Newest Plugins

Oracle Enterprise Manager Ops Center Remote Code Execution (October 2017 CPU)


Synopsis:

An enterprise management application installed on the remote host is
affected by multiple vulnerabilities.

Description:

The version of Oracle Enterprise Manager Ops Center installed on
the remote host is missing a security patch. It is, therefore,
affected by a remote code execution vulnerability. Refer to the
October 2017 CPU for details on this vulnerability.

See also :

http://www.nessus.org/u?1e07fa0e

Solution :

Apply the appropriate patch according to the October 2017 Oracle Critical
Patch Update advisory.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)

This script is Copyright (C) 2017 Tenable Network Security, Inc.

Oracle WebCenter Sites Local Vulnerability (Oct 2017 CPU)


Synopsis:

An application running on the remote host is affected by a local
security vulnerability.

Description:

The version of Oracle WebCenter Sites running on the remote host is
affected by an unspecified flaw in the Sites component (formerly
FatWire Content Server) that allows an authenticated, local
attacker to impact confidentiality and integrity. Note that this
issue only applies to versions 11.1.1.8.0 and 12.2.1.2.0.

See also :

http://www.nessus.org/u?c2c56d20

Solution :

Apply the appropriate patch according to the Oct 2017 Oracle
Critical Patch Update advisory.

Risk factor :

Low / CVSS Base Score : 2.6
(CVSS2#AV:L/AC:H/Au:N/C:P/I:P/A:N)

This script is Copyright (C) 2017 Tenable Network Security, Inc.

MySQL 5.7.x < 5.7.20 Multiple Vulnerabilities (October 2017 CPU)


Synopsis:

The remote database server is affected by multiple vulnerabilities.

Description:

The version of MySQL running on the remote host is 5.7.x prior to
5.7.20. It is, therefore, affected by multiple vulnerabilities as
noted in the October 2017 Critical Patch Update advisory. Please
consult the CVRF details for the applicable CVEs for additional
information.

Note that Nessus has not tested for these issues but has instead
relied only on the application's self-reported version number.

See also :

https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-20.html
http://www.nessus.org/u?1e07fa0e
https://support.oracle.com/rs?type=doc&id=2307762.1
http://www.nessus.org/u?31acf95c

Solution :

Upgrade to MySQL version 5.7.20 or later.

Risk factor :

High / CVSS Base Score : 7.8
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)

This script is Copyright (C) 2017 Tenable Network Security, Inc.

MySQL 5.6.x < 5.6.38 Multiple Vulnerabilities (October 2017 CPU)


Synopsis:

The remote database server is affected by multiple vulnerabilities.

Description:

The version of MySQL running on the remote host is 5.6.x prior to
5.6.38. It is, therefore, affected by multiple vulnerabilities as
noted in the October 2017 Critical Patch Update advisory. Please
consult the CVRF details for the applicable CVEs for additional
information.

Note that Nessus has not tested for these issues but has instead
relied only on the application's self-reported version number.

See also :

https://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-38.html
http://www.nessus.org/u?1e07fa0e
https://support.oracle.com/rs?type=doc&id=2307762.1
http://www.nessus.org/u?31acf95c

Solution :

Upgrade to MySQL version 5.6.38 or later.

Risk factor :

High / CVSS Base Score : 7.8
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)

This script is Copyright (C) 2017 Tenable Network Security, Inc.

MySQL 5.5.x < 5.5.58 Multiple Vulnerabilities (October 2017 CPU)


Synopsis:

The remote database server is affected by multiple vulnerabilities.

Description:

The version of MySQL running on the remote host is 5.5.x prior to
5.5.58. It is, therefore, affected by multiple vulnerabilities as
noted in the October 2017 Critical Patch Update advisory. Please
consult the CVRF details for the applicable CVEs for additional
information.

Note that Nessus has not tested for these issues but has instead
relied only on the application's self-reported version number.

