A certain Red Hat configuration step for the qla2xxx driver in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5, when N_Port ID Virtualization (NPIV) hardware is used, sets world-writable permissions for the (1) vport_create and (2) vport_delete files under /sys/class/scsi_host/, which allows local users to make arbitrary changes to SCSI host attributes by modifying these files.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several components and third-party libraries :

  - libpng
  - VMnc Codec
  - vmrun
  - VMware Remote Console (VMrc)
  - VMware Tools
  - vmware-authd

From Red Hat Security Advisory 2010:0046 :

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security fixes :

* an array index error was found in the gdth driver. A local user could send a specially crafted IOCTL request that would cause a denial of service or, possibly, privilege escalation. (CVE-2009-3080, Important)

* a flaw was found in the FUSE implementation. When a system is low on memory, fuse_put_request() could dereference an invalid pointer, possibly leading to a local denial of service or privilege escalation.
(CVE-2009-4021, Important)

* Tavis Ormandy discovered a deficiency in the fasync_helper() implementation. This could allow a local, unprivileged user to leverage a use-after-free of locked, asynchronous file descriptors to cause a denial of service or privilege escalation. (CVE-2009-4141, Important)

* the Parallels Virtuozzo Containers team reported the RHSA-2009:1243 update introduced two flaws in the routing implementation. If an attacker was able to cause a large enough number of collisions in the routing hash table (via specially crafted packets) for the emergency route flush to trigger, a deadlock could occur. Secondly, if the kernel routing cache was disabled, an uninitialized pointer would be left behind after a route lookup, leading to a kernel panic.
(CVE-2009-4272, Important)

* the RHSA-2009:0225 update introduced a rewrite attack flaw in the do_coredump() function. A local attacker able to guess the file name a process is going to dump its core to, prior to the process crashing, could use this flaw to append data to the dumped core file. This issue only affects systems that have '/proc/sys/fs/suid_dumpable' set to 2 (the default value is 0). (CVE-2006-6304, Moderate)

The fix for CVE-2006-6304 changes the expected behavior: With suid_dumpable set to 2, the core file will not be recorded if the file already exists. For example, core files will not be overwritten on subsequent crashes of processes whose core files map to the same name.

* an information leak was found in the Linux kernel. On AMD64 systems, 32-bit processes could access and read certain 64-bit registers by temporarily switching themselves to 64-bit mode. (CVE-2009-2910, Moderate)

* the RHBA-2008:0314 update introduced N_Port ID Virtualization (NPIV) support in the qla2xxx driver, resulting in two new sysfs pseudo files, '/sys/class/scsi_host/[a qla2xxx host]/vport_create' and 'vport_delete'. These two files were world-writable by default, allowing a local user to change SCSI host attributes. This flaw only affects systems using the qla2xxx driver and NPIV capable hardware.
(CVE-2009-3556, Moderate)

* permission issues were found in the megaraid_sas driver. The 'dbg_lvl' and 'poll_mode_io' files on the sysfs file system ('/sys/') had world-writable permissions. This could allow local, unprivileged users to change the behavior of the driver. (CVE-2009-3889, CVE-2009-3939, Moderate)

* a NULL pointer dereference flaw was found in the firewire-ohci driver used for OHCI compliant IEEE 1394 controllers. A local, unprivileged user with access to /dev/fw* files could issue certain IOCTL calls, causing a denial of service or privilege escalation. The FireWire modules are blacklisted by default, and if enabled, only root has access to the files noted above by default. (CVE-2009-4138, Moderate)

* a buffer overflow flaw was found in the hfs_bnode_read() function in the HFS file system implementation. This could lead to a denial of service if a user browsed a specially crafted HFS file system, for example, by running 'ls'. (CVE-2009-4020, Low)

Bug fix documentation for this update will be available shortly from www.redhat.com/docs/en-US/errata/RHSA-2010-0046/Kernel_Security_Update / index.html

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

This update fixes lots of bugs and some security issues in the SUSE Linux Enterprise 10 SP 3 kernel.

