SGI IRIX mapelf32exec denial of service
| irix-mapelf32exec-dos (16416) |  Medium Risk |
Description:
SGI IRIX is vulnerable to a denial of service attack, caused by vulnerability in the mapelf32exec function. A local attacker could use this vulnerability to cause the system to crash.
Consequences:
Denial of Service
Remedy:
Upgrade to the latest version of IRIX (6.5.25 or later), when available, as listed in SGI Security Advisory 20040601. See References.
— OR—
Apply the appropriate patch for your system, as listed in SGI Security Advisory 20040601. See References.
For Red Hat Linux:
Upgrade to the latest kernel package, as listed below. Refer to RHSA-2004:549-10 for more information. See References.
Red Hat Enterprise Linux Desktop and ES, AS, WS (v. 3): 2.4.21-20.0.1.EL or later
References:
- CIAC Information Bulletin O-167: SGI - System Call SGI_IOPROBE Vulnerability.
- CIAC Information Bulletin P-047: Red Hat Updated Kernel Packages.
- SGI Security Advisory 20040601: syssgi system call vulnerability and other security fixes.
- BID-10547: SGI IRIX Undisclosed MapElf32Exec Local Denial Of Service Vulnerability
- CVE-2004-0136: The mapelf32exec function call in IRIX 6.5.20 through 6.5.24 allows local users to cause a denial of service (system crash) via a corrupted binary.
- OSVDB ID: 7123: IRIX mapelf32exec Function Local DoS
- SA11872: SGI IRIX Privilege Escalation and Denial of Service Vulnerabilities
Platforms Affected:
- RedHat Enterprise Linux 3 AS
- RedHat Enterprise Linux 3 ES
- RedHat Enterprise Linux 3 WS
- SGI IRIX 6.5.20f
- SGI IRIX 6.5.20m
- SGI IRIX 6.5.21f
- SGI IRIX 6.5.21m
- SGI IRIX 6.5.22
- SGI IRIX 6.5.23
- SGI IRIX 6.5.24
Reported:
Jun 14, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net