Linux Netfilter/IPTables IP Queuing Arbitrary Network Traffic Reading Vulnerability

Bugtraq ID:	6305
Class:	Origin Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Dec 03 2002 12:00AM
Updated:	Dec 03 2002 12:00AM
Credit:	Vulnerability announced by James Morris <[email protected]>.
Vulnerable:	Linux kernel 2.5.31 Linux kernel 2.5.30 Linux kernel 2.5.29 Linux kernel 2.5.28 Linux kernel 2.5.27 Linux kernel 2.5.26 Linux kernel 2.5.25 Linux kernel 2.5.24 Linux kernel 2.5.23 Linux kernel 2.5.22 Linux kernel 2.5.21 Linux kernel 2.5.20 Linux kernel 2.5.19 Linux kernel 2.5.18 Linux kernel 2.5.17 Linux kernel 2.5.16 Linux kernel 2.5.15 Linux kernel 2.5.14 Linux kernel 2.5.13 Linux kernel 2.5.12 Linux kernel 2.5.11 Linux kernel 2.5.10 Linux kernel 2.5.9 Linux kernel 2.5.8 Linux kernel 2.5.7 Linux kernel 2.5.6 Linux kernel 2.5.5 Linux kernel 2.5.4 Linux kernel 2.5.3 Linux kernel 2.5.2 Linux kernel 2.5.1 Linux kernel 2.5 .0 Linux kernel 2.4.19 + Conectiva Linux Enterprise Edition 1.0 + MandrakeSoft Corporate Server 2.1 x86_64 + MandrakeSoft Corporate Server 2.1 + MandrakeSoft Multi Network Firewall 2.0 + Mandriva Linux Mandrake 9.0 + Slackware Linux -current + SuSE Linux 8.1 + SuSE SUSE Linux Enterprise Server 8 + SuSE SUSE Linux Enterprise Server 7 Linux kernel 2.4.18 + Astaro Security Linux 2.0 23 + Astaro Security Linux 2.0 16 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Mandriva Linux Mandrake 8.2 + Mandriva Linux Mandrake 8.1 + Mandriva Linux Mandrake 8.0 + Redhat Advanced Workstation for the Itanium Processor 2.1 IA64 + Redhat Advanced Workstation for the Itanium Processor 2.1 + Redhat Enterprise Linux AS 2.1 IA64 + Redhat Linux 8.0 + Redhat Linux 7.3 + S.u.S.E. Linux Connectivity Server + S.u.S.E. Linux Database Server 0 + S.u.S.E. Linux Firewall on CD + S.u.S.E. Linux Office Server + S.u.S.E. Linux Personal 8.2 + S.u.S.E. SuSE eMail Server 3.1 + S.u.S.E. SuSE eMail Server III + SuSE Linux 8.1 + SuSE Linux 8.0 + SuSE Linux 7.3 + SuSE Linux 7.2 + SuSE Linux 7.1 + SuSE Linux Openexchange Server + SuSE SUSE Linux Enterprise Server 8 + SuSE SUSE Linux Enterprise Server 7 + Turbolinux Turbolinux Server 8.0 + Turbolinux Turbolinux Server 7.0 + Turbolinux Turbolinux Workstation 8.0 + Turbolinux Turbolinux Workstation 7.0 Linux kernel 2.4.17 Linux kernel 2.4.16 + Sun Cobalt RaQ 550 Linux kernel 2.4.15 Linux kernel 2.4.14 Linux kernel 2.4.13 + Caldera OpenLinux Server 3.1.1 + Caldera OpenLinux Workstation 3.1.1 Linux kernel 2.4.12 Linux kernel 2.4.11 Linux kernel 2.4.10 + SuSE Linux 7.3 Linux kernel 2.4.9 + Redhat Enterprise Linux AS 2.1 IA64 + Redhat Enterprise Linux AS 2.1 + Redhat Enterprise Linux ES 2.1 IA64 + Redhat Enterprise Linux ES 2.1 + Redhat Enterprise Linux WS 2.1 IA64 + Redhat Enterprise Linux WS 2.1 + Redhat Linux 7.2 ia64 + Redhat Linux 7.2 i386 + Redhat Linux 7.2 alpha + Redhat Linux 7.1 ia64 + Redhat Linux 7.1 i386 + Redhat Linux 7.1 alpha + Sun Linux 5.0.5 + Sun Linux 5.0.3 + Sun Linux 5.0 Linux kernel 2.4.8 + Mandriva Linux Mandrake 8.2 + Mandriva Linux Mandrake 8.1 + Mandriva Linux Mandrake 8.0 Linux kernel 2.4.7 + Redhat Linux 7.2 + SuSE Linux 7.2 + SuSE Linux 7.1 Linux kernel 2.4.6 Linux kernel 2.4.5 + Slackware Linux 8.0 Linux kernel 2.4.4 + SuSE Linux 7.2 Linux kernel 2.4.3 + Mandriva Linux Mandrake 8.0 ppc + Mandriva Linux Mandrake 8.0 Linux kernel 2.4.2 + Caldera OpenLinux Server 3.1 + Caldera OpenLinux Workstation 3.1 + Redhat Linux 7.1 i386 + Redhat Linux 7.1 alpha Linux kernel 2.4.1 Linux kernel 2.4
Not Vulnerable:	Linux kernel 2.5.32 Linux kernel 2.4.20 + CRUX CRUX Linux 1.0 + Gentoo Linux 1.4 + Gentoo Linux 1.2 + Redhat Linux 9.0 i386 + Slackware Linux 9.0 + WOLK WOLK 4.4 s