See also :

https://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-58.html
http://www.nessus.org/u?1e07fa0e
https://support.oracle.com/rs?type=doc&id=2307762.1
http://www.nessus.org/u?31acf95c

Solution :

Upgrade to MySQL version 5.5.58 or later.

Risk factor :

Medium / CVSS Base Score : 6.8
(CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C)

This script is Copyright (C) 2017 Tenable Network Security, Inc.

Oracle Integrated Lights Out Manager (ILOM) < 3.2.6 Multiple Vulnerabilities (uncredentialed check)


Synopsis:

A network management system installed on the remote host is affected
by multiple vulnerabilities.

Description:

According to its self-reported version number, the version of Oracle
Integrated Lights Out Manager (ILOM) is affected by multiple vulnerabilities
as described in the advisory.

See also :

http://www.nessus.org/u?1e07fa0e

Solution :

Upgrade to Oracle Integrated Lights Out Manager (ILOM) 3.2.6 or later.

Risk factor :

High / CVSS Base Score : 7.8
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)

This script is Copyright (C) 2017 Tenable Network Security, Inc.

Oracle E-Business Multiple Vulnerabilities (October 2017 CPU)


Synopsis:

A web application installed on the remote host is affected by multiple
vulnerabilities.

Description:

The version of Oracle E-Business installed on the remote host is
12.x.x prior to 12.2.8. It is, therefore, affected by multiple
vulnerabilities as noted in the October 2017 Critical Patch Update
advisory. Please consult the CVRF details for the applicable CVEs
for additional information.
Note that Nessus has not tested for these issues but has instead
relied only on the application's self-reported version number.

See also :

http://www.nessus.org/u?2cb3855f

Solution :

Apply the appropriate patch according to the October 2017
Oracle Critical Patch Update advisory.

Risk factor :

High / CVSS Base Score : 9.4
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N)

This script is Copyright (C) 2017 Tenable Network Security, Inc.

KB4020535: Security Update for the Scripting Engine Memory Corruption Vulnerability (May 2017)


Synopsis:

The remote Windows host is affected by a remote code execution
vulnerability.

Description:

The remote Windows host is missing security update KB4020535. It is,
therefore, affected by a flaw in the VBScript engine due to improper
handling of objects in memory. An unauthenticated, remote attacker can
exploit this, by convincing a user to visit a malicious website or
open a specially crafted document file, to execute arbitrary code.

See also :

https://support.microsoft.com/en-us/help/4020535/
http://www.nessus.org/u?16f2aac4

Solution :

Apply security update KB4020535.

Risk factor :

High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)

This script is Copyright (C) 2017 Tenable Network Security, Inc.

KB4014793: Microsoft Wordpad Remote Code Execution vulnerability (April 2017)


Synopsis:

The remote Windows host is affected by an information disclosure
vulnerability.

Description:

The remote Windows host is missing security update KB4014793. It is,
therefore, affected by a remote code execution vulnerability in Windows
WordPad due to improper validation of user-supplied input.
An unauthenticated, remote attacker can exploit this, by convincing a
user to open a specially crafted file, to execute arbitrary code.

See also :

http://www.nessus.org/u?b841e949
http://www.nessus.org/u?7d5b7803

Solution :

Apply security update KB4014793.

Risk factor :

High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)

This script is Copyright (C) 2017 Tenable Network Security, Inc.

KB3217841: Security Update for the Hyper-V Denial of Service Vulnerability (April 2017)


Synopsis:

The remote Windows host is affected by an information disclosure
vulnerability.

Description:

The remote Windows host is missing a security update KB3217841. It is,
therefore, affected by an denial of service vulnerability in Hyper-V
due to improper validation of input from a privileged user on a guest
operating system.

See also :

http://www.nessus.org/u?b2a99b49
http://www.nessus.org/u?f8013000

Solution :

Apply security update KB3217841.

