Multiple Linux Flaws Reported

The more serious vulnerability could cause buffer overflows and lead to privilege escalation attacks.


You Can't Detect What You Can't See: Illuminating the Entire Kill Chain

On-Demand Webinar

Security researchers are warning of a buffer overflow security flaw in the Linux kernel that can be exploited to lead to privilege escalation attacks.

According to an advisory issued by iDEFENSE, the vulnerabilities affect Linux Kernel 2.6.x; Linux Kernel 2.5.x and Linux Kernel 2.4.x.

"Successful exploitation may allow arbitrary code execution with root or kernel level privileges," the company warned.

The company found that affected versions of Linux kernel performed no length checking on symbolic links stored on an ISO9660 file system, a problem that allows a malformed CD to perform an arbitrary length overflow in kernel memory.

"Symbolic links on ISO9660 file systems are supported by the 'Rock Ridge' extension to the standard format. The vulnerability can be triggered by performing a directory listing on a maliciously constructed ISO file system, or attempting to access a file via a malformed symlink on such a file system. Many distributions allow local users to mount CDs, which makes them potentially vulnerable to local elevation attacks," according to the security alert.

Updated Linux kernel versions are available at kernel.org.

Separately, security firm Secunia warned of an information leak and denial-of-service holes in Linux Kernel 2.4.x and 2.6.x. The information leak problem was discovered with the ext3, XFS, and JFS file system code and can lead to the exposure of data like cryptographic keys to malicious attackers.

Another error was found within the OSS code for SoundBlaster 16 devices that could be used to trigger denial-of-service attacks with odd numbers of output bytes are submitted.

0 Comments (click to add your comment)
Comment and Contribute


(Maximum characters: 1200). You have characters left.



IT Management Daily
Don't miss an article. Subscribe to our newsletter below.

By submitting your information, you agree that datamation.com may send you Datamation offers via email, phone and text message, as well as email offers about other products and services that Datamation believes may be of interest to you. Datamation will process your information in accordance with the Quinstreet Privacy Policy.