Gentoo Full Text Bug Listing

------- Comment #1 From Thierry Carrez (RETIRED) 2004-12-14 08:58:06 0000 -------

Separating the two issues. this one will be for the IGMP one :

Synopsis:  Linux kernel IGMP vulnerabilities
Product:   Linux kernel
Version:   2.4 up to and including 2.4.28, 2.6 up to and including 2.6.9
Vendor:    http://www.kernel.org/
URL:       http://isec.pl/vulnerabilities/isec-0018-igmp.txt
CVE:       CAN-2004-1137
Author:    Paul Starzetz <ihaquer@isec.pl>
Date:      Dec 14, 2004

BK changesets :
http://linux.bkbits.net:8080/linux-2.4/cset@41b76e94BsJKm8jhVtyDat9ZM1dXXg
http://linux.bkbits.net:8080/linux-2.6/cset@41b768d1ySHbfa7cUWDle8NjDT_02A
http://linux.bkbits.net:8080/linux-2.6/cset@41b76c07Ee61GkoNwMH-oOvWG2FdxA

------- Comment #2 From Thierry Carrez (RETIRED) 2004-12-14 09:03:35 0000 -------

*** Bug 73210 has been marked as a duplicate of this bug. ***

------- Comment #3 From solar 2004-12-14 22:19:54 0000 -------

The BK changesets in comment #1 appear to be for isec-0019-scm

------- Comment #4 From Thierry Carrez (RETIRED) 2004-12-15 00:41:24 0000 -------

Yes, you're right... I was confused by those CMSG/IGMP stuff. Latest patch by
Chris Wright follows.

------- Comment #5 From Thierry Carrez (RETIRED) 2004-12-15 00:42:02 0000 -------

Created an attachment (id=46018) [details]
CAN-2004-1137.patch

Patch by Chris Wright (chrisw@osdl.org)

------- Comment #6 From Christian Birchinger 2004-12-15 02:17:00 0000 -------

Any version for 2.4.28 available? Attachment 46018 [details] doesn't apply on it.

------- Comment #7 From Tor Klingberg 2004-12-16 07:18:12 0000 -------

Any fixed version coming to portage?

------- Comment #8 From Tor Klingberg 2004-12-16 07:21:42 0000 -------

Ah, sorry. gentoo-dev-sources-2.6.9-r10 has the fix, but is masked. May I
suggest unmasking?

------- Comment #9 From Christian Birchinger 2004-12-16 12:10:08 0000 -------

sparc-sources 2.4.28-r2 are patched

------- Comment #10 From Tim Yamin (RETIRED) 2004-12-24 07:08:13 0000 -------

Doesn't affect <= 2.4.21...

------- Comment #11 From Adam Mondl (RETIRED) 2004-12-24 13:11:15 0000 -------

Patched in ~x86 hardened-sources-2.4.28-r1

------- Comment #12 From Tim Yamin (RETIRED) 2004-12-24 16:35:19 0000 -------

Ok, all patched - the following externally maintained sources still need
patching:

gentoo-dev-sources-2.6.7 -- Adding dsd...
hppa(-dev)-sources -- Adding GMSoft...
mips-sources -- Adding `Kumba...
openmosix-sources -- Adding cluster herd...
pegasos-dev-sources -- Adding dholm...
rsbac(-dev)-sources -- Adding kang...

------- Comment #13 From Adam Mondl (RETIRED) 2004-12-24 17:00:53 0000 -------

hardened-dev-sources-r18 fixed

------- Comment #14 From Daniel Drake 2004-12-24 18:51:33 0000 -------

gentoo-dev-sources 2.6.8 (not 2.6.7) is eradicators deal

------- Comment #15 From Daniel Drake 2004-12-24 19:22:11 0000 -------

Sorry, sparc is actually on 2.6.9 and already done

------- Comment #16 From David Holm (RETIRED) 2004-12-25 05:29:21 0000 -------

pegasos-dev-sources fixed

------- Comment #17 From Guy Martin 2004-12-27 06:27:40 0000 -------

2.4 is dropped on hppa and I've added 2.6.10-pa1 which doesn't seems affected
by this problem.

------- Comment #18 From Konstantin Arkhipov 2004-12-27 08:49:24 0000 -------

done in oM6-sources.

------- Comment #19 From Joshua Kinard 2005-01-05 21:21:16 0000 -------

mips-sources fixed.

------- Comment #20 From Guillaume Destuynder (RETIRED) 2005-01-13 16:04:34 0000 -------

rsbac-dev-sources/rsbac-sources patched

------- Comment #21 From Tim Yamin (RETIRED) 2005-01-15 14:49:30 0000 -------

kang: 2.6.10 and 2.4.28-r2 need stabilizing...

------- Comment #22 From Guillaume Destuynder (RETIRED) 2005-01-18 13:14:48 0000 -------

Tim Yamin : I'm working on it. Didn't had inet the past weeks due to a big isp
failure.. i just got it back today.
I was able to commit a few things in between ;)
will get that ready before 2005.0 snapshot (luckily isp doesn't fails tomorrow
again ;)

------- Comment #23 From Thierry Carrez (RETIRED) 2005-03-16 03:16:26 0000 -------

Mass-Ccing kern-sec@gentoo.org to make sure Kernel Security guys know about all
of these...

------- Comment #24 From Tim Yamin (RETIRED) 2005-03-16 06:05:04 0000 -------

All fixed, closing bug.

Bug#: 74384	Product: Gentoo Security	Version: unspecified	Platform: All
OS/Version: All	Status: RESOLVED	Severity: normal	Priority: P2
Resolution: FIXED	Assigned To: security@gentoo.org	Reported By: christian.korff@gmail.com
Component: Kernel
URL: http://isec.pl/vulnerabilities/isec-0018-igmp.txt
Summary: Linux kernel IGMP vulnerabilities (CAN-2004-1137)
Keywords:
Status Whiteboard: [linux <2.6.10]
Opened: 2004-12-14 07:31 0000