Risk factor :

Medium / CVSS Base Score : 5.2
(CVSS2#AV:A/AC:M/Au:S/C:N/I:N/A:C)

This script is Copyright (C) 2017 Tenable Network Security, Inc.

Asterisk 11.x < 11.25.3 / 13.x < 13.17.2 / 14.x < 14.6.2 / 11.6 < 11.6-cert18 / 13.13 < 13.13-cert6 RTP/RTCP information leak (AST-2017-008)


Synopsis:

A telephony application running on the remote host is affected by
an information disclosure vulnerability.

Description:

According to its SIP banner, the version of Asterisk running on the
remote host is 11.x prior to 11.25.3, 13.x prior to 13.17.2,
14.x prior to 14.6.2, 11.6 prior to 11.6-cert18, or 13.13 prior to
13.13-cert6. It is therefore, affected by an information disclosure
vulnerability due to insufficient RTCP packet validation. A remote
attacker could potentially read buffer contents and redirect where
the next RTCP report goes.

Note that Nessus has not tested for these issues but has instead
relied only on the application's self-reported version number.

See also :

http://downloads.asterisk.org/pub/security/AST-2017-008.html

Solution :

Upgrade to Asterisk version 11.25.3 / 13.17.2 / 14.6.2 / 11.6-cert18 / 13.13-cert6 or later.

Risk factor :

Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)

This script is Copyright (C) 2017 Tenable Network Security, Inc.

Juniper Junos HTTPS Server Certificate AV Vulnerability (JSA10822)


Synopsis:

The remote device is missing a vendor-supplied security patch.

Description:

According to its self-reported version number, the remote Junos device
is affected by a vulnerability in that the HTTPS server certificate is
not verified before downloading anti-virus updates.

See also :

http://www.nessus.org/u?8997bb76

Solution :

Apply the relevant Junos software release referenced in
Juniper advisory JSA10822.

Risk factor :

High / CVSS Base Score : 7.8
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)

This script is Copyright (C) 2017 Tenable Network Security, Inc.

Juniper Junos DoS Vulnerability (JSA10821)


Synopsis:

The remote device is missing a vendor-supplied security patch.

Description:

According to its self-reported version number, the remote Junos device
is affected by a vulnerability in the express path feature that could
cause the flowd process to crash.

See also :

http://www.nessus.org/u?40868300

Solution :

Apply the relevant Junos software release referenced in
Juniper advisory JSA10821.

Risk factor :

High / CVSS Base Score : 7.8
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)

This script is Copyright (C) 2017 Tenable Network Security, Inc.

Juniper Junos BGP Update Vulnerability (JSA10820)


Synopsis:

The remote device is missing a vendor-supplied security patch.

Description:

According to its self-reported version number, the remote Junos device
is affected by a vulnerability in the 'bgp-error-tolerance' feature
that when enabled, a BGP UPDATE containing a specifically crafted set of
transitive attributes can cause the RPD routing process to crash and restart.

See also :

http://www.nessus.org/u?42d39d43

Solution :

Apply the relevant Junos software release or workarounds referenced in
Juniper advisory JSA10820.

Risk factor :

High / CVSS Base Score : 7.8
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)

This script is Copyright (C) 2017 Tenable Network Security, Inc.

Juniper Junos Remote Execution Vulnerability (JSA10818)


Synopsis:

The remote device is missing a vendor-supplied security patch.

Description:

According to its self-reported version number, the remote Junos device
is affected by a vulnerability in the pluggable authentication module
(PAM) of Juniper Networks Junos OS that may allow an unauthenticated network
based attacker to potentially execute arbitrary code or crash daemons
such as telnetd or sshd that make use of PAM.

See also :

http://www.nessus.org/u?fb27d038

Solution :

Apply the relevant Junos software release referenced in
Juniper advisory JSA10818.

Risk factor :

High / CVSS Base Score : 7.8
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)

This script is Copyright (C) 2017 Tenable Network Security, Inc.

