Scientific Linux Security Update : kernel on SL4.x i386/x86_64

This script is Copyright (C) 2012-2014 Tenable Network Security, Inc.


Synopsis :

The remote Scientific Linux host is missing one or more security
updates.

Description :

This update fixes the following security issues :

- a NULL pointer dereference flaw was found in the
sctp_rcv_ootb() function in the Linux kernel Stream
Control Transmission Protocol (SCTP) implementation. A
remote attacker could send a specially crafted SCTP
packet to a target system, resulting in a denial of
service. (CVE-2010-0008, Important)

- a NULL pointer dereference flaw was found in the Linux
kernel. During a core dump, the kernel did not check if
the Virtual Dynamically-linked Shared Object page was
accessible. On Intel 64 and AMD64 systems, a local,
unprivileged user could use this flaw to cause a kernel
panic by running a crafted 32-bit application.
(CVE-2009-4271, Important)

- an information leak was found in the
print_fatal_signal() implementation in the Linux kernel.
When '/proc/sys/kernel/print-fatal-signals' is set to 1
(the default value is 0), memory that is reachable by
the kernel could be leaked to user-space. This issue
could also result in a system crash. Note that this flaw
only affected the i386 architecture. (CVE-2010-0003,
Moderate)

- on AMD64 systems, it was discovered that the kernel did
not ensure the ELF interpreter was available before
making a call to the SET_PERSONALITY macro. A local
attacker could use this flaw to cause a denial of
service by running a 32-bit application that attempts to
execute a 64-bit application. (CVE-2010-0307, Moderate)

- missing capability checks were found in the ebtables
implementation, used for creating an Ethernet bridge
firewall. This could allow a local, unprivileged user to
bypass intended capability restrictions and modify
ebtables rules. (CVE-2010-0007, Low)

This update also fixes the following bugs :

- under some circumstances, a locking bug could have
caused an online ext3 file system resize to deadlock,
which may have, in turn, caused the file system or the
entire system to become unresponsive. In either case, a
reboot was required after the deadlock. With this
update, using resize2fs to perform an online resize of
an ext3 file system works as expected. (BZ#553135)

- some ATA and SCSI devices were not honoring the
barrier=1 mount option, which could result in data loss
after a crash or power loss. This update applies a patch
to the Linux SCSI driver to ensure ordered write
caching. This solution does not provide cache flushes

however, it does provide data integrity on devices that
have no write caching (or where write caching is
disabled) and no command queuing. For systems that have
command queuing or write cache enabled there is no
guarantee of data integrity after a crash. (BZ#560563)

- it was found that lpfc_find_target() could loop
continuously when scanning a list of nodes due to a
missing spinlock. This missing spinlock allowed the list
to be changed after the list_empty() test, resulting in
a NULL value, causing the loop. This update adds the
spinlock, resolving the issue. (BZ#561453)

- the fix for CVE-2009-4538 provided by RHSA-2010:0020
introduced a regression, preventing Wake on LAN (WoL)
working for network devices using the Intel PRO/1000
Linux driver, e1000e. Attempting to configure WoL for
such devices resulted in the following error, even when
configuring valid options :

'Cannot set new wake-on-lan settings: Operation not
supported not setting wol'

This update resolves this regression, and WoL now works as expected
for network devices using the e1000e driver. (BZ#565496)

The system must be rebooted for this update to take effect.

See also :

http://www.nessus.org/u?5a25594c
https://bugzilla.redhat.com/show_bug.cgi?id=553135
https://bugzilla.redhat.com/show_bug.cgi?id=560563
https://bugzilla.redhat.com/show_bug.cgi?id=561453
https://bugzilla.redhat.com/show_bug.cgi?id=565496

Solution :

Update the affected packages.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)

Family: Scientific Linux Local Security Checks

Nessus Plugin ID: 60748 ()

Bugtraq ID:

CVE ID: CVE-2009-4271
CVE-2009-4538
CVE-2010-0003
CVE-2010-0007
CVE-2010-0008
CVE-2010-0307