Linux Netfilter/IPTables IP Queuing Arbitrary Network Traffic Reading Vulnerability

IPTables and Netfilter are the firewall infrastructure developed for the Linux kernel.

The IP Queuing module requires a privileged process to communicate with user space to handle the queuing of network traffic on the local host. Insufficient checking of the integrity of the privileged process is performed. This could lead to a local user gaining access to information meant for the privileged process.

Linux Netfilter/IPTables IP Queuing Arbitrary Network Traffic Reading Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Linux Netfilter/IPTables IP Queuing Arbitrary Network Traffic Reading Vulnerability

Solution:
This problem has been resolved in kernels 2.4.20 and 2.5.32.

It should be noted that an ext3 corruption bug exists in kernel 2.4.20. Users needing ext3 with IP Queuing have been advised to wait for kernel 2.4.21.

Fixes available:


Linux kernel 2.4.1

• Linux linux-2.4.20.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.4/linux-2.4.20.tar.gz

Linux kernel 2.4.10

• Linux linux-2.4.20.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.4/linux-2.4.20.tar.gz

Linux kernel 2.4.11

• Linux linux-2.4.20.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.4/linux-2.4.20.tar.gz

Linux kernel 2.4.12

• Linux linux-2.4.20.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.4/linux-2.4.20.tar.gz

Linux kernel 2.4.13

• Linux linux-2.4.20.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.4/linux-2.4.20.tar.gz

Linux kernel 2.4.14

• Linux linux-2.4.20.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.4/linux-2.4.20.tar.gz

Linux kernel 2.4.15

• Linux linux-2.4.20.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.4/linux-2.4.20.tar.gz

Linux kernel 2.4.16

• Linux linux-2.4.20.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.4/linux-2.4.20.tar.gz

Linux kernel 2.4.17

• Linux linux-2.4.20.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.4/linux-2.4.20.tar.gz

Linux kernel 2.4.18

• Linux linux-2.4.20.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.4/linux-2.4.20.tar.gz

Linux kernel 2.4.19

• Linux linux-2.4.20.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.4/linux-2.4.20.tar.gz

Linux kernel 2.4.2

• Linux linux-2.4.20.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.4/linux-2.4.20.tar.gz

Linux kernel 2.4.3

• Linux linux-2.4.20.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.4/linux-2.4.20.tar.gz

Linux kernel 2.4.4

• Linux linux-2.4.20.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.4/linux-2.4.20.tar.gz

Linux kernel 2.4.5

• Linux linux-2.4.20.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.4/linux-2.4.20.tar.gz

Linux kernel 2.4.6

• Linux linux-2.4.20.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.4/linux-2.4.20.tar.gz

Linux kernel 2.4.7

• Linux linux-2.4.20.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.4/linux-2.4.20.tar.gz

Linux kernel 2.4.8

• Linux linux-2.4.20.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.4/linux-2.4.20.tar.gz