Juniper Junos DoS Telnet Vulnerability (JSA10817)


Synopsis:

The remote device is missing a vendor-supplied security patch.

Description:

According to its self-reported version number, the remote Junos device
is affected by two vulnerabilities in the telnetd service that
may allow a remote unauthenticated attacker to cause a denial of service
through memory and/or CPU consumption.

See also :

http://www.nessus.org/u?0d927783

Solution :

Apply the relevant Junos software release or workarounds referenced in
Juniper advisory JSA10817.

Risk factor :

High / CVSS Base Score : 7.8
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)

This script is Copyright (C) 2017 Tenable Network Security, Inc.

Juniper Junos Kernel Vulnerability (JSA10816)


Synopsis:

The remote device is missing a vendor-supplied security patch.

Description:

According to its self-reported version number, the remote Junos device
is affected by a vulnerability in the loopback interface that could
cause the kernel to hang.

See also :

http://www.nessus.org/u?496f4c5d

Solution :

Apply the relevant Junos software release or workarounds referenced in
Juniper advisory JSA10816.

Risk factor :

High / CVSS Base Score : 7.8
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)

This script is Copyright (C) 2017 Tenable Network Security, Inc.

Juniper Junos FPC Crash Vulnerability (JSA10814)


Synopsis:

The remote device is missing a vendor-supplied security patch.

Description:

According to its self-reported version number, the remote Junos device
is affected by a vulnerability in the extended-statistics component that
can cause the FPC to crash.

See also :

http://www.nessus.org/u?fcab52ab

Solution :

Apply the relevant Junos software release or workarounds referenced in
Juniper advisory JSA10814.

Risk factor :

High / CVSS Base Score : 7.8
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)

This script is Copyright (C) 2017 Tenable Network Security, Inc.

Juniper Junos SRX Flowd Crash Vulnerability (JSA10813)


Synopsis:

The remote device is missing a vendor-supplied security patch.

Description:

According to its self-reported version number, the remote Junos device
is affected by a vulnerability in which a crafted ICMP packet embedded
within a NAT64 IPv6 to IPv4 tunnel may cause the flowd process to crash.

See also :

http://www.nessus.org/u?e847046b

Solution :

Apply the relevant Junos software release referenced in
Juniper advisory JSA10813.

Risk factor :

High / CVSS Base Score : 7.8
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)

This script is Copyright (C) 2017 Tenable Network Security, Inc.

Juniper Junos SRX Flowd Crash Vulnerability (JSA10811)


Synopsis:

The remote device is missing a vendor-supplied security patch.

Description:

According to its self-reported version number, the remote Junos device
is affected by a vulnerability where one or more ALGs enabled may
cause a flowd crash when traffic is processed by the Sun/MS-RPC ALGs.

See also :

http://www.nessus.org/u?19d29f37

Solution :

Apply the relevant Junos software release or workarounds referenced in
Juniper advisory JSA10811.

Risk factor :

High / CVSS Base Score : 7.8
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)

This script is Copyright (C) 2017 Tenable Network Security, Inc.

Juniper Junos BGP PDU Vulnerability (JSA10810)


Synopsis:

The remote device is missing a vendor-supplied security patch.

Description:

According to its self-reported version number, the remote Junos device
is affected by a vulnerability in the way the router receives a crafted BGP PDU.

See also :

http://www.nessus.org/u?09c9d843

Solution :

Apply the relevant Junos software release referenced in Juniper
advisory JSA10810.

Risk factor :

High / CVSS Base Score : 7.8
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)

This script is Copyright (C) 2017 Tenable Network Security, Inc.

PostgreSQL Empty Password Handling Remote Authentication Bypass


Synopsis:

Postgresql has a flaw that allows the attacker to login with empty password.

Description:

PostgreSQL contains a flaw that is triggered when attempting to
authenticate to the database with an empty password using a modified
or a non-libpq-based client. This allows a remote attacker to
bypass authentication mechanisms.

