Etherleak-Vulnerability in Woody ?

markus1982 · 05-04-2003, 11:17 AM

I just did a nessus scan (no firewall enabled on the target host) with a 100% up-to-date Woody install. I got a serious vulnerability warning:

Quote:

The remote host is vulnerable to an 'Etherleak' -
the remote ethernet driver seems to leak bits of the
content of the memory of the remote operating system.

Note that an attacker may take advantage of this flaw
only when its target is on the same physical subnet.

See also : http://www.atstake.com/research/advi.../a010603-1.txt
Solution : Contact your vendor for a fix
Risk factor : Serious
CVE : CAN-2003-0001
Nessus ID : 11197

I've been using Knoppix 3.2 from 28th April 2003 ... Nessus 2.01 is installed there.

Does anybody get similar results ?

markus1982 · 05-04-2003, 01:15 PM

This got fixed in 2.4.21 ... all versions prior 2.4.21 seem to be vulnerable (incl. 2.4.20)

markus1982 · 05-05-2003, 11:29 AM

I just got a reply from the maintainer of the kernel packages:

"This is already patched in the Debian kernels in stable-proposed-updates, testing and unstable."

unSpawn · 05-05-2003, 02:19 PM

Well done!
If someone posts other distro's status that'd be appreciated...

Red Hat fixed the padding bug in kernel-2.4.18-26.7*, released 03/20/2003 (RHSA-2003:025-20).