Linux kernel 2.4.9

• Linux linux-2.4.20.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.4/linux-2.4.20.tar.gz

Linux kernel 2.5 .0

• Linux linux-2.5.32.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.5/linux-2.5.32.tar.gz

Linux kernel 2.5.1

• Linux linux-2.5.32.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.5/linux-2.5.32.tar.gz

Linux kernel 2.5.10

• Linux linux-2.5.32.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.5/linux-2.5.32.tar.gz

Linux kernel 2.5.11

• Linux linux-2.5.32.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.5/linux-2.5.32.tar.gz

Linux kernel 2.5.12

• Linux linux-2.5.32.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.5/linux-2.5.32.tar.gz

Linux kernel 2.5.13

• Linux linux-2.5.32.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.5/linux-2.5.32.tar.gz

Linux kernel 2.5.14

• Linux linux-2.5.32.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.5/linux-2.5.32.tar.gz

Linux kernel 2.5.15

• Linux linux-2.5.32.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.5/linux-2.5.32.tar.gz

Linux kernel 2.5.16

• Linux linux-2.5.32.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.5/linux-2.5.32.tar.gz

Linux kernel 2.5.17

• Linux linux-2.5.32.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.5/linux-2.5.32.tar.gz

Linux kernel 2.5.18

• Linux linux-2.5.32.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.5/linux-2.5.32.tar.gz

Linux kernel 2.5.19

• Linux linux-2.5.32.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.5/linux-2.5.32.tar.gz

Linux kernel 2.5.2

• Linux linux-2.5.32.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.5/linux-2.5.32.tar.gz

Linux kernel 2.5.20

• Linux linux-2.5.32.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.5/linux-2.5.32.tar.gz

Linux kernel 2.5.21

• Linux linux-2.5.32.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.5/linux-2.5.32.tar.gz

Linux kernel 2.5.22

• Linux linux-2.5.32.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.5/linux-2.5.32.tar.gz

Linux kernel 2.5.23

• Linux linux-2.5.32.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.5/linux-2.5.32.tar.gz

Linux kernel 2.5.24

• Linux linux-2.5.32.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.5/linux-2.5.32.tar.gz

Linux kernel 2.5.25

• Linux linux-2.5.32.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.5/linux-2.5.32.tar.gz

Linux kernel 2.5.26

• Linux linux-2.5.32.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.5/linux-2.5.32.tar.gz

Linux kernel 2.5.27

• Linux linux-2.5.32.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.5/linux-2.5.32.tar.gz

Linux kernel 2.5.28

• Linux linux-2.5.32.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.5/linux-2.5.32.tar.gz

Linux kernel 2.5.29

• Linux linux-2.5.32.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.5/linux-2.5.32.tar.gz

Linux kernel 2.5.3

• Linux linux-2.5.32.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.5/linux-2.5.32.tar.gz

Linux kernel 2.5.30

• Linux linux-2.5.32.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.5/linux-2.5.32.tar.gz

Linux kernel 2.5.31

• Linux linux-2.5.32.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.5/linux-2.5.32.tar.gz

Linux kernel 2.5.4

• Linux linux-2.5.32.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.5/linux-2.5.32.tar.gz

Linux kernel 2.5.5

• Linux linux-2.5.32.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.5/linux-2.5.32.tar.gz

Linux kernel 2.5.6

• Linux linux-2.5.32.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.5/linux-2.5.32.tar.gz

Linux kernel 2.5.7

• Linux linux-2.5.32.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.5/linux-2.5.32.tar.gz

Linux kernel 2.5.8

• Linux linux-2.5.32.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.5/linux-2.5.32.tar.gz

Linux kernel 2.5.9

• Linux linux-2.5.32.tar.gz
  http://www.kernel.org/pub/linux/kernel/v2.5/linux-2.5.32.tar.gz

Linux Netfilter/IPTables IP Queuing Arbitrary Network Traffic Reading Vulnerability

References:

• NetFilter Homepage (Linux NetFilter Developers)
  
• Local Netfilter / IPTables IP Queue PID Wrap Flaw (James Morris )
  
• Re: Local Netfilter / IPTables IP Queue PID Wrap Flaw (James Morris )