Re: [SECURITY] [DSA 1289-1] New Linux 2.6.18 packages fix several vulnerabilities

1 msg	Roland Lichti ist außer Haus.
13 msg	iptables and nmap
11 msg	Package management and security
1 msg	Parte del diario del coronel
4 msg	Re: PERSONAL LOAN - KTA
1 msg	Security features of Debian
1 msg	Wolfgang Rest/SALZBURG/PGV ist außer Haus.
3 msg	Security features of Debian Etch?
1 msg	Restrict remote access by time?
1 msg	Re: [SECURITY] [DSA 1297-1] New gforge-plugin-s...
1 msg	For Your Kind Attention
2 msg	CVE-2006-4625 Vulnerability not fixed on libapa...
1 msg	Administre su pymes - Maximice sus ganancias
1 msg	Re: [SECURITY] [DSA 1293-1] New quagga packages...
2 msg	Re: [SECURITY] [DSA 1292-1] New qt4-x11 package...
5 msg	Re: [SECURITY] [DSA 1291-1] New samba packages ...
6 msg	debian.org DNSs allow unrestricted zone transfers

Re: [SECURITY] [DSA 1289-1] New Linux 2.6.18 pa...
\ Marcin Owsiany (14 May 2007)

10 msg	security mirror out of date: 128.101.240.212
15 msg	spooky windows script

Subject:	Re: [SECURITY] [DSA 1289-1] New Linux 2.6.18 packages fix several vulnerabilities
Group:	Debian-security
From:	Marcin Owsiany
Date:	14 May 2007

On Sun, May 13, 2007 at 01:33:16PM +0200, Moritz Muehlenhoff wrote:
> CVE-2007-1496
>
> Michal Miroslaw reported a DoS vulnerability (crash) in netfilter.
> A remote attacker can cause a NULL pointer dereference in the
> nfnetlink_log function.

CVE says:
| nfnetlink_log in netfilter in the Linux kernel before 2.6.20.3 allows
| attackers to cause a denial of service (crash) via unspecified vectors
| involving the (1) nfulnl_recv_config function, (2) using "multiple
| packets per netlink message", and (3) bridged packets, which trigger a
| NULL pointer dereference.

Could someone who knows netfilter a bit better comment on this? In what
circumstances in real life is this exploitable? Is there any workaround?
I'm not using bridging, I don't care about logging, so I'm happy to
disable it, I'm not sure what that netlink thing means..

Marcin
--
Marcin Owsiany <porridge> http://marcin.owsiany.pl/
GnuPG: 1024D/60F41216 FE67 DA2D 0ACA FC5E 3F75 D6F6 3A0D 8AA0 60F4 1216

--
To UNSUBSCRIBE, email to debian-security-REQUEST
with a subject of "unsubscribe". Trouble? Contact listmaster