[ MDVSA-2008:043 ] - Updated kernel packages fix multiple vulnerabilities and bugs




-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2008:043
http://www.mandriva.com/security/
_______________________________________________________________________

Package : kernel
Date : February 11, 2008
Affected: 2007.0, 2007.1
_______________________________________________________________________

Problem Description:

A flaw in the vmsplice system call did not properly verify address
arguments passed by user-space processes, which allowed local attackers
to overwrite arbitrary kernel memory and gain root privileges.

Mandriva urges all users to upgrade to these new kernels immediately
as this flaw is being actively exploited. This issue only affects
2.6.17 and newer Linux kernels, so neither Corporate 3.0 nor Corporate
4.0 are affected.

To update your kernel, please follow the directions located at:

http://www.mandriva.com/en/security/kernelupdate
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0600
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2007.0:
c63758e3abeda7602d9a81890253d854 2007.0/i586/kernel-2.6.17.17mdv-1-1mdv2007.0.i586.rpm
eb743ddfbb72aac4763ad008cb5bcad5 2007.0/i586/kernel-doc-2.6.17.17mdv-1-1mdv2007.0.i586.rpm
974492b95aeb6349888ec4f9a6499fbf 2007.0/i586/kernel-enterprise-2.6.17.17mdv-1-1mdv2007.0.i586.rpm
ad17be478e5debd28663e0e3e788fba7 2007.0/i586/kernel-legacy-2.6.17.17mdv-1-1mdv2007.0.i586.rpm
12a369a4da1cf126ce0dbb61893b7476 2007.0/i586/kernel-source-2.6.17.17mdv-1-1mdv2007.0.i586.rpm
2fd75aa15c00fd06882dc5a9c88c560d 2007.0/i586/kernel-source-stripped-2.6.17.17mdv-1-1mdv2007.0.i586.rpm
44b699bd4418488011747c6f9d90cac5 2007.0/i586/kernel-xen0-2.6.17.17mdv-1-1mdv2007.0.i586.rpm
c2cbe1e2e11cdd66b8e1e926603cac7b 2007.0/i586/kernel-xenU-2.6.17.17mdv-1-1mdv2007.0.i586.rpm
8e0c25c3078b3e08902767ee05e8c6eb 2007.0/SRPMS/kernel-2.6.17.17mdv-1-1mdv2007.0.src.rpm

Mandriva Linux 2007.0/X86_64:
c7875e488362c15ecb76e7d4d0a5aef8 2007.0/x86_64/kernel-2.6.17.17mdv-1-1mdv2007.0.x86_64.rpm
e9f0a1008002ffe40bae5406249c5ff3 2007.0/x86_64/kernel-doc-2.6.17.17mdv-1-1mdv2007.0.x86_64.rpm
36133c70f730c3e29bd03626630522c7 2007.0/x86_64/kernel-source-2.6.17.17mdv-1-1mdv2007.0.x86_64.rpm
3441a1c0d0dca1bcd4b2ce0f70c776c7 2007.0/x86_64/kernel-source-stripped-2.6.17.17mdv-1-1mdv2007.0.x86_64.rpm
2569a3b256c64bb44e2f7257e8b891db 2007.0/x86_64/kernel-xen0-2.6.17.17mdv-1-1mdv2007.0.x86_64.rpm
568b997678edddc1af69defe02052229 2007.0/x86_64/kernel-xenU-2.6.17.17mdv-1-1mdv2007.0.x86_64.rpm
8e0c25c3078b3e08902767ee05e8c6eb 2007.0/SRPMS/kernel-2.6.17.17mdv-1-1mdv2007.0.src.rpm