  - A stack-based buffer overflow in the HFS subsystem of     the Linux kernel allows remote attackers to have an     unspecified impact via a crafted Hierarchical File     System (HFS) filesystem, related to the hfs_readdir()     function in fs/hfs/dir.c. CVE-2010-0410: The connector     netlink driver (drivers/connector/connector.c) of the     Linux kernel allows local users to cause a denial of     service (memory consumption or system crash) by sending     the kernel many NETLINK_CONNECTOR messages.
    CVE-2009-3556: A configuration value in the qla2xxx     driver of the Linux kernel when N_Port ID Virtualization     (NPIV) hardware is used, sets world-writable permissions     for the vport_create and vport_delete files under     /sys/class/scsi_host/, which allows local users to make     arbitrary changes to SCSI host attributes by modifying     these files. (CVE-2009-4020)

This update fixes a several security issues and various bugs in the SUSE Linux Enterprise 10 SP 2 kernel.

The following security issues were fixed :

  - Two sysfs filers in the qla2xxx driver were     worldwriteable, so users could change SCSI attributes of     the qla2xxx driver. CVE-2009-4536:
    drivers/net/e1000/e1000_main.c in the e1000 driver in     the Linux kernel handles Ethernet frames that exceed the     MTU by processing certain trailing payload data as if it     were a complete frame, which allows remote attackers to     bypass packet filters via a large packet with a crafted     payload. (CVE-2009-3556)

(The e1000e driver is not included in the SLES 10 SP2 kernel, so CVE-2009-4538 does not affect this kernel.)

a. Service Console update for COS kernel

   Updated COS package 'kernel' addresses the security issues that are    fixed through versions 2.6.18-164.11.1.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2009-2695, CVE-2009-2908, CVE-2009-3228,    CVE-2009-3286, CVE-2009-3547, CVE-2009-3613 to the security issues    fixed in kernel 2.6.18-164.6.1

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2009-3612, CVE-2009-3620, CVE-2009-3621,    CVE-2009-3726 to the security issues fixed in kernel 2.6.18-164.9.1.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2007-4567, CVE-2009-4536, CVE-2009-4537,    CVE-2009-4538 to the security issues fixed in kernel 2.6.18-164.10.1

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2006-6304, CVE-2009-2910, CVE-2009-3080,    CVE-2009-3556, CVE-2009-3889, CVE-2009-3939, CVE-2009-4020,    CVE-2009-4021, CVE-2009-4138, CVE-2009-4141, and CVE-2009-4272 to    the security issues fixed in kernel 2.6.18-164.11.1.

b. ESXi userworld update for ntp

   The Network Time Protocol (NTP) is used to synchronize the time of    a computer client or server to another server or reference time    source.

   A vulnerability in ntpd could allow a remote attacker to cause a    denial of service (CPU and bandwidth consumption) by using    MODE_PRIVATE to send a spoofed (1) request or (2) response packet    that triggers a continuous exchange of MODE_PRIVATE error responses    between two NTP daemons.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-3563 to this issue.

c. Service Console package openssl updated to 0.9.8e-12.el5_4.1

   OpenSSL is a toolkit implementing SSL v2/v3 and TLS protocols with    full-strength cryptography world-wide.

   A memory leak in the zlib could allow a remote attacker to cause a    denial of service (memory consumption) via vectors that trigger    incorrect calls to the CRYPTO_cleanup_all_ex_data function.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-4355 to this issue.

   A vulnerability was discovered which may allow remote attackers to    spoof certificates by using MD2 design flaws to generate a hash    collision in less than brute-force time. NOTE: the scope of this    issue is currently limited because the amount of computation    required is still large.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-2409 to this issue.

   This update also includes security fixes that were first addressed    in version openssl-0.9.8e-12.el5.i386.rpm.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the names CVE-2009-0590, CVE-2009-1377, CVE-2009-1378,    CVE-2009-1379, CVE-2009-1386 and CVE-2009-1387 to these issues.

d. Service Console update for krb5 to 1.6.1-36.el5_4.1 and pam_krb5 to    2.2.14-15.

   Kerberos is a network authentication protocol. It is designed to    provide strong authentication for client/server applications by    using secret-key cryptography.

   Multiple integer underflows in the AES and RC4 functionality in the    crypto library could allow remote attackers to cause a denial of    service (daemon crash) or possibly execute arbitrary code by    providing ciphertext with a length that is too short to be valid.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-4212 to this issue.

   The service console package for pam_krb5 is updated to version    pam_krb5-2.2.14-15. This update fixes a flaw found in pam_krb5. In    some non-default configurations (specifically, where pam_krb5 would    be the first module to prompt for a password), a remote attacker    could use this flaw to recognize valid usernames, which would aid a    dictionary-based password guess attack.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-1384 to this issue.

e. Service Console package bind updated to 9.3.6-4.P1.el5_4.2

   BIND (Berkeley Internet Name Daemon) is by far the most widely used    Domain Name System (DNS) software on the Internet.

   A vulnerability was discovered which could allow remote attacker to    add the Authenticated Data (AD) flag to a forged NXDOMAIN response    for an existing domain.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2010-0097 to this issue.

   A vulnerability was discovered which could allow remote attackers    to conduct DNS cache poisoning attacks by receiving a recursive    client query and sending a response that contains CNAME or DNAME    records, which do not have the intended validation before caching.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2010-0290 to this issue.

   A vulnerability was found in the way that bind handles out-of-    bailiwick data accompanying a secure response without re-fetching    from the original source, which could allow remote attackers to    have an unspecified impact via a crafted response.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2010-0382 to this issue.

   NOTE: ESX does not use the BIND name service daemon by default.

f. Service Console package gcc updated to 3.2.3-60

   The GNU Compiler Collection includes front ends for C, C++,    Objective-C, Fortran, Java, and Ada, as well as libraries for these    languages

   GNU Libtool's ltdl.c attempts to open .la library files in the    current working directory.  This could allow a local user to gain    privileges via a Trojan horse file.  The GNU C Compiler collection    (gcc) provided in ESX contains a statically linked version of the    vulnerable code, and is being replaced.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-3736 to this issue.

g. Service Console package gzip update to 1.3.3-15.rhel3

   gzip is a software application used for file compression

   An integer underflow in gzip's unlzw function on 64-bit platforms    may allow a remote attacker to trigger an array index error    leading to a denial of service (application crash) or possibly    execute arbitrary code via a crafted LZW compressed file.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2010-0001 to this issue.

h. Service Console package sudo updated to 1.6.9p17-6.el5_4

   Sudo (su 'do') allows a system administrator to delegate authority    to give certain users (or groups of users) the ability to run some    (or all) commands as root or another user while providing an audit    trail of the commands and their arguments.

   When a pseudo-command is enabled, sudo permits a match between the    name of the pseudo-command and the name of an executable file in an    arbitrary directory, which allows local users to gain privileges    via a crafted executable file.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2010-0426 to this issue.

   When the runas_default option is used, sudo does not properly set    group memberships, which allows local users to gain privileges via    a sudo command.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2010-0427 to this issue.

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security fixes :

* an array index error was found in the gdth driver. A local user could send a specially crafted IOCTL request that would cause a denial of service or, possibly, privilege escalation. (CVE-2009-3080, Important)

* a flaw was found in the FUSE implementation. When a system is low on memory, fuse_put_request() could dereference an invalid pointer, possibly leading to a local denial of service or privilege escalation.
(CVE-2009-4021, Important)

* Tavis Ormandy discovered a deficiency in the fasync_helper() implementation. This could allow a local, unprivileged user to leverage a use-after-free of locked, asynchronous file descriptors to cause a denial of service or privilege escalation. (CVE-2009-4141, Important)

* the Parallels Virtuozzo Containers team reported the RHSA-2009:1243 update introduced two flaws in the routing implementation. If an attacker was able to cause a large enough number of collisions in the routing hash table (via specially crafted packets) for the emergency route flush to trigger, a deadlock could occur. Secondly, if the kernel routing cache was disabled, an uninitialized pointer would be left behind after a route lookup, leading to a kernel panic.
(CVE-2009-4272, Important)

* the RHSA-2009:0225 update introduced a rewrite attack flaw in the do_coredump() function. A local attacker able to guess the file name a process is going to dump its core to, prior to the process crashing, could use this flaw to append data to the dumped core file. This issue only affects systems that have '/proc/sys/fs/suid_dumpable' set to 2 (the default value is 0). (CVE-2006-6304, Moderate)

The fix for CVE-2006-6304 changes the expected behavior: With suid_dumpable set to 2, the core file will not be recorded if the file already exists. For example, core files will not be overwritten on subsequent crashes of processes whose core files map to the same name.

* an information leak was found in the Linux kernel. On AMD64 systems, 32-bit processes could access and read certain 64-bit registers by temporarily switching themselves to 64-bit mode. (CVE-2009-2910, Moderate)

* the RHBA-2008:0314 update introduced N_Port ID Virtualization (NPIV) support in the qla2xxx driver, resulting in two new sysfs pseudo files, '/sys/class/scsi_host/[a qla2xxx host]/vport_create' and 'vport_delete'. These two files were world-writable by default, allowing a local user to change SCSI host attributes. This flaw only affects systems using the qla2xxx driver and NPIV capable hardware.
(CVE-2009-3556, Moderate)

* permission issues were found in the megaraid_sas driver. The 'dbg_lvl' and 'poll_mode_io' files on the sysfs file system ('/sys/') had world-writable permissions. This could allow local, unprivileged users to change the behavior of the driver. (CVE-2009-3889, CVE-2009-3939, Moderate)

* a NULL pointer dereference flaw was found in the firewire-ohci driver used for OHCI compliant IEEE 1394 controllers. A local, unprivileged user with access to /dev/fw* files could issue certain IOCTL calls, causing a denial of service or privilege escalation. The FireWire modules are blacklisted by default, and if enabled, only root has access to the files noted above by default. (CVE-2009-4138, Moderate)

* a buffer overflow flaw was found in the hfs_bnode_read() function in the HFS file system implementation. This could lead to a denial of service if a user browsed a specially crafted HFS file system, for example, by running 'ls'. (CVE-2009-4020, Low)

Bug fix documentation for this update will be available shortly from www.redhat.com/docs/en-US/errata/RHSA-2010-0046/Kernel_Security_Update / index.html

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2010-0046.
IAVA Reference : 2010-A-0001
IAVA Reference : 2010-A-0015

ID	Name	Product	Family	Severity
89740	VMware ESX / ESXi Third-Party Libraries and Components (VMSA-2010-0009) (remote check)	Nessus	VMware ESX Local Security Checks	critical
67988	Oracle Linux 5 : kernel (ELSA-2010-0046)	Nessus	Oracle Linux Local Security Checks	high
59146	SuSE 10 Security Update : Linux kernel (x86_64) (ZYPP Patch Number 6929)	Nessus	SuSE Local Security Checks	high
59145	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 6810)	Nessus	SuSE Local Security Checks	critical
49870	SuSE 10 Security Update : Linux kernel (x86) (ZYPP Patch Number 6925)	Nessus	SuSE Local Security Checks	high
46765	VMSA-2010-0009 : ESXi ntp and ESX Service Console third-party updates	Nessus	VMware ESX Local Security Checks	high
44398	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 6806)	Nessus	SuSE Local Security Checks	critical
44096	CentOS 5 : kernel (CESA-2010:0046)	Nessus	CentOS Local Security Checks	high
44062	RHEL 5 : kernel (RHSA-2010:0046)	Nessus	Red Hat Local Security Checks	high
801485	CentOS RHSA-2010-0046 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2009-3556

high

Tenable Plugins

critical

high

high

critical

high

high

critical

high

high

high