---------------------------------------------------------------------- Try a new way to discover vulnerabilities that ALREADY EXIST in your IT infrastructure. The Full Featured Secunia Network Software Inspector (NSI) is now available: http://secunia.com/network_software_inspector/ The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT vulnerabilities in more than 4,000 different Windows applications. ---------------------------------------------------------------------- TITLE: Linux Kernel RTA_MAX Security Issue and Seed Refeed Weakness SECUNIA ADVISORY ID: SA26244 VERIFY ADVISORY: http://secunia.com/advisories/26244/ CRITICAL: Less critical IMPACT: Brute force, DoS WHERE: >From remote OPERATING SYSTEM: Linux Kernel 2.4.x http://secunia.com/product/763/ DESCRIPTION: A security issue and a weakness have been reported in the Linux Kernel, which potentially can be exploited by malicious people to cause a DoS (Denial of Service) or bypass certain security restrictions. 1) A boundary error due to the use of RTA_MAX instead of RTN_MAX in dn_fib_props[] within dn_fib.c and in fib_props[] within fib_semantics.c can potentially be exploited to cause a DoS. 2) The "xfer_secondary_pool()" function in drivers/char/random.c uses the wrong data to refeed seeds into the random number generator. This may weaken the security of applications relying on the random number generator. Note: This also fixes a problem introduced by a previous smbfs security patch. SOLUTION: Update to version 2.4.35. PROVIDED AND/OR DISCOVERED BY: 1) PaX Team 2) Thomas Graf ORIGINAL ADVISORY: http://kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.35 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------