Vulnerability in linux-2.6 package
Summary
DSA-1286-1: linux-2.6. Affects linux-2.6 versions < 2.6.18.dfsg.1-12etch1. Fixed in 2.6.18.dfsg.1-12etch1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux-2.6 package is a kernel package for the Linux operating system. It provides the core functionality and drivers necessary for the system to run. The package is widely used and forms the foundation of many Linux distributions. However, it has been discovered that the linux-2.6 package is vulnerable to several local and remote vulnerabilities that can lead to denial of service or the execution of arbitrary code.
Vulnerability Detail
The vulnerabilities in the linux-2.6 package include:
-
CVE-2007-0005: Two buffer overflows in the cm4040 driver for the Omnikey CardMan 4040 device, which can be exploited by a local user or malicious device to execute arbitrary code in kernel space.
-
CVE-2007-0958: A vulnerability that allows local users to read otherwise unreadable files by triggering a core dump while using PT_INTERP. This vulnerability is related to CVE-2004-1073.
-
CVE-2007-1357: A vulnerability in the appletalk subsystem, where systems with the appletalk module loaded can be crashed by other systems on the local network via a malformed frame.
-
CVE-2007-1592: A defect that inadvertently shares flow labels between listening sockets and child sockets, which can be exploited by local users to cause a denial of service (Oops).
How To Fix
Minimum fixed version
2.6.18.dfsg.1-12etch1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linux-2.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities.
Conclusion
The linux-2.6 package is vulnerable to multiple local and remote vulnerabilities that can result in denial of service or the execution of arbitrary code. It is crucial to upgrade the package to the fixed version and reboot the machine to ensure the vulnerabilities are mitigated. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux-2.6 →
FAQ
These vulnerabilities can lead to a denial of service or the execution of arbitrary code, depending on the specific vulnerability.
The vulnerabilities can be exploited by local users or malicious devices in the case of CVE-2007-0005, and by other systems on the local network in the case of CVE-2007-1357.
There is no information provided about known instances of these vulnerabilities being exploited.
Yes, a fix is available by upgrading the linux-2.6 package to version 2.6.18.dfsg.1-12etch1 or later.
Yes, if you have built a custom kernel from the kernel source package, you will need to rebuild it to incorporate the fixes.
Related vulnerabilities
Recent vulnerabilities recorded for linux-2.6.
