Secunia

Marco Ivaldi has reported a weakness in the Linux kernel, which can be exploited by malicious people to disclose certain system information and potentially to bypass certain security restrictions.

The weakness is caused due to an error within the "ip_push_pending_frames()" function when creating a packet in reply to a received SYN/ACK packet. This causes RST packets to be sent with a IP ID value that is incremented per packet. This can potentially be exploited to conduct idle scan attacks.

The weakness has been reported in the 2.4 and 2.6 kernel branches.

Solution
Update to version 2.6.16.1.
Further details available in Customer Area

Provided and/or discovered by
Marco Ivaldi

Original Advisory
Kernel.org:
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.1
http://www.kernel.org/git/?p=linux/kernel/git/stable/linux-2.6.16.y.git;a=commit;h=6f78133bf7a06845afee5bcdff7c276bbceaaf55

Deep Links
Links available in Customer Area