See also :

https://www.postgresql.org/docs/9.6/static/release-9-5-8.html

Solution :

Upgrade to PostgreSQL 9.6.4, 9.5.8, 9.4.13, 9.3.18, 9.2.22 or later.

Risk factor :

High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)

This script is Copyright (C) 2017 Tenable Network Security, Inc.

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2791-1)


Synopsis:

The remote SUSE host is missing one or more security updates.

Description:

This update for the Linux Kernel 3.12.74-60_64_60 fixes several
issues. The following security bugs were fixed :

- CVE-2017-15274: security/keys/keyctl.c in the Linux
kernel did not consider the case of a NULL payload in
conjunction with a nonzero length value, which allowed
local users to cause a denial of service (NULL pointer
dereference and OOPS) via a crafted add_key or keyctl
system call (bsc#1045327).

- CVE-2017-1000112: Updated patch for this issue to be in
sync with the other livepatches. Description of the
issue: Prevent race condition in net-packet code that
could have been exploited by unprivileged users to gain
root access (bsc#1052368, bsc#1052311).

- CVE-2017-9242: The __ip6_append_data function in
net/ipv6/ip6_output.c was too late in checking whether
an overwrite of an skb data structure may occur, which
allowed local users to cause a denial of service (system
crash) via crafted system calls (bsc#1042892).

- CVE-2017-8890: The inet_csk_clone_lock function in
net/ipv4/inet_connection_sock.c allowed attackers to
cause a denial of service (double free) or possibly have
unspecified other impact by leveraging use of the accept
system call (bsc#1038564).

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

See also :

https://bugzilla.suse.com/1038564
https://bugzilla.suse.com/1042892
https://bugzilla.suse.com/1045327
https://bugzilla.suse.com/1052311
https://bugzilla.suse.com/1052368
https://www.suse.com/security/cve/CVE-2017-1000112.html
https://www.suse.com/security/cve/CVE-2017-15274.html
https://www.suse.com/security/cve/CVE-2017-8890.html
https://www.suse.com/security/cve/CVE-2017-9242.html
http://www.nessus.org/u?1cd03bd9

Solution :

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Server for SAP 12-SP1:zypper in -t patch
SUSE-SLE-SAP-12-SP1-2017-1732=1

SUSE Linux Enterprise Server 12-SP1-LTSS:zypper in -t patch
SUSE-SLE-SERVER-12-SP1-2017-1732=1

To bring your system up-to-date, use 'zypper patch'.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.8
(CVSS2#E:POC/RL:OF/RC:C)
Public Exploit Available : true

This script is Copyright (C) 2017 Tenable Network Security, Inc.

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2790-1) (BlueBorne)


Synopsis:

The remote SUSE host is missing one or more security updates.

Description:

This update for the Linux Kernel 3.12.69-60_64_35 fixes one issue. The
following security bugs were fixed :

- CVE-2017-15274: security/keys/keyctl.c in the Linux
kernel did not consider the case of a NULL payload in
conjunction with a nonzero length value, which allowed
local users to cause a denial of service (NULL pointer
dereference and OOPS) via a crafted add_key or keyctl
system call (bsc#1045327).

- CVE-2017-1000251: The native Bluetooth stack in the
Linux Kernel (BlueZ) was vulnerable to a stack overflow
vulnerability in the processing of L2CAP configuration
responses resulting in Remote code execution in kernel
space (bsc#1057950).

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

See also :

https://bugzilla.suse.com/1045327
https://bugzilla.suse.com/1057950
https://www.suse.com/security/cve/CVE-2017-1000251.html
https://www.suse.com/security/cve/CVE-2017-15274.html
http://www.nessus.org/u?b220e385

Solution :

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Server for SAP 12-SP1:zypper in -t patch
SUSE-SLE-SAP-12-SP1-2017-1731=1

SUSE Linux Enterprise Server 12-SP1-LTSS:zypper in -t patch
SUSE-SLE-SERVER-12-SP1-2017-1731=1

To bring your system up-to-date, use 'zypper patch'.

