CVE-2005-3181

Name	CVE-2005-3181
Description	The audit system in Linux kernel 2.6.6, and other versions before 2.6.13.4, when CONFIG_AUDITSYSCALL is enabled, uses an incorrect function to free names_cache memory, which prevents the memory from being tracked by AUDITSYSCALL code and leads to a memory leak that allows attackers to cause a denial of service (memory consumption).
Source	CVE (at NVD; oss-sec, fulldisc, OSVDB, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, more)
References	DSA-1017-1
NVD severity	low (attack range: local)
Debian/oldstable	not vulnerable.
Debian/stable	not known to be vulnerable.
Debian/testing	not known to be vulnerable.
Debian/unstable	not known to be vulnerable.

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
linux-2.6 (PTS)	squeeze (security), squeeze	2.6.32-48squeeze6	fixed
	squeeze (lts)	2.6.32-48squeeze11	fixed

The information above is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin
kernel-source-2.4.27	source	(unstable)	(not affected)
kernel-source-2.6.8	source	sarge	2.6.8-16sarge2	low	DSA-1017-1
linux-2.6	source	(unstable)	2.6.13+2.6.14-rc4-0experimental1	low

- kernel-source-2.4.27 <not-affected> (2.4 kernels don't have CONFIG_AUDITSYSCALL)