Race condition in the sctp_rcv function in net/sctp/input.c in the Linux kernel before 2.6.29 allows remote attackers to cause a denial of service (system hang) via SCTP packets. NOTE: in some environments, this issue exists because of an incomplete fix for CVE-2011-2482.

The remote VMware ESX host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in the following components :

  - COS kernel
  - libxml2

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in the following components :

  - Kernel
  - krb5 telnet daemon

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2013-0039 for details.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-0007 advisory.

    - Revert:  [block] add and use scsi_blk_cmd_ioctl (Paolo Bonzini) [752385 752386] {CVE-2011-4127}
    - Revert:  [block] fail SCSI passthrough ioctls on partition devices (Paolo Bonzini) [752385 752386]     {CVE-2011-4127}
    - Revert:  [dm] do not forward ioctls from logical volumes to the underlying device (Paolo Bonzini)     [752385 752386] {CVE-2011-4127}
    - Revert:  [scsi] fix 32-on-64 block device ioctls (Paolo Bonzini) [752385 752386] {CVE-2011-4127}
    - [scsi] fix 32-on-64 block device ioctls (Paolo Bonzini) [752385 752386] {CVE-2011-4127}
    - [fs] xfs: Fix memory corruption in xfs_readlink (Carlos Maiolino) [749159 749160] {CVE-2011-4077}
    - [fs] nfs: remove BUG() from encode_share_access() (Jeff Layton) [755442 754901] {CVE-2011-4324}
    - [fs] hfs: add sanity check for file name length (Eric Sandeen) [755432 755433] {CVE-2011-4330}
    - [fs] jbd/jbd2: validate sb->s_first in journal_get_superblock (Eryu Guan) [753343 706810]     {CVE-2011-4132}
    - [fs] proc: fix oops on invalid /proc/<pid>/maps access (Johannes Weiner) [747851 747699] {CVE-2011-3637}
    - [fs] proc: close race with exec in mem_read() (Johannes Weiner) [692041 692042] {CVE-2011-1020}
    - [mm] implement access_remote_vm (Johannes Weiner) [692041 692042] {CVE-2011-1020}
    - [mm] factor out main logic of access_process_vm (Johannes Weiner) [692041 692042] {CVE-2011-1020}
    - [mm] use mm_struct to resolve gate vma's in __get_user_pages (Johannes Weiner) [692041 692042]     {CVE-2011-1020}
    - [mm] make in_gate_area take mm_struct instead of a task_struct (Johannes Weiner) [692041 692042]     {CVE-2011-1020}
    - [mm] make get_gate_vma take mm_struct instead of task_struct (Johannes Weiner) [692041 692042]     {CVE-2011-1020}
    - [x86_64] mark assoc mm when running task in 32 bit compat mode (Johannes Weiner) [692041 692042]     {CVE-2011-1020}
    - [misc] sched: add ctx tag to mm running task in ia32 compat mode (Johannes Weiner) [692041 692042]     {CVE-2011-1020}
    - [fs] proc: require the target to be tracable (or yourself) (Johannes Weiner) [692041 692042]     {CVE-2011-1020}
    - [fs] proc: close race in /proc/*/environ (Johannes Weiner) [692041 692042] {CVE-2011-1020}
    - [fs] proc: report errors in /proc/*/*map* sanely (Johannes Weiner) [692041 692042] {CVE-2011-1020}
    - [fs] proc: shift down_read(mmap_sem) to the caller (Johannes Weiner) [692041 692042] {CVE-2011-1020}
    - [fs] detect exec transition phase with new mm but old creds (Johannes Weiner) [692041 692042]     {CVE-2011-1020}
    - [dm] do not forward ioctls from logical volumes to the underlying device (Paolo Bonzini) [752385 752386]     {CVE-2011-4127}
    - [block] fail SCSI passthrough ioctls on partition devices (Paolo Bonzini) [752385 752386]     {CVE-2011-4127}
    - [block] add and use scsi_blk_cmd_ioctl (Paolo Bonzini) [752385 752386] {CVE-2011-4127}
    - [fs] nfs: Fix an O_DIRECT Oops (Jeff Layton) [755457 754620] {CVE-2011-4325}
    - [net] sctp: Fix another race during accept/peeloff (Thomas Graf) [757146 714870] {CVE-2011-4348}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