Risk factor :

High / CVSS Base Score : 8.3
(CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.9
(CVSS2#E:F/RL:U/RC:ND)
Public Exploit Available : true

This script is Copyright (C) 2017 Tenable Network Security, Inc.

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2788-1) (BlueBorne)


Synopsis:

The remote SUSE host is missing one or more security updates.

Description:

This update for the Linux Kernel 3.12.74-60_64_45 fixes one issue. The
following security bugs were fixed :

- CVE-2017-15274: security/keys/keyctl.c in the Linux
kernel did not consider the case of a NULL payload in
conjunction with a nonzero length value, which allowed
local users to cause a denial of service (NULL pointer
dereference and OOPS) via a crafted add_key or keyctl
system call (bsc#1045327).

- CVE-2017-1000251: The native Bluetooth stack in the
Linux Kernel (BlueZ) was vulnerable to a stack overflow
vulnerability in the processing of L2CAP configuration
responses resulting in Remote code execution in kernel
space (bsc#1057950).

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

See also :

https://bugzilla.suse.com/1045327
https://bugzilla.suse.com/1057950
https://www.suse.com/security/cve/CVE-2017-1000251.html
https://www.suse.com/security/cve/CVE-2017-15274.html
http://www.nessus.org/u?d50a574a

Solution :

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Server for SAP 12-SP1:zypper in -t patch
SUSE-SLE-SAP-12-SP1-2017-1729=1

SUSE Linux Enterprise Server 12-SP1-LTSS:zypper in -t patch
SUSE-SLE-SERVER-12-SP1-2017-1729=1

To bring your system up-to-date, use 'zypper patch'.

Risk factor :

High / CVSS Base Score : 8.3
(CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.9
(CVSS2#E:F/RL:U/RC:ND)
Public Exploit Available : true

This script is Copyright (C) 2017 Tenable Network Security, Inc.

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2787-1) (BlueBorne)


Synopsis:

The remote SUSE host is missing one or more security updates.

Description:

This update for the Linux Kernel 3.12.74-60_64_40 fixes one issue. The
following security bugs were fixed :

- CVE-2017-15274: security/keys/keyctl.c in the Linux
kernel did not consider the case of a NULL payload in
conjunction with a nonzero length value, which allowed
local users to cause a denial of service (NULL pointer
dereference and OOPS) via a crafted add_key or keyctl
system call (bsc#1045327).

- CVE-2017-1000251: The native Bluetooth stack in the
Linux Kernel (BlueZ) was vulnerable to a stack overflow
vulnerability in the processing of L2CAP configuration
responses resulting in Remote code execution in kernel
space (bsc#1057950).

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

See also :

https://bugzilla.suse.com/1045327
https://bugzilla.suse.com/1057950
https://www.suse.com/security/cve/CVE-2017-1000251.html
https://www.suse.com/security/cve/CVE-2017-15274.html
http://www.nessus.org/u?6da586cc

Solution :

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Server for SAP 12-SP1:zypper in -t patch
SUSE-SLE-SAP-12-SP1-2017-1730=1

SUSE Linux Enterprise Server 12-SP1-LTSS:zypper in -t patch
SUSE-SLE-SERVER-12-SP1-2017-1730=1

To bring your system up-to-date, use 'zypper patch'.

Risk factor :

High / CVSS Base Score : 8.3
(CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.9
(CVSS2#E:F/RL:U/RC:ND)
Public Exploit Available : true

This script is Copyright (C) 2017 Tenable Network Security, Inc.

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2786-1) (BlueBorne)


Synopsis:

The remote SUSE host is missing one or more security updates.

