Amazon Linux AMI : kernel Multiple Vulnerabilities (ALAS-2014-289)

This script is Copyright (C) 2014 Tenable Network Security, Inc.


Synopsis :

The remote Amazon Linux AMI host is missing a security update.

Description :

SELinux: local denial-of-service (CVE-2014-1874)

cifs: incorrect handling of bogus user pointers during uncached writes
(CVE-2014-0069)

The pn_recvmsg function in net/phonet/datagram.c in the Linux kernel
before 3.12.4 updates a certain length value before ensuring that an
associated data structure has been initialized, which allows local
users to obtain sensitive information from kernel stack memory via a
(1) recvfrom, (2) recvmmsg, or (3) recvmsg system call
(CVE-2013-7265).

The Linux kernel before 3.12.4 updates certain length values before
ensuring that associated data structures have been initialized, which
allows local users to obtain sensitive information from kernel stack
memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call,
related to net/ipv4/ping.c, net/ipv4/raw.c, net/ipv4/udp.c,
net/ipv6/raw.c, and net/ipv6/udp.c (CVE-2013-7263).

See also :

http://www.nessus.org/u?6d552381

Solution :

Run 'yum update kernel' to update your system.

Risk factor :

Medium / CVSS Base Score : 6.2
(CVSS2#AV:L/AC:H/Au:N/C:C/I:C/A:C)

Family: Amazon Linux Local Security Checks

Nessus Plugin ID: 72745 ()

Bugtraq ID:

CVE ID: CVE-2013-7263
CVE-2013-7265
CVE-2014-0069
CVE-2014-1874