Scientific Linux Security Update : kernel on SL5.x i386/x86_64

This script is Copyright (C) 2012-2014 Tenable Network Security, Inc.


Synopsis :

The remote Scientific Linux host is missing one or more security
updates.

Description :

This update fixes the following security issues :

- instances of unsafe sprintf() use were found in the
Linux kernel Bluetooth implementation. Creating a large
number of Bluetooth L2CAP, SCO, or RFCOMM sockets could
result in arbitrary memory pages being overwritten. A
local, unprivileged user could use this flaw to cause a
kernel panic (denial of service) or escalate their
privileges. (CVE-2010-1084, Important)

- a flaw was found in the Xen hypervisor implementation
when using the Intel Itanium architecture, allowing
guests to enter an unsupported state. An unprivileged
guest user could trigger this flaw by setting the BE
(Big Endian) bit of the Processor Status Register (PSR),
leading to the guest crashing (denial of service).
(CVE-2010-2070, Important)

- a flaw was found in the CIFSSMBWrite() function in the
Linux kernel Common Internet File System (CIFS)
implementation. A remote attacker could send a specially
crafted SMB response packet to a target CIFS client,
resulting in a kernel panic (denial of service).
(CVE-2010-2248, Important)

- buffer overflow flaws were found in the Linux kernel's
implementation of the server-side External Data
Representation (XDR) for the Network File System (NFS)
version 4. An attacker on the local network could send a
specially crafted large compound request to the NFSv4
server, which could possibly result in a kernel panic
(denial of service) or, potentially, code execution.
(CVE-2010-2521, Important)

- a flaw was found in the handling of the SWAPEXT IOCTL in
the Linux kernel XFS file system implementation. A local
user could use this flaw to read write-only files, that
they do not own, on an XFS file system. This could lead
to unintended information disclosure. (CVE-2010-2226,
Moderate)

- a flaw was found in the dns_resolver upcall used by
CIFS. A local, unprivileged user could redirect a
Microsoft Distributed File System link to another IP
address, tricking the client into mounting the share
from a server of the user's choosing. (CVE-2010-2524,
Moderate)

- a missing check was found in the mext_check_arguments()
function in the ext4 file system code. A local user
could use this flaw to cause the MOVE_EXT IOCTL to
overwrite the contents of an append-only file on an ext4
file system, if they have write permissions for that
file. (CVE-2010-2066, Low)

The system must be rebooted for this update to take effect.

See also :

http://www.nessus.org/u?6083e1f4

Solution :

Update the affected packages.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)

Family: Scientific Linux Local Security Checks

Nessus Plugin ID: 60834 ()

Bugtraq ID:

CVE ID: CVE-2010-1084
CVE-2010-2066
CVE-2010-2070
CVE-2010-2226
CVE-2010-2248
CVE-2010-2521
CVE-2010-2524