpm kernel-headers-2.6.18-238.28.1.el5.s390x.rpm kernel-kdump-2.6.18-238.28.1.el5.s390x.rpm kernel-kdump-debuginfo-2.6.18-238.28.1.el5.s390x.rpm kernel-kdump-devel-2.6.18-238.28.1.el5.s390x.rpm x86_64: kernel-2.6.18-238.28.1.el5.x86_64.rpm kernel-debug-2.6.18-238.28.1.el5.x86_64.rpm kernel-debug-debuginfo-2.6.18-238.28.1.el5.x86_64.rpm kernel-debug-devel-2.6.18-238.28.1.el5.x86_64.rpm kernel-debuginfo-2.6.18-238.28.1.el5.x86_64.rpm kernel-debuginfo-common-2.6.18-238.28.1.el5.x86_64.rpm kernel-devel-2.6.18-238.28.1.el5.x86_64.rpm kernel-headers-2.6.18-238.28.1.el5.x86_64.rpm kernel-xen-2.6.18-238.28.1.el5.x86_64.rpm kernel-xen-debuginfo-2.6.18-238.28.1.el5.x86_64.rpm kernel-xen-devel-2.6.18-238.28.1.el5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2011-3188.html https://www.redhat.com/security/data/cve/CVE-2011-3209.html https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2011 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFOsCp6XlSAg2UNWIIRAqjtAKC+6itwqo7i/nD2TiB5jAoly0MGowCfU9EU LGpVFEpzls46GkvOInRcpSo= =qH8Q -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c04135307 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04135307 Version: 1 HPSBGN02970 rev.1 - HP Rapid Deployment Pack (RDP) or HP Insight Control Server Deployment, Multiple Remote Vulnerabilities affecting Confidentiality, Integrity and Availability NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2014-03-10 Last Updated: 2014-03-10 Potential Security Impact: Multiple remote vulnerabilities affecting confidentiality, integrity and availability Source: Hewlett-Packard Company, HP Software Security Response Team VULNERABILITY SUMMARY Potential vulnerabilities have been identified with HP Rapid Deployment Pack (RDP) or HP Insight Control Server Deployment. The vulnerabilities could be exploited remotely affecting confidentiality, integrity and availability. References: CVE-2010-4008 CVE-2010-4494 CVE-2011-2182 CVE-2011-2213 CVE-2011-2492 CVE-2011-2518 CVE-2011-2689 CVE-2011-2723 CVE-2011-3188 CVE-2011-4077 CVE-2011-4110 CVE-2012-0058 CVE-2012-0879 CVE-2012-1088 CVE-2012-1179 CVE-2012-2137 CVE-2012-2313 CVE-2012-2372 CVE-2012-2373 CVE-2012-2375 CVE-2012-2383 CVE-2012-2384 CVE-2013-6205 CVE-2013-6206 SSRT101443 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP Rapid Deployment Pack (RDP) -- All versions HP Insight Control Server Deployment -- All versions BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2013-6205 (AV:L/AC:M/Au:S/C:P/I:P/A:P) 4.1 CVE-2013-6206 (AV:N/AC:L/Au:N/C:C/I:P/A:P) 9.0 CVE-2010-4008 (AV:N/AC:M/Au:N/C:N/I:N/A:P) 4.3 CVE-2010-4494 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2011-2182 (AV:L/AC:L/Au:N/C:C/I:C/A:C) 7.2 CVE-2011-2213 (AV:L/AC:L/Au:N/C:N/I:N/A:C) 4.9 CVE-2011-2492 (AV:L/AC:M/Au:N/C:P/I:N/A:N) 1.9 CVE-2011-2518 (AV:L/AC:L/Au:N/C:N/I:N/A:C) 4.9 CVE-2011-2689 (AV:L/AC:L/Au:N/C:N/I:N/A:C) 4.9 CVE-2011-2723 (AV:A/AC:M/Au:N/C:N/I:N/A:C) 5.7 CVE-2011-3188 (AV:N/AC:M/Au:N/C:P/I:P/A:P) 6.8 CVE-2011-4077 (AV:L/AC:M/Au:N/C:C/I:C/A:C) 6.9 CVE-2011-4110 (AV:L/AC:L/Au:N/C:N/I:N/A:P) 2.1 CVE-2012-0058 (AV:L/AC:L/Au:N/C:N/I:N/A:C) 4.9 CVE-2012-0879 (AV:L/AC:L/Au:N/C:N/I:N/A:C) 4.9 CVE-2012-1088 (AV:L/AC:M/Au:N/C:N/I:P/A:P) 3.3 CVE-2012-1179 (AV:A/AC:M/Au:S/C:N/I:N/A:C) 5.2 CVE-2012-2137 (AV:L/AC:M/Au:N/C:C/I:C/A:C) 6.9 CVE-2012-2313 (AV:L/AC:H/Au:N/C:N/I:N/A:P) 1.2 CVE-2012-2372 (AV:L/AC:M/Au:S/C:N/I:N/A:C) 4.4 CVE-2012-2373 (AV:L/AC:H/Au:N/C:N/I:N/A:C) 4.0 CVE-2012-2375 (AV:A/AC:H/Au:N/C:N/I:N/A:C) 4.6 CVE-2012-2383 (AV:L/AC:L/Au:N/C:N/I:N/A:C) 4.9 CVE-2012-2384 (AV:L/AC:L/Au:N/C:N/I:N/A:C) 4.9 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION HP recommends that HP Rapid Deployment Pack (RDP) or HP Insight Control Server Deployment should only be run on private secure networks to prevent the risk of security compromise. HISTORY Version:1 (rev.1) - 10 March 2014 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com. Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins Security Bulletin Archive: A list of recently released Security Bulletins is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/ Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HP General Software HF = HP Hardware and Firmware MP = MPE/iX MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PI = Printing and Imaging PV = ProCurve ST = Storage Software TU = Tru64 UNIX UX = HP-UX Copyright 2014 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. The text of the original advisory is reproduced for reference: Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2011-1020 Kees Cook discovered an issue in the /proc filesystem that allows local users to gain access to sensitive process information after execution of a setuid binary. CVE-2011-1576 Ryan Sweat discovered an issue in the VLAN implementation. CVE-2011-2484 Vasiliy Kulikov of Openwall discovered that the number of exit handlers that a process can register is not capped, resulting in local denial of service through resource exhaustion (cpu time and memory). CVE-2011-2491 Vasily Averin discovered an issue with the NFS locking implementation. A malicious NFS server can cause a client to hang indefinitely in an unlock call. CVE-2011-2492 Marek Kroemeke and Filip Palian discovered that uninitialized struct elements in the Bluetooth subsystem could lead to a leak of sensitive kernel memory through leaked stack memory. CVE-2011-2495 Vasiliy Kulikov of Openwall discovered that the io file of a process' proc directory was world-readable, resulting in local information disclosure of information such as password lengths. CVE-2011-2496 Robert Swiecki discovered that mremap() could be abused for local denial of service by triggering a BUG_ON assert. CVE-2011-2497 Dan Rosenberg discovered an integer underflow in the Bluetooth subsystem, which could lead to denial of service or privilege escalation. CVE-2011-2517 It was discovered that the netlink-based wireless configuration interface performed insufficient length validation when parsing SSIDs, resulting in buffer overflows. CVE-2011-2525 Ben Pfaff reported an issue in the network scheduling code. CVE-2011-2700 Mauro Carvalho Chehab of Red Hat reported a buffer overflow issue in the driver for the Si4713 FM Radio Transmitter driver used by N900 devices. CVE-2011-2723 Brent Meshier reported an issue in the GRO (generic receive offload) implementation. This can be exploited by remote users to create a denial of service (system crash) in certain network device configurations. CVE-2011-2905 Christian Ohm discovered that the 'perf' analysis tool searches for its config files in the current working directory. This could lead to denial of service or potential privilege escalation if a user with elevated privileges is tricked into running 'perf' in a directory under the control of the attacker. CVE-2011-2909 Vasiliy Kulikov of Openwall discovered that a programming error in the Comedi driver could lead to the information disclosure through leaked stack memory. CVE-2011-2918 Vince Weaver discovered that incorrect handling of software event overflows in the 'perf' analysis tool could lead to local denial of service. CVE-2011-2928 Timo Warns discovered that insufficient validation of Be filesystem images could lead to local denial of service if a malformed filesystem image is mounted. CVE-2011-3188 Dan Kaminsky reported a weakness of the sequence number generation in the TCP protocol implementation. This can be used by remote attackers to inject packets into an active session. CVE-2011-3191 Darren Lavender reported an issue in the Common Internet File System (CIFS). A malicious file server could cause memory corruption leading to a denial of service. This update also includes a fix for a regression introduced with the previous security fix for CVE-2011-1768 (Debian: #633738) For the stable distribution (squeeze), this problem has been fixed in version 2.6.32-35squeeze2. Updates for issues impacting the oldstable distribution (lenny) will be available soon. The following matrix lists additional source packages that were rebuilt for compatibility with or to take advantage of this update: Debian 6.0 (squeeze) user-mode-linux 2.6.32-1um-4+35squeeze2 We recommend that you upgrade your linux-2.6 and user-mode-linux packages. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . (CVE-2011-3188) Yogesh Sharma discovered that CIFS did not correctly handle UNCs that had no prefixpaths

AFFECTED PRODUCTS