TITLE:
Linux Kernel Netfilter Weakness and Two SCTP Vulnerabilities

SECUNIA ADVISORY ID:
SA20185

VERIFY ADVISORY:
http://secunia.com/advisories/20185/

CRITICAL:
Moderately critical

IMPACT:
Exposure of sensitive information, DoS

WHERE:
>From remote

OPERATING SYSTEM:
Linux Kernel 2.6.x
http://secunia.com/product/2719/

DESCRIPTION:
Two vulnerabilities and a weakness have been reported in the Linux
Kernel, which can be exploited by malicious, local users to cause a
DoS (Denial of Service) and disclose potentially sensitive
information, and by malicious people to cause a DoS.

1) An input validation error in SCTP when processing a HB-ACK chunk
with a specially-crafted parameter length can be exploited to cause
out-of-bounds memory access. This can potentially cause the system to
crash.

2) An error in SCTP chunk length calculation during parameter
processing can be exploited to cause out-of-bounds memory access.
This can potentially cause the system to crash. 

3) A race condition in the "do_add_counters()" function in netfilter
can be exploited by local users to read kernel memory or cause the
system to crash via a race condition that produces a size value that
is different from the size of the allocated memory.

Successful exploitation requires that the user is granted
CAP_NET_ADMIN rights.

SOLUTION:
Update to version 2.6.16.17.
http://kernel.org/

PROVIDED AND/OR DISCOVERED BY:
1-2) Reported by vendor.
3) Solar Designer

ORIGINAL ADVISORY:
Kernel.org:
http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.17

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------