—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2015:057
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : kernel
Date : March 10, 2015
Affected: Business Server 1.0
_______________________________________________________________________

Problem Description:

Multiple vulnerabilities has been found and corrected in the Linux
kernel:

The Crypto API in the Linux kernel before 3.18.5 allows local users
to load arbitrary kernel modules via a bind system call for an
AF_ALG socket with a parenthesized module template expression in
the salg_name field, as demonstrated by the vfat(aes) expression,
a different vulnerability than CVE-2013-7421 (CVE-2014-9644).

net/netfilter/nf_conntrack_proto_generic.c in the Linux kernel before
3.18 generates incorrect conntrack entries during handling of certain
iptables rule sets for the SCTP, DCCP, GRE, and UDP-Lite protocols,
which allows remote attackers to bypass intended access restrictions
via packets with disallowed port numbers (CVE-2014-8160).

The Crypto API in the Linux kernel before 3.18.5 allows local users
to load arbitrary kernel modules via a bind system call for an
AF_ALG socket with a module name in the salg_name field, a different
vulnerability than CVE-2014-9644 (CVE-2013-7421).

The updated packages provides a solution for these security issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9644
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8160
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7421
_______________________________________________________________________

Updated Packages:

Mandriva Business Server 1/X86_64:
ab21eb82b9f3b9998d89a9a96d802d89 mbs1/x86_64/cpupower-3.4.106-1.1.mbs1.x86_64.rpm
46fd73cc51df3b28d0d8514284fac385 mbs1/x86_64/kernel-firmware-3.4.106-1.1.mbs1.noarch.rpm
21a5b87104f323ab6f9c0053459b6758 mbs1/x86_64/kernel-headers-3.4.106-1.1.mbs1.x86_64.rpm
c98d416ff27d029db2a2b99074f8d8cc mbs1/x86_64/kernel-server-3.4.106-1.1.mbs1.x86_64.rpm
6d006fc713bf03befe27f52da7587bca mbs1/x86_64/kernel-server-devel-3.4.106-1.1.mbs1.x86_64.rpm
8e620bcc9138026e7e7ca6b2be965cf7 mbs1/x86_64/kernel-source-3.4.106-1.mbs1.noarch.rpm
ff53f8301daf71c8d118b3c751bc432d mbs1/x86_64/lib64cpupower0-3.4.106-1.1.mbs1.x86_64.rpm
d3b60137d548904023e4355a8035353a mbs1/x86_64/lib64cpupower-devel-3.4.106-1.1.mbs1.x86_64.rpm
f5013c8e961f3eb1841dbb1dcddfd44f mbs1/x86_64/perf-3.4.106-1.1.mbs1.x86_64.rpm
ac71f1e51ed1440926a80bec1c9bf8b1 mbs1/SRPMS/cpupower-3.4.106-1.1.mbs1.src.rpm
29ed687f12ca09bca945a49fb95e58e1 mbs1/SRPMS/kernel-firmware-3.4.106-1.1.mbs1.src.rpm
63d4ff2e470e1c15fd213119a893d0c7 mbs1/SRPMS/kernel-headers-3.4.106-1.1.mbs1.src.rpm
17c40cdb0e71f2e12ce1f04514a72ffa mbs1/SRPMS/kernel-server-3.4.106-1.1.mbs1.src.rpm
61f419409456eeae14af3b0346bcdb95 mbs1/SRPMS/kernel-source-3.4.106-1.mbs1.src.rpm
c5373a8d093e13288efb69376ef2fded mbs1/SRPMS/perf-3.4.106-1.1.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFU/ro5mqjQ0CJFipgRArhTAKDV/pfXBMXLzn4a30W2Gf881jRF8gCeN/bV
EVT7oxqY/TFjUsM+pfPNxTc=
=wLS6
—–END PGP SIGNATURE—–

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
_______________________________________________________