home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / modules / nessus-2.2.8.mo / usr / lib / nessus / plugins / mandrake_MDKSA-2004-037.nasl < prev    next >
Text File  |  2005-01-14  |  6KB  |  182 lines
  1. #
  2. # (C) Tenable Network Security
  3. #
  4. # This plugin text was extracted from Mandrake Linux Security Advisory MDKSA-2004:037
  5. #
  6.  
  7.  
  8. if ( ! defined_func("bn_random") ) exit(0);
  9. if(description)
  10. {
  11.  script_id(14136);
  12.  script_bugtraq_id(10211, 10221, 10233);
  13.  script_version ("$Revision: 1.3 $");
  14.  script_cve_id("CAN-2004-0229", "CAN-2004-0394", "CAN-2004-0424", "CAN-2004-0427");
  15.  
  16.  name["english"] = "MDKSA-2004:037: kernel";
  17.  
  18.  script_name(english:name["english"]);
  19.  
  20.  desc["english"] = "
  21. The remote host is missing the patch for the advisory MDKSA-2004:037 (kernel).
  22.  
  23.  
  24. A vulnerability was found in the framebuffer driver of the 2.6 kernel. This is
  25. due to incorrect use of the fb_copy_cmap function. (CAN-2004-0229)
  26. A vulnerability has been found in the Linux kernel in the ip_setsockopt()
  27. function code. There is an exploitable integer overflow inside the code handling
  28. the MCAST_MSFILTER socket option in the IP_MSFILTER_SIZE macro calculation. This
  29. issue is present in both 2.4 (2.4.25) and 2.6 kernels. (CAN-2004-0424)
  30. There is a minor issue with the static buffer in 2.4 kernel's panic() function.
  31. Although it's a possibly buffer overflow, it most like not exploitable due to
  32. the nature of panic(). (CAN-2004-0394)
  33. In do_fork(), if an error occurs after the mm_struct for the child has been
  34. allocated, it is never freed. The exit_mm() meant to free it increments the
  35. mm_count and this count is never decremented. (For a running process that is
  36. exitting, schedule() takes care this; however, the child process being cleaned
  37. up is not running.) In the CLONE_VM case, the parent's mm_struct will get an
  38. extra mm_count and so it will never be freed. This issue is present in both 2.4
  39. and 2.6 kernels. (CAN-2004-0427)
  40. The provided packages are patched to fix these vulnerabilities. All users are
  41. encouraged to upgrade to these updated kernels.
  42. To update your kernel, please follow the directions located at:
  43. http://www.mandrakesecure.net/en/kernelupdate.php
  44.  
  45.  
  46. Solution : http://www.mandrakesoft.com/security/advisories?name=MDKSA-2004:037
  47. Risk factor : High";
  48.  
  49.  
  50.  
  51.  script_description(english:desc["english"]);
  52.  
  53.  summary["english"] = "Check for the version of the kernel package";
  54.  script_summary(english:summary["english"]);
  55.  
  56.  script_category(ACT_GATHER_INFO);
  57.  
  58.  script_copyright(english:"This script is Copyright (C) 2004 Tenable Network Security");
  59.  family["english"] = "Mandrake Local Security Checks";
  60.  script_family(english:family["english"]);
  61.  
  62.  script_dependencies("ssh_get_info.nasl");
  63.  script_require_keys("Host/Mandrake/rpm-list");
  64.  exit(0);
  65. }
  66.  
