CERTA-2004-AVI-002

Vulnerability from certfr_avis - Published: 2004-01-07 - Updated: 2004-01-09

None

Description

Il a été reporté qu'une vulnérabilité présente dans l'appel système mremap du noyau Linux pourrait être exploitée par un utilisateur mal intentionné afin d'obtenir les privilèges du super-utilisateur root ou réaliser un déni de service par arrêt brutal du système.

Solution

Les versions 2.4.24 et 2.6.1-rc3 du noyau Linux corrigent cette vulnérabilité.

None
Impacted products
Vendor Product Description
N/A N/A linux 2.6.1-rc1 et versions antérieures.
N/A N/A Linux 2.4.23 et versions antérieures ;

Show details on source website

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "linux 2.6.1-rc1 et versions ant\u00e9rieures.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Linux 2.4.23 et versions ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nIl a \u00e9t\u00e9 report\u00e9 qu\u0027une vuln\u00e9rabilit\u00e9 pr\u00e9sente dans l\u0027appel syst\u00e8me\nmremap du noyau Linux pourrait \u00eatre exploit\u00e9e par un utilisateur mal\nintentionn\u00e9 afin d\u0027obtenir les privil\u00e8ges du super-utilisateur root ou\nr\u00e9aliser un d\u00e9ni de service par arr\u00eat brutal du syst\u00e8me.\n\n## Solution\n\nLes versions 2.4.24 et 2.6.1-rc3 du noyau Linux corrigent cette\nvuln\u00e9rabilit\u00e9.\n",
  "cves": [],
  "initial_release_date": "2004-01-07T00:00:00",
  "last_revision_date": "2004-01-09T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 GLSA 200401-01 de Gentoo :",
      "url": "http://marc.theaimsgroup.com/?l=gentoo-announce\u0026m=107360666507658"
    },
    {
      "title": "Sources du noyau Linux :",
      "url": "http://www.kernel.org"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 SuSE-SA:2004:01 de SuSE :",
      "url": "http://www.suse.com/de/security/2004_01_linux_kernel.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 MDKSA-2004:001 de Mandrake :",
      "url": "http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:001"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 DSA-413 de Debian :",
      "url": "http://www.debian.org/security/2004/dsa-413"
    }
  ],
  "reference": "CERTA-2004-AVI-002",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2004-01-07T00:00:00.000000"
    },
    {
      "description": "Modification de la version du correctif pour les noyaux de la s\u00e9rie 2.6. Ajout r\u00e9f\u00e9rences aux bulletins de s\u00e9curit\u00e9 de Gentoo et Mandrake.",
      "revision_date": "2004-01-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": null,
  "title": "Vuln\u00e9rabilit\u00e9 du noyau linux",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "BUlletin de s\u00e9curit\u00e9 DSA-413 de Debian",
      "url": null
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SuSE-SA-2004:001 de SuSE",
      "url": null
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 RHSA-2003:417 de Red Hat",
      "url": "http://rhn.redhat.com/errata/RHSA-2003-417.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 isec-0013-mremap d\u0027Isec",
      "url": "http://isec.pl/vulnerabilities/isec-0013-mremap.txt"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Loading…

Detection rules are retrieved from Rulezet.

Loading…

Loading…