Mandriva Linux 2007.1:
0f1453e9367c4483e8a09d1f86abbfc7 2007.1/i586/kernel-2.6.17.17mdv-1-1mdv2007.1.i586.rpm
04f805797e6ad66ce6e2ef4356c5ae20 2007.1/i586/kernel-doc-2.6.17.17mdv-1-1mdv2007.1.i586.rpm
bddd4e3c46da24bab5107e36ebf052a9 2007.1/i586/kernel-doc-latest-2.6.17-17mdv.i586.rpm
bc5309d6003dbf70cf08cc287c878911 2007.1/i586/kernel-enterprise-2.6.17.17mdv-1-1mdv2007.1.i586.rpm
fc903c61146c16b45ba2f86f5f4e9318 2007.1/i586/kernel-enterprise-latest-2.6.17-17mdv.i586.rpm
b0eba323c633baf341216fe5c000a852 2007.1/i586/kernel-latest-2.6.17-17mdv.i586.rpm
3789dfc33bbcfd7a4643e623a3d3f887 2007.1/i586/kernel-legacy-2.6.17.17mdv-1-1mdv2007.1.i586.rpm
a014d9595a4e80b3ff51976b59822acb 2007.1/i586/kernel-legacy-latest-2.6.17-17mdv.i586.rpm
555822b1f7400be240d63aa993809fa5 2007.1/i586/kernel-source-2.6.17.17mdv-1-1mdv2007.1.i586.rpm
d99f1b9db0461be5c7dc187b6e0e76aa 2007.1/i586/kernel-source-latest-2.6.17-17mdv.i586.rpm
5f579b07b3b40cf3a2e7e30e0a3c7f24 2007.1/i586/kernel-source-stripped-2.6.17.17mdv-1-1mdv2007.1.i586.rpm
fa83757c3f38fff305df8a212c264e04 2007.1/i586/kernel-source-stripped-latest-2.6.17-17mdv.i586.rpm
2b380e48adf57862740a883acf8b5eed 2007.1/i586/kernel-xen0-2.6.17.17mdv-1-1mdv2007.1.i586.rpm
80852864b2146eadc762235ec61e5a13 2007.1/i586/kernel-xen0-latest-2.6.17-17mdv.i586.rpm
0cac0d1e82089622d3d3566720accb14 2007.1/i586/kernel-xenU-2.6.17.17mdv-1-1mdv2007.1.i586.rpm
750d97ef65990e039ba6c5437e4301e5 2007.1/i586/kernel-xenU-latest-2.6.17-17mdv.i586.rpm
6761309040b1a1980bc95eca54f205b2 2007.1/SRPMS/kernel-2.6.17.17mdv-1-1mdv2007.1.src.rpm

Mandriva Linux 2007.1/X86_64:
01be7ee171bfd72f353b091492c21e54 2007.1/x86_64/kernel-2.6.17.17mdv-1-1mdv2007.1.x86_64.rpm
722594b383eaa2eb1ab68d5f8916deb1 2007.1/x86_64/kernel-doc-2.6.17.17mdv-1-1mdv2007.1.x86_64.rpm
2371fdd019b0aa8d6f789fa0d3964a10 2007.1/x86_64/kernel-doc-latest-2.6.17-17mdv.x86_64.rpm
32309ca753c4eec5077f0e7c0389f82e 2007.1/x86_64/kernel-latest-2.6.17-17mdv.x86_64.rpm
233a48b8e2d0f46a5e3518539e42806b 2007.1/x86_64/kernel-source-2.6.17.17mdv-1-1mdv2007.1.x86_64.rpm
5b7514a844f49306c3b0eaa15cc9f4db 2007.1/x86_64/kernel-source-latest-2.6.17-17mdv.x86_64.rpm
e91c84b6960f290eff377eb7240308cc 2007.1/x86_64/kernel-source-stripped-2.6.17.17mdv-1-1mdv2007.1.x86_64.rpm
799051e2f4a45e8fa5266757ed1511f4 2007.1/x86_64/kernel-source-stripped-latest-2.6.17-17mdv.x86_64.rpm
6c27f83a4a82e5c75e3ef9ac28fbba09 2007.1/x86_64/kernel-xen0-2.6.17.17mdv-1-1mdv2007.1.x86_64.rpm
bf06381c466e20dd21d03e72d1135cc7 2007.1/x86_64/kernel-xen0-latest-2.6.17-17mdv.x86_64.rpm
40aa16fc3a27f43035f011f09751da7a 2007.1/x86_64/kernel-xenU-2.6.17.17mdv-1-1mdv2007.1.x86_64.rpm
e27a4aa2d2e8ef10e7fb5abb3811440e 2007.1/x86_64/kernel-xenU-latest-2.6.17-17mdv.x86_64.rpm
6761309040b1a1980bc95eca54f205b2 2007.1/SRPMS/kernel-2.6.17.17mdv-1-1mdv2007.1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)

iD8DBQFHsRj6mqjQ0CJFipgRAv3AAJ9642rVYAE591l1f8W34W66/dEM5gCbB4dP
zRX2zkKZxAoOjowzX9Tb8rQ=
=mzup
-----END PGP SIGNATURE-----