  - A buffer overflow flaw was found in the way the Linux     kernel's XFS file system implementation handled links     with overly long path names. A local, unprivileged user     could use this flaw to cause a denial of service or     escalate their privileges by mounting a specially     crafted disk. (CVE-2011-4077, Important)

  - The fix for CVE-2011-2482 provided by a previous update     introduced a regression: on systems that do not have     Security-Enhanced Linux (SELinux) in Enforcing mode, a     socket lock race could occur between sctp_rcv() and     sctp_accept(). A remote attacker could use this flaw to     cause a denial of service. By default, SELinux runs in     Enforcing mode on Scientific Linux 5. (CVE-2011-4348,     Important)

  - The proc file system could allow a local, unprivileged     user to obtain sensitive information or possibly cause     integrity issues. (CVE-2011-1020, Moderate)

  - A missing validation flaw was found in the Linux     kernel's m_stop() implementation. A local, unprivileged     user could use this flaw to trigger a denial of service.
    (CVE-2011-3637, Moderate)

  - A flaw was found in the Linux kernel's Journaling Block     Device (JBD). A local attacker could use this flaw to     crash the system by mounting a specially crafted ext3 or     ext4 disk. (CVE-2011-4132, Moderate)

  - A flaw was found in the Linux kernel's     encode_share_access() implementation. A local,     unprivileged user could use this flaw to trigger a     denial of service by creating a regular file on an NFSv4     (Network File System version 4) file system via mknod().
    (CVE-2011-4324, Moderate)

  - A flaw was found in the Linux kernel's NFS     implementation. A local, unprivileged user could use     this flaw to cause a denial of service. (CVE-2011-4325,     Moderate)

  - A missing boundary check was found in the Linux kernel's     HFS file system implementation. A local attacker could     use this flaw to cause a denial of service or escalate     their privileges by mounting a specially crafted disk.
    (CVE-2011-4330, Moderate)

This update also fixes several bugs and adds one enhancement.

Users should upgrade to these updated packages, which contain backported patches to correct these issues, and fix the bugs and add the enhancement noted in the Technical Notes. The system must be rebooted for this update to take effect.

a. ESX third-party update for Service Console kernel

   The ESX Service Console Operating System (COS) kernel is updated    which addresses several security issues in the COS kernel.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2011-3191, CVE-2011-4348 and CVE-2012-0028 to    these issues.

b. Updated ESX Service Console package libxml2

   The ESX Console Operating System (COS) libxml2 rpms are updated to    the following versions libxml2-2.6.26-2.1.12.el5_7.2 and    libxml2-python-2.6.26-2.1.12.el5_7.2 which addresses several    security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2010-4008, CVE-2011-0216, CVE-2011-1944,    CVE-2011-2834, CVE-2011-3905, CVE-2011-3919 to these issues.

a. VMware ROM Overwrite Privilege Escalation     A flaw in the way port-based I/O is handled allows for modifying    Read-Only Memory that belongs to the Virtual DOS Machine.
   Exploitation of this issue may lead to privilege escalation on    Guest Operating Systems that run Windows 2000, Windows XP    32-bit, Windows Server 2003 32-bit or Windows Server 2003 R2    32-bit.
    VMware would like to thank Derek Soeder of Ridgeway Internet    Security, L.L.C. for reporting this issue to us.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2012-1515 to this issue.
 b. ESX third-party update for Service Console kernel     The ESX Service Console Operating System (COS) kernel is updated    to kernel-400.2.6.18-238.4.11.591731 to fix multiple security    issues in the COS kernel.
    The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2011-2482, CVE-2011-3191 and    CVE-2011-4348 to these issues.
 c. ESX third-party update for Service Console krb5 RPM     This patch updates the krb5-libs and krb5-workstation RPMs to    version 1.6.1-63.el5_7 to resolve a security issue.
    By default, the affected krb5-telnet and ekrb5-telnet services    do not run. The krb5 telnet daemon is an xinetd service.  You    can run the following commands to check if krb5 telnetd is    enabled :

     /sbin/chkconfig --list krb5-telnet      /sbin/chkconfig --list ekrb5-telnet      The output of these commands displays if krb5 telnet is enabled.
     You can run the following commands to disable krb5 telnet    daemon :

     /sbin/chkconfig krb5-telnet off      /sbin/chkconfig ekrb5-telnet off     The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2011-4862 to this issue.

