#VU99946 Information exposure in Linux kernel - CVE-2004-0177
Vulnerability identifier: #VU99946
Vulnerability risk: Low
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2004-0177
CWE-ID:
CWE-200
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
Linux kernel
Operating systems & Components /
Operating system
Vendor: Linux Foundation
Description
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The ext3 code in Linux 2.4.x before 2.4.26 does not properly initialize journal descriptor blocks, which causes an information leak in which in-memory data is written to the device for the ext3 file system, which allows privileged users to obtain portions of kernel memory by reading the raw device.
Mitigation
Install update from vendor's repository.
Vulnerable software versions
Linux kernel: All versions
External links
https://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000846
https://linux.bkbits.net:8080/linux-2.4/cset@4056b368s6vpJbGWxDD_LhQNYQrdzQ
https://marc.info/?l=bugtraq&m=108213675028441&w=2
https://rhn.redhat.com/errata/RHSA-2004-166.html
https://security.gentoo.org/glsa/glsa-200407-02.xml
https://www.ciac.org/ciac/bulletins/o-121.shtml
https://www.ciac.org/ciac/bulletins/o-126.shtml
https://www.ciac.org/ciac/bulletins/o-127.shtml
https://www.debian.org/security/2004/dsa-479
https://www.debian.org/security/2004/dsa-480
https://www.debian.org/security/2004/dsa-481
https://www.debian.org/security/2004/dsa-482
https://www.debian.org/security/2004/dsa-489
https://www.debian.org/security/2004/dsa-491
https://www.debian.org/security/2004/dsa-495
https://www.linuxsecurity.com/advisories/engarde_advisory-4285.html
https://www.mandriva.com/security/advisories?name=MDKSA-2004:029
https://www.redhat.com/support/errata/RHSA-2004-504.html
https://www.redhat.com/support/errata/RHSA-2004-505.html
https://www.redhat.com/support/errata/RHSA-2005-293.html
https://www.securityfocus.com/bid/10152
https://bugzilla.fedora.us/show_bug.cgi?id=2336
https://exchange.xforce.ibmcloud.com/vulnerabilities/15867
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10556
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
