[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20161024053334.GA4644@openwall.com>
Date: Mon, 24 Oct 2016 07:33:34 +0200
From: Solar Designer <solar@...nwall.com>
To: announce@...ts.openwall.com, owl-users@...ts.openwall.com
Subject: Owl security fixes: Linux kernel "Dirty COW", BIND DoS
Hi,
Linux kernel and BIND security updates are now available in Owl-current
and Owl 3.1-stable, documented as follows:
2016/10/23 Package: kernel
SECURITY FIX Severity: high, local, active
Added a mitigation for the "Dirty COW" Linux kernel privilege escalation
vulnerability (CVE-2016-5195).
References:
http://www.openwall.com/lists/oss-security/2016/10/21/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5195
2016/10/17 -
2016/10/21 Package: bind
SECURITY FIX Severity: low, remote, active
Merged multiple DoS vulnerability fixes from Red Hat's package, most
notably for two easily triggerable assertion failures (CVE-2016-2776,
CVE-2016-2848).
References:
http://www.openwall.com/lists/oss-security/2016/09/27/8
https://kb.isc.org/article/AA-01419
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2776
http://www.openwall.com/lists/oss-security/2016/10/20/7
https://kb.isc.org/article/AA-01433/74/CVE-2016-2848
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2848
These are currently available as source code changes and as pre-built
packages (in both branches, and for both i686 and x86_64), however there
are no updated ISOs and vztemplates yet.
The "Dirty COW" mitigation is likely non-final and possibly incomplete
(it addresses the MADV_DONTNEED vs. PTRACE_POKE* race, and possibly some
other scenarios), pending a properly tested backport of the official fix
(likely) by Red Hat, but given the urgency of the issue I felt it most
appropriate to start by releasing a non-invasive mitigation like this.
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
