[Ksplice][RHEL 4 Updates] New updates available via Ksplice (RHSA-2010:0936)

[Nelson Elhage]

Synopsis: RHSA-2010:0936 can now be patched using Ksplice
CVEs: CVE-2010-3432 CVE-2010-3442
Red Hat Security Advisory Severity: Important

Systems running Red Hat Enterprise Linux 4, CentOS 4, and CentOSPlus 4
can now use Ksplice to patch against the latest Red Hat Security
Advisory, RHSA-2010:0936.

INSTALLING THE UPDATES

We recommend that all Ksplice Uptrack RHEL 4, CentOS 4, and CentOSPlus
4 users install these updates.  You can install these updates by
running:

# uptrack-upgrade -y

DESCRIPTION

* CVE-2010-3442: Integer overflow in snd_ctl_new.

A missing integer overflow check in snd_ctl_new() in the Linux kernel's sound
subsystem could allow a local, unprivileged user on a 32-bit system to cause a
denial of service or escalate their privileges. (CVE-2010-3442, Important)


* CVE-2010-3432: Remote DoS in sctp_packet_config.

A flaw in sctp_packet_config() in the Linux kernel's Stream Control Transmission
Protocol (SCTP) implementation could allow a remote attacker to cause a denial
of service. (CVE-2010-3432, Important)


* Kernel panic in netif_receive_skb.

Erroneous pointer checks could have caused a kernel panic. This was due to a
critical value not being copied when a network buffer was duplicated and
consumed by multiple portions of the kernel's network stack.

SUPPORT

Ksplice support is available at support at ksplice.com or +1 765-577-5423.