rPath Security Advisory: 2006-0122-2
Published: 2006-07-07
Updated:
    2006-07-13 Upgraded to Critical status with additional information
Products: rPath Linux 1
Rating: Critical
Exposure Level Classification:
    Local Root Deterministic Privilege Escalation
Updated Versions:
    kernel=/conary.rpath.com@rpl:devel//1/2.6.16.24-0.1-1

References:
    http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2451
    http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2934
    https://issues.rpath.com/browse/RPL-488

Description:
    Previous versions of the kernel package have two specific
    vulnerablities that are addressed in this version.
    
    The first vulnerability allows any local user to fill up file
    systems by causing core dumps to write to directories to which
    they do not have write access permissions, and on most systems
    (including any system that provides a generally-accessible "cron"
    or "at" service) to escalate to run arbitrary code as the root user.
    An exploit for this privilege escalation vulnerability is
    publically available and in active use.
    
    The second vulnerability applies only to systems using the SCTP
    protocol, which is not enabled by default, and the tools required
    to configure it (lksctp-tools) are not included in rPath Linux.
    This vulnerability, which cannot apply to systems without
    lksctp-tools installed, enables a remote denial of service attack
    in which specially-crafted packets can crash the system.
    
    A system reboot is required to make the update to resolve these
    vulnerabilities effective.  rPath strongly recommends that all
    users apply this update.