Red Hat Bugzilla – Bug 168803
CAN-2005-2457, -2548 Linux Kernel Denial of Service
Last modified: 2007-04-18 13:31:40 EDT
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20050729 Netscape/22.214.171.124
Description of problem:
05.34.5 CVE: CAN-2005-2457
Title: Linux Kernel ISO File System Denial of Service
Description: The Linux kernel driver for compressed ISO file systems
is prone to a denial of service vulnerability. A malicious user may
create a compressed ISO file system containing data that will trigger
the exploit. Upon successful exploitation of this vulnerability, the
kernel will attempt to mount this image, and will cause the Linux
kernel to crash. Various versions of the kernel are vulnerable.
Version-Release number of selected component (if applicable):
05.34.6 CVE: CAN-2005-2548
Title: Linux Kernel SNMP Handler Denial of Service
Description: The Linux kernel is prone to an SNMP handler denial of
service vulnerability. Linux kernel versions 2.6.8 rc2 and earlier are
known to be vulnerable.
05.37.8 CVE: CAN-2005-2802
Title: Linux Kernel Netfilter ipt_recent Remote Denial of Service
Description: The Netfilter project maintains the packet filter
component of the Linux kernel. The "ipt_recent" module can be used
with Netfilter to verify if a source address has been recently seen.
The "ipt_recent" module in the Linux Kernel is reported prone to a
local denial of service vulnerability which can be exploited by
sending specially crafted packets such as packets used to carry out an
SSH brute force attack. Linux Kernel versions 2.6.8 and 2.6.10 are
Hey John, Pekka, et al.,
Why don't we combine this bug with bug # 157459, "CAN-2005-1263 Linux kernel ELF
core dump privilege elevation", adding the three above advisories to it, call
157459 "Linux Kernel multiple vulnerabilities (CAN-2005-1263, CAN-2005-2457,
CAN-2005-2548, CAN-2005-2802)" and close this bug DUPLICATE of 157459? Or
combine that bug with this one, closing that one as a duplicate?
That way we can track all kernel security issues in on bug ticket #.
Seems to make sense..
*** This bug has been marked as a duplicate of 157459 ***