  67. include("rpm.inc");
  68. if ( rpm_check( reference:"kernel-2.4.25.4mdk-1-1mdk", release:"MDK10.0", yank:"mdk") )
  69. {
  70.  security_hole(0);
  71.  exit(0);
  72. }
  73. if ( rpm_check( reference:"kernel-2.6.3.9mdk-1-1mdk", release:"MDK10.0", yank:"mdk") )
  74. {
  75.  security_hole(0);
  76.  exit(0);
  77. }
  78. if ( rpm_check( reference:"kernel-enterprise-2.4.25.4mdk-1-1mdk", release:"MDK10.0", yank:"mdk") )
  79. {
  80.  security_hole(0);
  81.  exit(0);
  82. }
  83. if ( rpm_check( reference:"kernel-enterprise-2.6.3.9mdk-1-1mdk", release:"MDK10.0", yank:"mdk") )
  84. {
  85.  security_hole(0);
  86.  exit(0);
  87. }
  88. if ( rpm_check( reference:"kernel-i686-up-4GB-2.6.3.9mdk-1-1mdk", release:"MDK10.0", yank:"mdk") )
  89. {
  90.  security_hole(0);
  91.  exit(0);
  92. }
  93. if ( rpm_check( reference:"kernel-p3-smp-64GB-2.6.3.9mdk-1-1mdk", release:"MDK10.0", yank:"mdk") )
  94. {
  95.  security_hole(0);
  96.  exit(0);
  97. }
  98. if ( rpm_check( reference:"kernel-secure-2.6.3.9mdk-1-1mdk", release:"MDK10.0", yank:"mdk") )
  99. {
  100.  security_hole(0);
  101.  exit(0);
  102. }
  103. if ( rpm_check( reference:"kernel-smp-2.4.25.4mdk-1-1mdk", release:"MDK10.0", yank:"mdk") )
  104. {
  105.  security_hole(0);
  106.  exit(0);
  107. }
  108. if ( rpm_check( reference:"kernel-smp-2.6.3.9mdk-1-1mdk", release:"MDK10.0", yank:"mdk") )
  109. {
  110.  security_hole(0);
  111.  exit(0);
  112. }
  113. if ( rpm_check( reference:"kernel-source-2.4.25-4mdk", release:"MDK10.0", yank:"mdk") )
  114. {
  115.  security_hole(0);
  116.  exit(0);
  117. }
  118. if ( rpm_check( reference:"kernel-source-2.6.3-9mdk", release:"MDK10.0", yank:"mdk") )
  119. {
  120.  security_hole(0);
  121.  exit(0);
  122. }
  123. if ( rpm_check( reference:"kernel-source-stripped-2.6.3-9mdk", release:"MDK10.0", yank:"mdk") )
  124. {
  125.  security_hole(0);
  126.  exit(0);
  127. }
  128. if ( rpm_check( reference:"kernel-2.4.21.0.30mdk-1-1mdk", release:"MDK9.1", yank:"mdk") )
  129. {
  130.  security_hole(0);
  131.  exit(0);
  132. }
  133. if ( rpm_check( reference:"kernel-secure-2.4.21.0.30mdk-1-1mdk", release:"MDK9.1", yank:"mdk") )
  134. {
  135.  security_hole(0);
  136.  exit(0);
  137. }
  138. if ( rpm_check( reference:"kernel-smp-2.4.21.0.30mdk-1-1mdk", release:"MDK9.1", yank:"mdk") )
  139. {
  140.  security_hole(0);
  141.  exit(0);
  142. }
  143. if ( rpm_check( reference:"kernel-source-2.4.21-0.30mdk", release:"MDK9.1", yank:"mdk") )
  144. {
  145.  security_hole(0);
  146.  exit(0);
  147. }
  148. if ( rpm_check( reference:"kernel-2.4.22.30mdk-1-1mdk", release:"MDK9.2", yank:"mdk") )
  149. {
  150.  security_hole(0);
  151.  exit(0);
  152. }
  153. if ( rpm_check( reference:"kernel-enterprise-2.4.22.30mdk-1-1mdk", release:"MDK9.2", yank:"mdk") )
  154. {
  155.  security_hole(0);
  156.  exit(0);
  157. }
  158. if ( rpm_check( reference:"kernel-secure-2.4.22.30mdk-1-1mdk", release:"MDK9.2", yank:"mdk") )
  159. {
  160.  security_hole(0);
  161.  exit(0);
  162. }
  163. if ( rpm_check( reference:"kernel-smp-2.4.22.30mdk-1-1mdk", release:"MDK9.2", yank:"mdk") )
  164. {
  165.  security_hole(0);
  166.  exit(0);
  167. }
  168. if ( rpm_check( reference:"kernel-source-2.4.22-30mdk", release:"MDK9.2", yank:"mdk") )
  169. {
  170.  security_hole(0);
  171.  exit(0);
  172. }
  173. if (rpm_exists(rpm:"kernel-", release:"MDK10.0")
  174.  || rpm_exists(rpm:"kernel-", release:"MDK9.1")
  175.  || rpm_exists(rpm:"kernel-", release:"MDK9.2") )
  176. {
  177.  set_kb_item(name:"CAN-2004-0229", value:TRUE);
  178.  set_kb_item(name:"CAN-2004-0394", value:TRUE);
  179.  set_kb_item(name:"CAN-2004-0424", value:TRUE);
  180.  set_kb_item(name:"CAN-2004-0427", value:TRUE);
  181. }
  182.