Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2014.2095
kfreebsd-9 security update
10 November 2014
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: kfreebsd-9
Publisher: Debian
Operating System: Debian GNU/Linux 7
Impact/Access: Access Privileged Data -- Existing Account
Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2014-8476 CVE-2014-3953 CVE-2014-3952
CVE-2014-3711
Reference: ESB-2014.2059
ESB-2014.1937
ESB-2014.1112
Original Bulletin:
http://www.debian.org/security/2014/dsa-3070
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-3070-1 security@debian.org
http://www.debian.org/security/ Moritz Muehlenhoff
November 07, 2014 http://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : kfreebsd-9
CVE ID : CVE-2014-3711 CVE-2014-3952 CVE-2014-3953 CVE-2014-8476
Several vulnerabilities have been discovered in the FreeBSD kernel that
may lead to a denial of service or information disclosure.
CVE-2014-3711
Denial of service through memory leak in sandboxed namei lookups.
CVE-2014-3952
Kernel memory disclosure in sockbuf control messages.
CVE-2014-3953
Kernel memory disclosure in SCTP. This update disables SCTP, since the
userspace tools shipped in Wheezy didn't support SCTP anyway.
CVE-2014-8476
Kernel stack disclosure in setlogin() and getlogin().
For the stable distribution (wheezy), these problems have been fixed in
version 9.0-10+deb70.8.
We recommend that you upgrade your kfreebsd-9 packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBAgAGBQJUXQcdAAoJEBDCk7bDfE42nr0P/2IAF5Nixr8fo6yxraz35ddG
CG3b7rnguCi2SBJjGSD2na2VXlNTDMFKjm4NXchLYTJ6qhR8ECWY3+XmcmcwBm/p
ceHxo4PmmMMednzkj0qtZbmtyMaeA7pWR7EXSkyX89onzb1UuCNGEgkOi89+jjts
JxaE/MeGvezPm9kikkKUAZ0pyRw0TkwyMGXbNVMgbgq3OAyA0XHwMGhX139779oL
WiQfMIvxKbBgFxcvEm9BLcc6DZQTj7x2k8f5hTyO89gsnaoTb5jD63owKh//hjLj
rWhTkurTaJn5gJ2C3UFlN1XgMkRb7H3l1OKqnIOcvi0EG8vPu4HxDtKi/uSqHu+K
4UDk/KmC1Llafpk7pVJvh5dqc9XxFAepxiNUFD3mZ34EO9Eecf0Qs4SBRH1SRS+F
pdtSq6JGhW7aWIHpM/BOjE0CZssRE96wdSqL8AJFvToxtQI+Z14mbUPP4Y33lNlM
4PIjKIAT3TGO+jusvH5IDAkBk4M1Ce9u2AeuoIi0R+dD1u7OgiA5wbSfET2QlZk0
8Mo2URFl/psaVZ7WRbmIXW5eVDmnqIDoDFKgqM9M/Vx+cU7ViT/ZkGTJY06AU1zp
HVDfnM9OsUboWcKaphzTARh9PqhREpQAbWCLbp/o0YfLK+e4H6n+UI+OZTtpmWTm
jfs/VK7bLDzUPCP0/bfe
=yvgP
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBVGADShLndAQH1ShLAQIe2w//d9nVZ90ybZnN1a1lS8qtTlX2daORvs/w
vhczij7eUYylyFYSo2TDuxry3N4CuNF6v9llm6a1j/rYRa9h64uF/4MHPVRBHScn
fXjoI/cuKRftS4etDu/m5i0s9OODkES2ckGHFFWnTvc004fMWKNFR+xuim1JyKVN
i2bOeFzQlXDB8ZJouXfunr7CWzhSYN6q38KC/2a1hofvgSGPTmrFqnhB+WWFbDBB
eFz74qidlGKAd4tXPKSqJ/Grj/tReHfAnqbXkVSazZrguoctNDrUKAaJP45oMnve
wnnWehkR9Tc1opokgkON3Fm89YxKWhh836JqVZ9/oqYd0UHjGSZ/VyM1vZ4pldCt
0ZSEkaHKvTdqaXySv7XroVFotgXEyPipqtz1ocTr2Xd++BlQZvFbN7losUEeqhvD
EOkWd9+gnV+bkOJz4HtNQhr2532STlWcyviQ+6CsqRvvOXJcdPsPFTXGFY/aL4Gy
T9FQ5mnBDui5MkG1iLtwrONfYO6AJpfSDG8Ry91d065lFpvs/x6iHKyzbn1m5137
2dRGj4Pe3JTq1pr/fl+BP6x8BuKQ6Ean964jqqMDgkodCy3+1SC/EUvH6eMtx+ov
hnmHus6PhJZj8OVyzvsPdcxUkR2F4lasAnX3wRkNhdZyGBYAgZwoWYEjX0ZeSdjq
YneqNRSGFEU=
=zYLb
-----END PGP SIGNATURE-----