Oracle Linux 5 : kernel (ELSA-2011-0833)

This script is Copyright (C) 2013-2014 Tenable Network Security, Inc.


Synopsis :

The remote Oracle Linux host is missing one or more security updates.

Description :

From Red Hat Security Advisory 2011:0833 :

Updated kernel packages that fix multiple security issues and several
bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS)
base scores, which give detailed severity ratings, are available for
each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux
operating system.

This update fixes the following security issues :

* A flaw in the dccp_rcv_state_process() function could allow a remote
attacker to cause a denial of service, even when the socket was
already closed. (CVE-2011-1093, Important)

* Multiple buffer overflow flaws were found in the Linux kernel's
Management Module Support for Message Passing Technology (MPT) based
controllers. A local, unprivileged user could use these flaws to cause
a denial of service, an information leak, or escalate their
privileges. (CVE-2011-1494, CVE-2011-1495, Important)

* A missing validation of a null-terminated string data structure
element in the bnep_sock_ioctl() function could allow a local user to
cause an information leak or a denial of service. (CVE-2011-1079,
Moderate)

* Missing error checking in the way page tables were handled in the
Xen hypervisor implementation could allow a privileged guest user to
cause the host, and the guests, to lock up. (CVE-2011-1166, Moderate)

* A flaw was found in the way the Xen hypervisor implementation
checked for the upper boundary when getting a new event channel port.
A privileged guest user could use this flaw to cause a denial of
service or escalate their privileges. (CVE-2011-1763, Moderate)

* The start_code and end_code values in '/proc/[pid]/stat' were not
protected. In certain scenarios, this flaw could be used to defeat
Address Space Layout Randomization (ASLR). (CVE-2011-0726, Low)

* A missing initialization flaw in the sco_sock_getsockopt() function
could allow a local, unprivileged user to cause an information leak.
(CVE-2011-1078, Low)

* A missing validation of a null-terminated string data structure
element in the do_replace() function could allow a local user who has
the CAP_NET_ADMIN capability to cause an information leak.
(CVE-2011-1080, Low)

* A buffer overflow flaw in the DEC Alpha OSF partition implementation
in the Linux kernel could allow a local attacker to cause an
information leak by mounting a disk that contains specially-crafted
partition tables. (CVE-2011-1163, Low)

* Missing validations of null-terminated string data structure
elements in the do_replace(), compat_do_replace(), do_ipt_get_ctl(),
do_ip6t_get_ctl(), and do_arpt_get_ctl() functions could allow a local
user who has the CAP_NET_ADMIN capability to cause an information
leak. (CVE-2011-1170, CVE-2011-1171, CVE-2011-1172, Low)

* A heap overflow flaw in the Linux kernel's EFI GUID Partition Table
(GPT) implementation could allow a local attacker to cause a denial of
service by mounting a disk that contains specially-crafted partition
tables. (CVE-2011-1577, Low)

Red Hat would like to thank Dan Rosenberg for reporting CVE-2011-1494
and CVE-2011-1495
Vasiliy Kulikov for reporting CVE-2011-1079,
CVE-2011-1078, CVE-2011-1080, CVE-2011-1170, CVE-2011-1171, and
CVE-2011-1172
Kees Cook for reporting CVE-2011-0726
and Timo Warns
for reporting CVE-2011-1163 and CVE-2011-1577.

This update also fixes several bugs. Documentation for these bug fixes
will be available shortly from the Technical Notes document linked to
in the References section.

Users should upgrade to these updated packages, which contain
backported patches to correct these issues, and fix the bugs noted in
the Technical Notes. The system must be rebooted for this update to
take effect.

See also :

https://oss.oracle.com/pipermail/el-errata/2011-June/002158.html

Solution :

Update the affected kernel packages.

Risk factor :

High / CVSS Base Score : 7.8
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS Temporal Score : 6.8
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : false