Xen, possibly before 4.0.2, allows local 64-bit PV guests to cause a denial of service (host crash) by specifying user mode execution without user-mode pagetables.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2011-282:05 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system. The kernel     handles the basic functions of the operating system: memory allocation, process allocation, device input     and output, etc.
    Security issues fixed with this release:
    CVE-2011-0726     The do_task_stat function in fs/proc/array.c in the Linux kernel before 2.6.39-rc1 does not perform an     expected uid check, which makes it easier for local users to defeat the ASLR protection mechanism by     reading the start_code and end_code fields in the /proc/#####/stat file for a process executing a PIE     binary.
    CVE-2011-1093     The dccp_rcv_state_process function in net/dccp/input.c in the Datagram Congestion Control Protocol (DCCP)     implementation in the Linux kernel before 2.6.38 does not properly handle packets for a CLOSED endpoint,     which allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by sending     a DCCP-Close packet followed by a DCCP-Reset packet.
    CVE-2011-1170     net/ipv4/netfilter/arp_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not     place the expected '' character at the end of string data in the values of certain structure members,     which allows local users to obtain potentially sensitive information from kernel memory by leveraging the     CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting     modprobe process.
    CVE-2011-1171     net/ipv4/netfilter/ip_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not place     the expected '' character at the end of string data in the values of certain structure members, which     allows local users to obtain potentially sensitive information from kernel memory by leveraging the     CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting     modprobe process.
    CVE-2011-1172     net/ipv6/netfilter/ip6_tables.c in the IPv6 implementation in the Linux kernel before 2.6.39 does not     place the expected '' character at the end of string data in the values of certain structure members,     which allows local users to obtain potentially sensitive information from kernel memory by leveraging the     CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting     modprobe process.
    CVE-2011-1163     The osf_partition function in fs/partitions/osf.c in the Linux kernel before 2.6.38 does not properly     handle an invalid number of partitions, which might allow local users to obtain potentially sensitive     information from kernel heap memory via vectors related to partition-table parsing.
    CVE-2011-1494     Integer overflow in the _ctl_do_mpt_command function in drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux     kernel 2.6.38 and earlier might allow local users to gain privileges or cause a denial of service (memory     corruption) via an ioctl call specifying a crafted value that triggers a heap-based buffer overflow.
    CVE-2011-1495     drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier does not validate (1) length and     (2) offset values before performing memory copy operations, which might allow local users to gain     privileges, cause a denial of service (memory corruption), or obtain sensitive information from kernel     memory via a crafted ioctl call, related to the _ctl_do_mpt_command and _ctl_diag_read_buffer functions.
    CVE-2011-1577     Heap-based buffer overflow in the is_gpt_valid function in fs/partitions/efi.c in the Linux kernel 2.6.38     and earlier allows physically proximate attackers to cause a denial of service (OOPS) or possibly have     unspecified other impact via a crafted size of the EFI GUID partition-table header on removable media.
    CVE-2010-4346     The install_special_mapping function in mm/mmap.c in the Linux kernel before 2.6.37-rc6 does not make an     expected security_file_mmap function call, which allows local users to bypass intended mmap_min_addr     restrictions and possibly conduct NULL pointer dereference attacks via a crafted assembly-language     application.
    CVE-2011-0521     The dvb_ca_ioctl function in drivers/media/dvb/ttpci/av7110_ca.c in the Linux kernel before 2.6.38-rc2     does not check the sign of a certain integer field, which allows local users to cause a denial of service     (memory corruption) or possibly have unspecified other impact via a negative value.
    CVE-2011-0710     The task_show_regs function in arch/s390/kernel/traps.c in the Linux kernel before     2.6.38-rc4-next-20110216 on the s390 platform allows local users to obtain the values of the registers of     an arbitrary process by reading a status file under /proc/.
    CVE-2011-1010     Buffer overflow in the mac_partition function in fs/partitions/mac.c in the Linux kernel before 2.6.37.2     allows local users to cause a denial of service (panic) or possibly have unspecified other impact via a     malformed Mac OS partition table.
    CVE-2011-1090     The __nfs4_proc_set_acl function in fs/nfs/nfs4proc.c in the Linux kernel before 2.6.38 stores NFSv4 ACL     data in memory that is allocated by kmalloc but not properly freed, which allows local users to cause a     denial of service (panic) via a crafted attempt to set an ACL.
    CVE-2010-4249     The wait_for_unix_gc function in net/unix/garbage.c in the Linux kernel before 2.6.37-rc3-next-20101125     does not properly select times for garbage collection of inflight sockets, which allows local users to     cause a denial of service (system hang) via crafted use of the socketpair and sendmsg system calls for     SOCK_SEQPACKET sockets.
    CVE-2010-4251     The socket implementation in net/core/sock.c in the Linux kernel before 2.6.34 does not properly manage a     backlog of received packets, which allows remote attackers to cause a denial of service (memory     consumption) by sending a large amount of network traffic, as demonstrated by netperf UDP tests.
    CVE-2010-4655     net/core/ethtool.c in the Linux kernel before 2.6.36 does not initialize certain data structures, which     allows local users to obtain potentially sensitive information from kernel heap memory by leveraging the     CAP_NET_ADMIN capability for an ethtool ioctl call.
    CVE-2010-4526     Race condition in the Linux kernel 2.6.11-rc2 through 2.6.33 allows remote attackers to cause a denial of     service (panic) via an ICMP unreachable message to a socket that is already locked by a user, which causes     the socket to be freed and triggers list corruption, related to the sctp_wait_for_connect function.
    CVE-2010-3296     The cxgb_extension_ioctl function in drivers/net/cxgb3/cxgb3_main.c in the Linux kernel before 2.6.36-rc5     does not properly initialize a certain structure member, which allows local users to obtain potentially     sensitive information from kernel stack memory via a CHELSIO_GET_QSET_NUM ioctl call.
    CVE-2010-3877     The get_name function in net/tipc/socket.c in the Linux kernel before 2.6.37-rc2 does not initialize a     certain structure, which allows local users to obtain potentially sensitive information from kernel stack     memory by reading a copy of this structure.
    CVE-2010-4072     The copy_shmid_to_user function in ipc/shm.c in the Linux kernel before 2.6.37-rc1 does not initialize a     certain structure, which allows local users to obtain potentially sensitive information from kernel stack     memory via vectors related to the shmctl system call and the old shm interface.
    CVE-2010-4073     The ipc subsystem in the Linux kernel before 2.6.37-rc1 does not initialize certain structures, which     allows local users to obtain potentially sensitive information from kernel stack memory via vectors     related to the (1) compat_sys_semctl, (2) compat_sys_msgctl, and (3) compat_sys_shmctl functions in     ipc/compat.c; and the (4) compat_sys_mq_open and (5) compat_sys_mq_getsetattr functions in     ipc/compat_mq.c.
    CVE-2010-4075     The uart_get_count function in drivers/serial/serial_core.c in the Linux kernel before 2.6.37-rc1 does not     properly initialize a certain structure member, which allows local users to obtain potentially sensitive     information from kernel stack memory via a TIOCGICOUNT ioctl call.
    CVE-2010-4080     The snd_hdsp_hwdep_ioctl function in sound/pci/rme9652/hdsp.c in the Linux kernel before 2.6.36-rc6 does     not initialize a certain structure, which allows local users to obtain potentially sensitive information     from kernel stack memory via an SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctl call.
    CVE-2010-4081     The snd_hdspm_hwdep_ioctl function in sound/pci/rme9652/hdspm.c in the Linux kernel before 2.6.36-rc6 does     not initialize a certain structure, which allows local users to obtain potentially sensitive information     from kernel stack memory via an SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO ioctl call.
    CVE-2010-4158     The sk_run_filter function in net/core/filter.c in the Linux kernel before 2.6.36.2 does not check whether     a certain memory location has been initialized before executing a (1) BPF_S_LD_MEM or (2) BPF_S_LDX_MEM     instruction, which allows local users to obtain potentially sensitive information from kernel stack memory     via a crafted socket filter.
    CVE-2010-4238     The vbd_create function in Xen 3.1.2, when the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 is     used, allows guest OS users to cause a denial of service (host OS panic) via an attempted access to a     virtual CD-ROM device through the blkback driver. NOTE: some of these details are obtained from third     party information.
    CVE-2010-4243     fs/exec.c in the Linux kernel before 2.6.37 does not enable the OOM Killer to assess use of stack memory     by arrays representing the (1) arguments and (2) environment, which allows local users to cause a denial     of service (memory consumption) via a crafted exec system call, aka an OOM dodging issue, a related issue     to CVE-2010-3858.
    CVE-2010-4255     The fixup_page_fault function in arch/x86/traps.c in Xen 4.0.1 and earlier on 64-bit platforms, when     paravirtualization is enabled, does not verify that kernel mode is used to call the     handle_gdt_ldt_mapping_fault function, which allows guest OS users to cause a denial of service (host OS     BUG_ON) via a crafted memory access.
    CVE-2010-4263     The igb_receive_skb function in drivers/net/igb/igb_main.c in the Intel Gigabit Ethernet (aka igb)     subsystem in the Linux kernel before 2.6.34, when Single Root I/O Virtualization (SR-IOV) and promiscuous     mode are enabled but no VLANs are registered, allows remote attackers to cause a denial of service (NULL     pointer dereference and panic) and possibly have unspecified other impact via a VLAN tagged frame.
    CVE-2010-4343     drivers/scsi/bfa/bfa_core.c in the Linux kernel before 2.6.35 does not initialize a certain port data     structure, which allows local users to cause a denial of service (system crash) via read operations on an     fc_host statistics file.
    CVE-2011-1078     CVE-2011-1079     CVE-2011-1080     CVE-2011-1166     CVE-2011-1763     CVE-2011-1478     No description available at the time of writing, please refer to the CVE links below.
    Fixed bugs:
    Too many to list here but here are some of the main ones:
    - Changed the value of debug parameter from 0 to 1 to provide kernel-debug-devel.
    - Merged patches from 2.6.18-194.11.AXS3
    - Modified all i686, x86_64 and ia64 kernel config files
    - Modified config-rhel-generic to enable ocfs2

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2011-264:04 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system.  The     kernel handles the basic functions of the operating system:  memory allocation, process allocation, device     input and output, etc.
    Security issues fixed with this release:
    CVE-2011-0726     The do_task_stat function in fs/proc/array.c in the Linux kernel before 2.6.39-rc1 does not perform an     expected uid check, which makes it easier for local users to defeat the ASLR protection mechanism by     reading the start_code and end_code fields in the /proc/#####/stat file for a process executing a PIE     binary.
    CVE-2011-1093     The dccp_rcv_state_process function in net/dccp/input.c in the Datagram Congestion Control Protocol (DCCP)     implementation in the Linux kernel before 2.6.38 does not properly handle packets for a CLOSED endpoint,     which allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by sending     a DCCP-Close packet followed by a DCCP-Reset packet.
    CVE-2011-1170     net/ipv4/netfilter/arp_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not     place the expected '0' character at the end of string data in the values of certain structure members,     which allows local users to obtain potentially sensitive information from kernel memory by leveraging the     CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting     modprobe process.
    CVE-2011-1171     net/ipv4/netfilter/ip_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not place     the expected '0' character at the end of string data in the values of certain structure members, which     allows local users to obtain potentially sensitive information from kernel memory by leveraging the     CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting     modprobe process.
    CVE-2011-1172     net/ipv6/netfilter/ip6_tables.c in the IPv6 implementation in the Linux kernel before 2.6.39 does not     place the expected '0' character at the end of string data in the values of certain structure members,     which allows local users to obtain potentially sensitive information from kernel memory by leveraging the     CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting     modprobe process.
    CVE-2011-1163     The osf_partition function in fs/partitions/osf.c in the Linux kernel before 2.6.38 does not properly     handle an invalid number of partitions, which might allow local users to obtain potentially sensitive     information from kernel heap memory via vectors related to partition-table parsing.
    CVE-2011-1494     Integer overflow in the _ctl_do_mpt_command function in drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux     kernel 2.6.38 and earlier might allow local users to gain privileges or cause a denial of service (memory     corruption) via an ioctl call specifying a crafted value that triggers a heap-based buffer overflow.
    CVE-2011-1495     drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier does not validate (1) length and     (2) offset values before performing memory copy operations, which might allow local users to gain     privileges, cause a denial of service (memory corruption), or obtain sensitive information from kernel     memory via a crafted ioctl call, related to the _ctl_do_mpt_command and _ctl_diag_read_buffer functions.
    CVE-2011-1577     Heap-based buffer overflow in the is_gpt_valid function in fs/partitions/efi.c in the Linux kernel 2.6.38     and earlier allows physically proximate attackers to cause a denial of service (OOPS) or possibly have     unspecified other impact via a crafted size of the EFI GUID partition-table header on removable media.
    CVE-2011-1078     CVE-2011-1079     CVE-2011-1080     CVE-2011-1166     CVE-2011-1763     No descriptions at the time of writing, please use the CVE links below.
    Fixed bugs:
    For an exhasive list of other fixes, please refer to the changelog

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party libraries :

  - COS kernel
  - cURL
  - python
  - rpm

Collective May/2011 update for Xen

Xen :

  - 675363 - Random lockups with kernel-xen. Possibly     graphics related.

  - 679344 - Xen: multi-vCPU pv guest may crash host

  - 681044 - update xenpaging.autostart.patch

  - 681302 - xm create -x <guest> returns 'ImportError: No     module named ext'

  - 688473 - potential buffer overflow in tools

  - 691738 - Xen does not find device create with npiv block

vm-install :

  - 688757 - SLED10SP4 fully virtualized in SLES10SP4 XEN -     kernel panic

  - 678152 - Xen: virt-manager: harmless block device admin     actions on FV guests mess up network (VIF) device type     ==> network lost.

  - 631680 - OpenSUSE 11.3 KVM install of windows xp fails     on first reboot during installation.

Collective May/2011 update for Xen

Xen :

  - 691238 - L3: question on behaviour change xm list

  - 623680 - xen kernel freezes during boot when processor     module is loaded

  - 680824 - dom0 can't recognize boot disk when IOMMU is     enabled

  - 688473 - VUL-0: potential buffer overflow in tools

  - 679344 - VUL-0: Xen: multi-vCPU pv guest may crash host

  - 687981 - L3: mistyping model type when defining VIF     crashes

  - 675817 - Kernel panic when creating HVM guests on AMD     platforms with XSAVE

  - 678871 - dom0 hangs long time when starting hvm guests     with memory >= 64GB

  - 675363 - Random lockups with kernel-xen. Possibly     graphics related

  - 678229 - restore of sles HVM fails

  - 672833 - xen-tools bug causing problems with Ubuntu     10.10 under Xen 4.

  - 665610 - xm console > 1 to same VM messes up both     consoles

vm-install :

  - 688757 - SLED10SP4 fully virtualized in SLES10SP4 XEN -     kernel panic

  - 678152 - Xen: virt-manager: harmless block device admin     actions on FV guests mess up network (VIF) device type     ==> network lost.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0833 advisory.

    - [scsi] mpt2sas: prevent heap overflows and unchecked access (Tomas Henzl) [694526 694527] {CVE-2011-1495     CVE-2011-1494}
    - [net] bridge/netfilter: fix ebtables information leak (Don Howard) [681325 681326] {CVE-2011-1080}
    - [net] bluetooth: fix sco information leak to userspace (Don Howard) [681310 681311] {CVE-2011-1078}
    - [fs] fix corrupted GUID partition table kernel oops (Jerome Marchand) [695979 695980] {CVE-2011-1577}
    - [xen] x86/domain: fix error checks in arch_set_info_guest (Laszlo Ersek) [688581 688582] {CVE-2011-1166}
    - [fs] partitions: Fix corrupted OSF partition table parsing (Danny Feng) [688022 688023] {CVE-2011-1163}
    - [net] netfilter: ip6_tables: fix infoleak to userspace (Jiri Pirko) [689348 689349] {CVE-2011-1172}
    - [net] netfilter/ip_tables: fix infoleak to userspace (Jiri Pirko) [689331 689332] {CVE-2011-1171}
    - [net] netfilter/arp_tables: fix infoleak to userspace (Jiri Pirko) [689322 689323] {CVE-2011-1170}
    - [fs] proc: protect mm start_/end_code in /proc/pid/stat (Eugene Teo) [684570 684571] {CVE-2011-0726}
    - [net] dccp: fix oops in dccp_rcv_state_process (Eugene Teo) [682955 682956] {CVE-2011-1093}
    - [net] bluetooth: fix bnep buffer overflow (Don Howard) [681318 681319] {CVE-2011-1079}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* A flaw in the dccp_rcv_state_process() function could allow a remote attacker to cause a denial of service, even when the socket was already closed. (CVE-2011-1093, Important)

* Multiple buffer overflow flaws were found in the Linux kernel's Management Module Support for Message Passing Technology (MPT) based controllers. A local, unprivileged user could use these flaws to cause a denial of service, an information leak, or escalate their privileges. (CVE-2011-1494, CVE-2011-1495, Important)

* A missing validation of a null-terminated string data structure element in the bnep_sock_ioctl() function could allow a local user to cause an information leak or a denial of service. (CVE-2011-1079, Moderate)

* Missing error checking in the way page tables were handled in the Xen hypervisor implementation could allow a privileged guest user to cause the host, and the guests, to lock up. (CVE-2011-1166, Moderate)

* A flaw was found in the way the Xen hypervisor implementation checked for the upper boundary when getting a new event channel port.
A privileged guest user could use this flaw to cause a denial of service or escalate their privileges. (CVE-2011-1763, Moderate)

* The start_code and end_code values in '/proc/[pid]/stat' were not protected. In certain scenarios, this flaw could be used to defeat Address Space Layout Randomization (ASLR). (CVE-2011-0726, Low)

* A missing initialization flaw in the sco_sock_getsockopt() function could allow a local, unprivileged user to cause an information leak.
(CVE-2011-1078, Low)

* A missing validation of a null-terminated string data structure element in the do_replace() function could allow a local user who has the CAP_NET_ADMIN capability to cause an information leak.
(CVE-2011-1080, Low)

* A buffer overflow flaw in the DEC Alpha OSF partition implementation in the Linux kernel could allow a local attacker to cause an information leak by mounting a disk that contains specially crafted partition tables. (CVE-2011-1163, Low)

* Missing validations of null-terminated string data structure elements in the do_replace(), compat_do_replace(), do_ipt_get_ctl(), do_ip6t_get_ctl(), and do_arpt_get_ctl() functions could allow a local user who has the CAP_NET_ADMIN capability to cause an information leak. (CVE-2011-1170, CVE-2011-1171, CVE-2011-1172, Low)

* A heap overflow flaw in the Linux kernel's EFI GUID Partition Table (GPT) implementation could allow a local attacker to cause a denial of service by mounting a disk that contains specially crafted partition tables. (CVE-2011-1577, Low)

Red Hat would like to thank Dan Rosenberg for reporting CVE-2011-1494 and CVE-2011-1495; Vasiliy Kulikov for reporting CVE-2011-1079, CVE-2011-1078, CVE-2011-1080, CVE-2011-1170, CVE-2011-1171, and CVE-2011-1172; Kees Cook for reporting CVE-2011-0726; and Timo Warns for reporting CVE-2011-1163 and CVE-2011-1577.

This update also fixes several bugs. Documentation for these bug fixes will be available shortly from the Technical Notes document linked to in the References section.

Users should upgrade to these updated packages, which contain backported patches to correct these issues, and fix the bugs noted in the Technical Notes. The system must be rebooted for this update to take effect.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

  - A flaw in the dccp_rcv_state_process() function could     allow a remote attacker to cause a denial of service,     even when the socket was already closed. (CVE-2011-1093,     Important)

  - Multiple buffer overflow flaws were found in the Linux     kernel's Management Module Support for Message Passing     Technology (MPT) based controllers. A local,     unprivileged user could use these flaws to cause a     denial of service, an information leak, or escalate     their privileges. (CVE-2011-1494, CVE-2011-1495,     Important)

  - A missing validation of a null-terminated string data     structure element in the bnep_sock_ioctl() function     could allow a local user to cause an information leak or     a denial of service. (CVE-2011-1079, Moderate)

  - Missing error checking in the way page tables were     handled in the Xen hypervisor implementation could allow     a privileged guest user to cause the host, and the     guests, to lock up. (CVE-2011-1166, Moderate)

  - A flaw was found in the way the Xen hypervisor     implementation checked for the upper boundary when     getting a new event channel port. A privileged guest     user could use this flaw to cause a denial of service or     escalate their privileges. (CVE-2011-1763, Moderate)

  - The start_code and end_code values in '/proc/[pid]/stat'     were not protected. In certain scenarios, this flaw     could be used to defeat Address Space Layout     Randomization (ASLR). (CVE-2011-0726, Low)

  - A missing initialization flaw in the     sco_sock_getsockopt() function could allow a local,     unprivileged user to cause an information leak.
    (CVE-2011-1078, Low)

  - A missing validation of a null-terminated string data     structure element in the do_replace() function could     allow a local user who has the CAP_NET_ADMIN capability     to cause an information leak. (CVE-2011-1080, Low)

  - A buffer overflow flaw in the DEC Alpha OSF partition     implementation in the Linux kernel could allow a local     attacker to cause an information leak by mounting a disk     that contains specially crafted partition tables.
    (CVE-2011-1163, Low)

  - Missing validations of null-terminated string data     structure elements in the do_replace(),     compat_do_replace(), do_ipt_get_ctl(),     do_ip6t_get_ctl(), and do_arpt_get_ctl() functions could     allow a local user who has the CAP_NET_ADMIN capability     to cause an information leak. (CVE-2011-1170,     CVE-2011-1171, CVE-2011-1172, Low)

  - A heap overflow flaw in the Linux kernel's EFI GUID     Partition Table (GPT) implementation could allow a local     attacker to cause a denial of service by mounting a disk     that contains specially crafted partition tables.
    (CVE-2011-1577, Low)

This update also fixes several bugs.

The system must be rebooted for this update to take effect.

a. ESX third-party update for Service Console kernel      The ESX Service Console Operating System (COS) kernel is updated to    kernel-2.6.18-274.3.1.el5 to fix multiple security issues in the    COS kernel.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2011-0726, CVE-2011-1078, CVE-2011-1079,    CVE-2011-1080, CVE-2011-1093, CVE-2011-1163, CVE-2011-1166,    CVE-2011-1170, CVE-2011-1171, CVE-2011-1172, CVE-2011-1494,    CVE-2011-1495, CVE-2011-1577, CVE-2011-1763, CVE-2010-4649,    CVE-2011-0695, CVE-2011-0711, CVE-2011-1044, CVE-2011-1182,    CVE-2011-1573, CVE-2011-1576, CVE-2011-1593, CVE-2011-1745,    CVE-2011-1746, CVE-2011-1776, CVE-2011-1936, CVE-2011-2022,    CVE-2011-2213, CVE-2011-2492, CVE-2011-1780, CVE-2011-2525,    CVE-2011-2689, CVE-2011-2482, CVE-2011-2491, CVE-2011-2495,    CVE-2011-2517, CVE-2011-2519, CVE-2011-2901 to these issues.
  b. ESX third-party update for Service Console cURL RPM      The ESX Service Console (COS) curl RPM is updated to cURL-7.15.5.9    resolving a security issues.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the name CVE-2011-2192 to this issue.
  c. ESX third-party update for Service Console nspr and nss RPMs      The ESX Service Console (COS) nspr and nss RPMs are updated to    nspr-4.8.8-1.el5_7 and nss-3.12.10-4.el5_7 respectively resolving    a security issues.
     A Certificate Authority (CA) issued fraudulent SSL certificates and    Netscape Portable Runtime (NSPR) and Network Security Services (NSS)    contain the built-in tokens of this fraudulent Certificate    Authority. This update renders all SSL certificates signed by the    fraudulent CA as untrusted for all uses.
  d. ESX third-party update for Service Console rpm RPMs      The ESX Service Console Operating System (COS) rpm packages are    updated to popt-1.10.2.3-22.el5_7.2, rpm-4.4.2.3-22.el5_7.2,    rpm-libs-4.4.2.3-22.el5_7.2 and rpm-python-4.4.2.3-22.el5_7.2    which fixes multiple security issues.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2010-2059 and CVE-2011-3378 to these    issues.
  e. ESX third-party update for Service Console samba RPMs      The ESX Service Console Operating System (COS) samba packages are    updated to samba-client-3.0.33-3.29.el5_7.4,    samba-common-3.0.33-3.29.el5_7.4 and    libsmbclient-3.0.33-3.29.el5_7.4 which fixes multiple security    issues in the Samba client.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2010-0547, CVE-2010-0787, CVE-2011-1678,    CVE-2011-2522 and CVE-2011-2694 to these issues.
     Note that ESX does not include the Samba Web Administration Tool    (SWAT) and therefore ESX COS is not affected by CVE-2011-2522 and    CVE-2011-2694.
  f. ESX third-party update for Service Console python package      The ESX Service Console (COS) python package is updated to    2.4.3-44 which fixes multiple security issues.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2009-3720, CVE-2010-3493, CVE-2011-1015 and    CVE-2011-1521 to these issues.
  g. ESXi update to third-party component python      The python third-party library is updated to python 2.5.6 which    fixes multiple security issues.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2009-3560, CVE-2009-3720, CVE-2010-1634,    CVE-2010-2089, and CVE-2011-1521 to these issues.

This collective June/2011 Update for Xen provides the following fixes :

  - Xen does not properly check the upper boundary of     user-supplied data in the get_free_port() function when     getting a new event channel port. A local user on the     guest operating system can exploit this flaw to cause     denial of service conditions or potentially gain     elevated privileges. (CVE-2011-1166)

  - 654798: Fix race between hotplug scripts writing to     xenstore and xend registering a watch for the write.

  - 684297: HVM taking too long to dump vmcore

  - 688757: Fix kernel panic on fully virtualized setup

  - 658413: Fix root drive search on SLES 10-SP3 HVM guest

  - 675363: Random lockups with kernel-xen related to     graphics

Several vulnerabilities were discovered in the Xen virtual machine hypervisor.

  - CVE-2011-1166     A 64-bit guest can get one of its vCPUs into non-kernel     mode without first providing a valid non-kernel     pagetable, thereby locking up the host system.

  - CVE-2011-1583, CVE-2011-3262     Local users can cause a denial of service and possibly     execute arbitrary code via a crafted paravirtualised     guest kernel image.

  - CVE-2011-1898     When using PCI passthrough on Intel VT-d chipsets that     do not have interrupt remapping, guest OS users can gain     host OS privileges by writing to the interrupt injection     registers.

The oldstable distribution (lenny) contains a different version of Xen not affected by these problems.

This update fixes various bugs in XEN :

The following security issues have been fixed :

  - A denial of service (Host Crash) in the XEN hypervisor.
    (CVE-2011-2901)

  - A bug was found in the way Xen handles CPUID instruction     emulation during VM exits. An unprivileged guest user     can potentially use this flaw to crash the guest.
    (CVE-2011-1936)

  - A 64-bit guest can get one of its vcpus into non-kernel     mode without first providing a valid non-kernel     pagetable. The observed failure mode was usually a hard     lockup of the host (host denial of service).
    (CVE-2011-1166)

It fixes also the following bugs :

  - SLES 10 SP3 XEN: Device /dev/xvdp is already connected     error when starting multiple vm's. (bnc#654798)

  - HVM taking too long to dump vmcore. (bnc#684297)

Collective May/2011 update for Xen

Xen :

  - 679344: Xen: multi-vCPU pv guest may crash host

  - 675817: Kernel panic when creating HVM guests on AMD     platforms with XSAVE

  - 678871: dom0 hangs long time when starting hvm guests     with memory >= 64GB

  - 675363: Random lockups with kernel-xen. Possibly     graphics related

  - 678229: restore of sles HVM fails

  - 672833: xen-tools bug causing problems with Ubuntu 10.10     under Xen 4.

  - 665610: xm console > 1 to same VM messes up both     consoles

  - 687981: mistyping model type when defining VIF crashes     VM

  - 688473: Fix potential buffer overflow in decode

  - 691238: revert accidental behaviour change in xm list

  - 680824: dom0 can't recognize boot disk when IOMMU is     enabled

  - 623680: xen kernel freezes during boot when processor     module is loaded vm-install :

  - 678152: virt-manager: harmless block device admin     actions on FV guests mess up network (VIF) device type     ==> network lost.

  - 688757: SLED10SP4 fully virtualized in SLES10SP4 XEN -     kernel panic libvirt :

  - 674371: qemu aio mode per disk

  - 675861: Force FLR on for buggy SR-IOV devices

  - 678406: libvirt: several API calls do not honour     read-only

  - 684877: libvirt: error reporting in libvirtd is not     thread safe

  - 686737: virsh: Add option 'model' to attach-interface

  - 681546: Fix xmdomain.cfg to libvirt XML format     conversion

  - 688306: Handle support for recent KVM versions

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0833 advisory.

  - kernel: proc: protect mm start_code/end_code in /proc/pid/stat (CVE-2011-0726)

  - kernel: bt sco_conninfo infoleak (CVE-2011-1078)

  - kernel: bnep device field missing NULL terminator (CVE-2011-1079)

  - kernel: ebtables stack infoleak (CVE-2011-1080)

  - kernel: dccp: fix oops on Reset after close (CVE-2011-1093)

  - kernel: fs/partitions: Corrupted OSF partition table infoleak (CVE-2011-1163)

  - kernel: xen: x86_64: fix error checking in arch_set_info_guest() (CVE-2011-1166)

  - kernel: ipv4: netfilter: arp_tables: fix infoleak to userspace (CVE-2011-1170)

  - kernel: ipv4: netfilter: ip_tables: fix infoleak to userspace (CVE-2011-1171)

  - kernel: ipv6: netfilter: ip6_tables: fix infoleak to userspace (CVE-2011-1172)

  - kernel: drivers/scsi/mpt2sas: prevent heap overflows (CVE-2011-1494, CVE-2011-1495)

  - kernel: corrupted GUID partition tables can cause kernel oops (CVE-2011-1577)

  - kernel: xen: improper upper boundary check in get_free_port() function (CVE-2011-1763)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
284391	MiracleLinux 3 : kernel-2.6.18-238.2.AXS3 (AXSA:2011-282:05)	Nessus	Miracle Linux Local Security Checks	medium
284281	MiracleLinux 3 : kernel-2.6.18-194.13.AXS3 (AXSA:2011-264:04)	Nessus	Miracle Linux Local Security Checks	high
89105	VMware ESX / ESXi Service Console and Third-Party Libraries Multiple Vulnerabilities (VMSA-2012-0001) (remote check)	Nessus	Misc.	high
76048	openSUSE Security Update : xen-201105 (openSUSE-SU-2011:0578-1)	Nessus	SuSE Local Security Checks	medium
75776	openSUSE Security Update : xen-201105 (openSUSE-SU-2011:0580-1)	Nessus	SuSE Local Security Checks	medium
68276	Oracle Linux 5 : kernel (ELSA-2011-0833)	Nessus	Oracle Linux Local Security Checks	high
67081	CentOS 5 : kernel (CESA-2011:0833)	Nessus	CentOS Local Security Checks	high
61059	Scientific Linux Security Update : kernel on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
57749	VMSA-2012-0001 : VMware ESXi and ESX updates to third-party library and ESX Service Console	Nessus	VMware ESX Local Security Checks	high
57265	SuSE 10 Security Update : Xen (ZYPP Patch Number 7547)	Nessus	SuSE Local Security Checks	medium
56716	Debian DSA-2337-1 : xen - several vulnerabilities	Nessus	Debian Local Security Checks	high
56618	SuSE 10 Security Update : Xen (ZYPP Patch Number 7703)	Nessus	SuSE Local Security Checks	medium
54934	SuSE 11.1 Security Update : Xen (SAT Patch Number 4491)	Nessus	SuSE Local Security Checks	medium
54925	RHEL 5 : kernel (RHSA-2011:0833)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2011-1166

critical

Tenable Plugins

medium

high

high

medium

medium

high

high

high

high

medium

high

medium

medium

high