National Cyber Awareness System

Vulnerability Summary for CVE-2005-0400

Overview

The ext2_make_empty function call in the Linux kernel before 2.6.11.6 does not properly initialize memory when creating a block for a new directory entry, which allows local users to obtain potentially sensitive information by reading the block.

Impact

CVSS Severity (version 2.0 incomplete approximation):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: XF

Name: kernel-ext2-information-disclosure(19866)

Type: Patch Information

Hyperlink:http://xforce.iss.net/xforce/xfdb/19866

External Source: FEDORA

Name: FLSA:152532

Hyperlink:https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=152532

External Source: VUPEN

Name: ADV-2005-1878

Hyperlink:http://www.vupen.com/english/advisories/2005/1878

External Source: UBUNTU

Name: USN-103-1

Hyperlink:http://www.ubuntulinux.org/support/documentation/usn/usn-103-1

External Source: SECUNIA

Name: 14713

Hyperlink:http://secunia.com/advisories/14713/

External Source: OVAL

Name: oval:org.mitre.oval:def:10336

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10336

External Source: CONFIRM

Name: http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.11.6

Hyperlink:http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.11.6

External Source: MISC

Name: http://arkoon.net/advisories/ext2-make-empty-leak.txt

Type: Advisory

Hyperlink:http://arkoon.net/advisories/ext2-make-empty-leak.txt

External Source: BID

Name: 12932

Hyperlink:http://www.securityfocus.com/bid/12932

External Source: REDHAT

Name: RHSA-2006:0191

Hyperlink:http://www.redhat.com/support/errata/RHSA-2006-0191.html

External Source: REDHAT

Name: RHSA-2006:0190

Hyperlink:http://www.redhat.com/support/errata/RHSA-2006-0190.html

External Source: REDHAT

Name: RHSA-2005:663

Hyperlink:http://www.redhat.com/support/errata/RHSA-2005-663.html

External Source: REDHAT

Name: RHSA-2005:366

Hyperlink:http://www.redhat.com/support/errata/RHSA-2005-366.html

External Source: SECUNIA

Name: 18684

Hyperlink:http://secunia.com/advisories/18684

External Source: SECUNIA

Name: 17002

Hyperlink:http://secunia.com/advisories/17002

External Source: BUGTRAQ

Name: 20050401 Information leak in the Linux kernel ext2 implementation

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=111238764720696&w=2

References to Check Content

Identifier:oval:org.mitre.oval:def:10336

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:10336