Linux Kernel Serial Driver Proc File Information Disclosure Vulnerability
BID:10330
Info
Linux Kernel Serial Driver Proc File Information Disclosure Vulnerability
| Bugtraq ID: | 10330 |
| Class: | Design Error |
| CVE: |
CVE-2003-0461 |
| Remote: | No |
| Local: | Yes |
| Published: | May 12 2004 12:00AM |
| Updated: | Jul 12 2009 04:07AM |
| Credit: | The person responsible for the discovery of this issue is currently unknown. |
| Vulnerable: |
SGI ProPack 3.0 SGI ProPack 2.4 Linux kernel 2.4.26 Linux kernel 2.4.25 Linux kernel 2.4.24 Linux kernel 2.4.23 Linux kernel 2.4.22 Linux kernel 2.4.21 Linux kernel 2.4.20 Linux kernel 2.4.19 Linux kernel 2.4.18 Linux kernel 2.4.17 Linux kernel 2.4.16 Linux kernel 2.4.15 Linux kernel 2.4.14 Linux kernel 2.4.13 Linux kernel 2.4.12 Linux kernel 2.4.11 Linux kernel 2.4.10 Linux kernel 2.4.9 Linux kernel 2.4.8 Linux kernel 2.4.7 Linux kernel 2.4.6 Linux kernel 2.4.5 Linux kernel 2.4.4 Linux kernel 2.4.3 Linux kernel 2.4.2 Linux kernel 2.4.1 Linux kernel 2.4 |
| Not Vulnerable: |
Linux kernel 2.6.5 Linux kernel 2.6.4 Linux kernel 2.6.3 Linux kernel 2.6.2 Linux kernel 2.6.1 Linux kernel 2.6 |
Discussion
Linux Kernel Serial Driver Proc File Information Disclosure Vulnerability
It has been reported that the Linux kernel is prone to a serial driver proc file information disclosure vulnerability. This issue is due to a design error that allows unprivileged access to potentially sensitive information.
This issue might allow an attacker to gain access to sensitive information such as user password lengths.
It has been reported that the Linux kernel is prone to a serial driver proc file information disclosure vulnerability. This issue is due to a design error that allows unprivileged access to potentially sensitive information.
This issue might allow an attacker to gain access to sensitive information such as user password lengths.
Exploit / POC
Linux Kernel Serial Driver Proc File Information Disclosure Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Linux Kernel Serial Driver Proc File Information Disclosure Vulnerability
Solution:
Debian has released an advisory (DSA 423-1) that addresses the issue that is described in this BID for the IA-64 architecture. Further details regarding obtaining and applying fixes can be found in the referenced advisory.
Red Hat has released advisory RHSA-2004:188-14 dealing with this and other issues for their enterprise linux distribution. Customers subscribed to the Red Hat Network may apply the appropriate fixes using the Red Hat Update Agent (up2date). Please see referenced advisory for additional information.
A Linux kernel upgrade is available that resolves this issue. As this issue affects only versions 2.4.X of the affected kernel, users are advised to upgrade to version 2.6.X.
SGI has released an advisory (20040505-01-U) with fixes to address this and other issues in SGI ProPack 2.4. Please see the referenced advisory for more information.
SGI has released an advisory (20040504-01-U) with fixes to address this and other issues in SGI ProPack 3.0. Please see the referenced advisory for more information.
Solution:
Debian has released an advisory (DSA 423-1) that addresses the issue that is described in this BID for the IA-64 architecture. Further details regarding obtaining and applying fixes can be found in the referenced advisory.
Red Hat has released advisory RHSA-2004:188-14 dealing with this and other issues for their enterprise linux distribution. Customers subscribed to the Red Hat Network may apply the appropriate fixes using the Red Hat Update Agent (up2date). Please see referenced advisory for additional information.
A Linux kernel upgrade is available that resolves this issue. As this issue affects only versions 2.4.X of the affected kernel, users are advised to upgrade to version 2.6.X.
SGI has released an advisory (20040505-01-U) with fixes to address this and other issues in SGI ProPack 2.4. Please see the referenced advisory for more information.
SGI has released an advisory (20040504-01-U) with fixes to address this and other issues in SGI ProPack 3.0. Please see the referenced advisory for more information.
References
Linux Kernel Serial Driver Proc File Information Disclosure Vulnerability
References:
References: