Computer Security
[EN] securityvulns.ru no-pyccku


Linux kernel multiple security vulnerabilities
updated since 13.09.2008
Published:14.09.2008
Source:
SecurityVulns ID:9285
Type:remote
Threat Level:
5/10
Description:Multiple local DoS conditions, snd_seq_oss_synth_make_info() information leaks, integer overflows in DCCP and SCTP_AUTH_KEY.
Affected:LINUX : kernel 2.6
CVE:CVE-2008-3915 (Buffer overflow in nfsd in the Linux kernel before 2.6.26.4, when NFSv4 is enabled, allows remote attackers to have an unknown impact via vectors related to decoding an NFSv4 acl.)
 CVE-2008-3792 (net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.26.4 does not verify that the SCTP-AUTH extension is enabled before proceeding with SCTP-AUTH API functions, which allows attackers to cause a denial of service (NULL pointer dereference and panic) via vectors that result in calls to (1) sctp_setsockopt_auth_chunk, (2) sctp_setsockopt_hmac_ident, (3) sctp_setsockopt_auth_key, (4) sctp_setsockopt_active_key, (5) sctp_setsockopt_del_key, (6) sctp_getsockopt_maxburst, (7) sctp_getsockopt_active_key, (8) sctp_getsockopt_peer_auth_chunks, or (9) sctp_getsockopt_local_auth_chunks.)
 CVE-2008-3535 (Off-by-one error in the iov_iter_advance function in mm/filemap.c in the Linux kernel before 2.6.27-rc2 allows local users to cause a denial of service (system crash) via a certain sequence of file I/O operations with readv and writev, as demonstrated by testcases/kernel/fs/ftest/ftest03 from the Linux Test Project.)
 CVE-2008-3534 (The shmem_delete_inode function in mm/shmem.c in the tmpfs implementation in the Linux kernel before 2.6.26.1 allows local users to cause a denial of service (system crash) via a certain sequence of file create, remove, and overwrite operations, as demonstrated by the insserv program, related to allocation of "useless pages" and improper maintenance of the i_blocks count.)
 CVE-2008-3526 (Integer overflow in the sctp_setsockopt_auth_key function in net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel 2.6.24-rc1 through 2.6.26.3 allows remote attackers to cause a denial of service (panic) or possibly have unspecified other impact via a crafted sca_keylength field associated with the SCTP_AUTH_KEY option.)
 CVE-2008-3276 (Integer overflow in the dccp_setsockopt_change function in net/dccp/proto.c in the Datagram Congestion Control Protocol (DCCP) subsystem in the Linux kernel 2.6.17-rc1 through 2.6.26.2 allows remote attackers to cause a denial of service (panic) via a crafted integer value, related to Change L and Change R options without at least one byte in the dccpsf_val field.)
 CVE-2008-3275 (The (1) real_lookup and (2) __lookup_hash functions in fs/namei.c in the vfs implementation in the Linux kernel before 2.6.25.15 do not prevent creation of a child dentry for a deleted (aka S_DEAD) directory, which allows local users to cause a denial of service ("overflow" of the UBIFS orphan area) via a series of attempted file creations within deleted directories.)
 CVE-2008-3272 (The snd_seq_oss_synth_make_info function in sound/core/seq/oss/seq_oss_synth.c in the sound subsystem in the Linux kernel before 2.6.27-rc2 does not verify that the device number is within the range defined by max_synthdev before returning certain data to the caller, which allows local users to obtain sensitive information.)
Original documentdocumentTobias Klein, [TKADV2008-007] Linux Kernel SCTP-AUTH API Information Disclosure Vulnerability and NULL Pointer Dereferences (14.09.2008)
 documentDEBIAN, [SECURITY] [DSA 1636-1] New Linux 2.6.24 packages fix several vulnerabilities (13.09.2008)

Apple iPhone Safari DoS
Published:14.09.2008
Source:
SecurityVulns ID:9286
Type:remote
Threat Level:
5/10
Description:Invalid memory read on JavaScript alert() function.
Affected:APPLE : iPhone 1.1
 APPLE : iPhone 2.0
 APPLE : iPod touch 1.1
 APPLE : iPod touch 2.0
CVE:CVE-2008-3950 (Off-by-one error in the _web_drawInRect:withFont:ellipsis:alignment:measureOnly function in WebKit in Safari in Apple iPhone 1.1.4 and 2.0 and iPod touch 1.1.4 and 2.0 allows remote attackers to cause a denial of service (browser crash) via a JavaScript alert call with an argument that lacks breakable characters and has a length that is a multiple of the memory page size, leading to an out-of-bounds read.)
Original documentdocumentCORE SECURITY TECHNOLOGIES ADVISORIES, CORE-2008-0126: iPhone Safari JavaScript alert Denial of Service (14.09.2008)

Baidu Hi instant messenger integer overflow
updated since 14.09.2008
Published:16.09.2008
Source:
SecurityVulns ID:9287
Type:remote
Threat Level:
5/10
Description:Integer overflow on encrypted message decyphering causes buffer overflow.
Original documentdocumentLi Gen, Baidu Hi IM client software DoS bug, div zero make client crash (16.09.2008)
 documentLi Gen, Baidu Hi IM software parsing plaintext stack overflow (14.09.2008)

Nokia e90 phone Wi-Fi DoS
updated since 14.09.2008
Published:16.09.2008
Source:
SecurityVulns ID:9288
Type:remote
Threat Level:
5/10
Description:Device crash on malformed Wi-Fi frame.
Affected:NOKIA : Nokia E90
Original documentdocumentwins.mallow_(at)_gmail.com, Re: Fwd: Nokia e90 (Probably, and other devices with s60v3) Crashes (16.09.2008)
 documentwins mallow, Fwd: Nokia e90 (Probably, and other devices with s60v3) Crashes (14.09.2008)

About | Terms of use | Privacy Policy
© SecurityVulns, 3APA3A, Vladimir Dubrovin
Nizhny Novgorod