Updated kernel packages that fix multiple security issues, several bugs, and add one enhancement are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* A buffer overflow flaw was found in the way the Linux kernel's XFS file system implementation handled links with overly long path names.
A local, unprivileged user could use this flaw to cause a denial of service or escalate their privileges by mounting a specially crafted disk. (CVE-2011-4077, Important)

* The fix for CVE-2011-2482 provided by RHSA-2011:1212 introduced a regression: on systems that do not have Security-Enhanced Linux (SELinux) in Enforcing mode, a socket lock race could occur between sctp_rcv() and sctp_accept(). A remote attacker could use this flaw to cause a denial of service. By default, SELinux runs in Enforcing mode on Red Hat Enterprise Linux 5. (CVE-2011-4348, Important)

* The proc file system could allow a local, unprivileged user to obtain sensitive information or possibly cause integrity issues.
(CVE-2011-1020, Moderate)

* A missing validation flaw was found in the Linux kernel's m_stop() implementation. A local, unprivileged user could use this flaw to trigger a denial of service. (CVE-2011-3637, Moderate)

* A flaw was found in the Linux kernel's Journaling Block Device (JBD). A local attacker could use this flaw to crash the system by mounting a specially crafted ext3 or ext4 disk. (CVE-2011-4132, Moderate)

* A flaw was found in the Linux kernel's encode_share_access() implementation. A local, unprivileged user could use this flaw to trigger a denial of service by creating a regular file on an NFSv4 (Network File System version 4) file system via mknod().
(CVE-2011-4324, Moderate)

* A flaw was found in the Linux kernel's NFS implementation. A local, unprivileged user could use this flaw to cause a denial of service.
(CVE-2011-4325, Moderate)

* A missing boundary check was found in the Linux kernel's HFS file system implementation. A local attacker could use this flaw to cause a denial of service or escalate their privileges by mounting a specially crafted disk. (CVE-2011-4330, Moderate)

Red Hat would like to thank Kees Cook for reporting CVE-2011-1020, and Clement Lecigne for reporting CVE-2011-4330.

This update also fixes several bugs and adds one enhancement.
Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.

Users should upgrade to these updated packages, which contain backported patches to correct these issues, and fix the bugs and add the enhancement noted in the Technical Notes. The system must be rebooted for this update to take effect.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0007 advisory.

  - kernel: no access restrictions of /proc/pid/* after setuid program exec (CVE-2011-1020)

  - kernel: proc: fix oops on invalid /proc/<pid>/maps access (CVE-2011-3637)

  - kernel: xfs: potential buffer overflow in xfs_readlink() (CVE-2011-4077)

  - kernel: jbd/jbd2: invalid value of first log block leads to oops (CVE-2011-4132)

  - kernel: nfsv4: mknod(2) DoS (CVE-2011-4324)

  - kernel: nfs: diotest4 from LTP crash client null pointer deref (CVE-2011-4325)

  - kernel: hfs: add sanity check for file name length (CVE-2011-4330)

  - kernel: incomplete fix for CVE-2011-2482 (CVE-2011-4348)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
89109	VMware ESX Service Console Multiple Vulnerabilities (VMSA-2012-0008) (remote check)	Nessus	Misc.	critical
89107	VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2012-0006) (remote check)	Nessus	Misc.	critical
79507	OracleVM 2.2 : kernel (OVMSA-2013-0039)	Nessus	OracleVM Local Security Checks	high
68427	Oracle Linux 5 : kernel (ELSA-2012-0007)	Nessus	Oracle Linux Local Security Checks	medium
61215	Scientific Linux Security Update : kernel on SL5.x i386/x86_64 (20120110)	Nessus	Scientific Linux Local Security Checks	high
58903	VMSA-2012-0008 : VMware ESX updates to ESX Service Console	Nessus	VMware ESX Local Security Checks	high
58535	VMSA-2012-0006 : VMware Workstation, ESXi, and ESX address several security issues	Nessus	VMware ESX Local Security Checks	high
57485	CentOS 5 : kernel (CESA-2012:0007)	Nessus	CentOS Local Security Checks	medium
57481	RHEL 5 : kernel (RHSA-2012:0007)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2011-4348

medium

Tenable Plugins

critical

critical

high

medium

high

high

high

medium

medium