Scientific Linux Security Update : kernel on SL4.x i386/x86_64

This script is Copyright (C) 2012 Tenable Network Security, Inc.


Synopsis :

The remote Scientific Linux host is missing one or more security
updates.

Description :

This update fixes the following security issues :

- A heap overflow flaw was found in the Linux kernel's
Transparent Inter-Process Communication protocol (TIPC)
implementation. A local, unprivileged user could use
this flaw to escalate their privileges. (CVE-2010-3859,
Important)

- Missing sanity checks were found in gdth_ioctl_alloc()
in the gdth driver in the Linux kernel. A local user
with access to '/dev/gdth' on a 64-bit system could use
these flaws to cause a denial of service or escalate
their privileges. (CVE-2010-4157, Moderate)

- A NULL pointer dereference flaw was found in the
Bluetooth HCI UART driver in the Linux kernel. A local,
unprivileged user could use this flaw to cause a denial
of service. (CVE-2010-4242, Moderate)

- A flaw was found in the Linux kernel's garbage collector
for AF_UNIX sockets. A local, unprivileged user could
use this flaw to trigger a denial of service
(out-of-memory condition). (CVE-2010-4249, Moderate)

- Missing initialization flaws were found in the Linux
kernel. A local, unprivileged user could use these flaws
to cause information leaks. (CVE-2010-3876,
CVE-2010-4072, CVE-2010-4073, CVE-2010-4075,
CVE-2010-4080, CVE-2010-4083, CVE-2010-4158, Low)

This update also fixes the following bugs :

- A flaw was found in the Linux kernel where, if used in
conjunction with another flaw that can result in a
kernel Oops, could possibly lead to privilege
escalation. It does not affect Red Hat Enterprise Linux
4 as the sysctl panic_on_oops variable is turned on by
default. However, as a preventive measure if the
variable is turned off by an administrator, this update
addresses the issue. (BZ#659568)

- On Intel I/O Controller Hub 9 (ICH9) hardware, jumbo
frame support is achieved by using page-based sk_buff
buffers without any packet split. The entire frame data
is copied to the page(s) rather than some to the
skb->data area and some to the page(s) when performing a
typical packet-split. This caused problems with the
filtering code and frames were getting dropped before
they were received by listening applications. This bug
could eventually lead to the IP address being released
and not being able to be re-acquired from DHCP if the
MTU (Maximum Transfer Unit) was changed (for an affected
interface using the e1000e driver). With this update,
frames are no longer dropped and an IP address is
correctly re-acquired after a previous release.
(BZ#664667)

The system must be rebooted for this update to take effect.

See also :

http://www.nessus.org/u?e85585d8
https://bugzilla.redhat.com/show_bug.cgi?id=659568
https://bugzilla.redhat.com/show_bug.cgi?id=664667

Solution :

Update the affected packages.

Risk factor :

Medium / CVSS Base Score : 6.9
(CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)

Family: Scientific Linux Local Security Checks

Nessus Plugin ID: 60938 ()

Bugtraq ID:

CVE ID: CVE-2010-3859
CVE-2010-3876
CVE-2010-4072
CVE-2010-4073
CVE-2010-4075
CVE-2010-4080
CVE-2010-4083
CVE-2010-4157
CVE-2010-4158
CVE-2010-4242
CVE-2010-4249