Description:

This update for the Linux Kernel 3.12.67-60_64_24 fixes one issue. The
following security bugs were fixed :

- CVE-2017-15274: security/keys/keyctl.c in the Linux
kernel did not consider the case of a NULL payload in
conjunction with a nonzero length value, which allowed
local users to cause a denial of service (NULL pointer
dereference and OOPS) via a crafted add_key or keyctl
system call (bsc#1045327).

- CVE-2017-1000251: The native Bluetooth stack in the
Linux Kernel (BlueZ) was vulnerable to a stack overflow
vulnerability in the processing of L2CAP configuration
responses resulting in Remote code execution in kernel
space (bsc#1057950).

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

See also :

https://bugzilla.suse.com/1045327
https://bugzilla.suse.com/1057950
https://www.suse.com/security/cve/CVE-2017-1000251.html
https://www.suse.com/security/cve/CVE-2017-15274.html
http://www.nessus.org/u?2af49084

Solution :

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Server for SAP 12-SP1:zypper in -t patch
SUSE-SLE-SAP-12-SP1-2017-1725=1

SUSE Linux Enterprise Server 12-SP1-LTSS:zypper in -t patch
SUSE-SLE-SERVER-12-SP1-2017-1725=1

To bring your system up-to-date, use 'zypper patch'.

Risk factor :

High / CVSS Base Score : 8.3
(CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.9
(CVSS2#E:F/RL:U/RC:ND)
Public Exploit Available : true

This script is Copyright (C) 2017 Tenable Network Security, Inc.

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2785-1) (BlueBorne)


Synopsis:

The remote SUSE host is missing one or more security updates.

Description:

This update for the Linux Kernel 3.12.62-60_64_8 fixes one issue. The
following security bugs were fixed :

- CVE-2017-15274: security/keys/keyctl.c in the Linux
kernel did not consider the case of a NULL payload in
conjunction with a nonzero length value, which allowed
local users to cause a denial of service (NULL pointer
dereference and OOPS) via a crafted add_key or keyctl
system call (bsc#1045327).

- CVE-2017-1000251: The native Bluetooth stack in the
Linux Kernel (BlueZ) was vulnerable to a stack overflow
vulnerability in the processing of L2CAP configuration
responses resulting in Remote code execution in kernel
space (bsc#1057950).

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

See also :

https://bugzilla.suse.com/1045327
https://bugzilla.suse.com/1057950
https://www.suse.com/security/cve/CVE-2017-1000251.html
https://www.suse.com/security/cve/CVE-2017-15274.html
http://www.nessus.org/u?492ee4e6

Solution :

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Server for SAP 12-SP1:zypper in -t patch
SUSE-SLE-SAP-12-SP1-2017-1720=1

SUSE Linux Enterprise Server 12-SP1-LTSS:zypper in -t patch
SUSE-SLE-SERVER-12-SP1-2017-1720=1

To bring your system up-to-date, use 'zypper patch'.

Risk factor :

High / CVSS Base Score : 8.3
(CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.9
(CVSS2#E:F/RL:U/RC:ND)
Public Exploit Available : true

This script is Copyright (C) 2017 Tenable Network Security, Inc.

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2784-1) (BlueBorne)


Synopsis:

The remote SUSE host is missing one or more security updates.

Description:

This update for the Linux Kernel 3.12.60-52_63 fixes one issue. The
following security bugs were fixed :

- CVE-2017-15274: security/keys/keyctl.c in the Linux
kernel did not consider the case of a NULL payload in
conjunction with a nonzero length value, which allowed
local users to cause a denial of service (NULL pointer
dereference and OOPS) via a crafted add_key or keyctl
system call (bsc#1045327).

- CVE-2017-1000251: The native Bluetooth stack in the
Linux Kernel (BlueZ) was vulnerable to a stack overflow
vulnerability in the processing of L2CAP configuration
responses resulting in Remote code execution in kernel
space (bsc#1057950).

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

See also :

https://bugzilla.suse.com/1045327
https://bugzilla.suse.com/1057950
https://www.suse.com/security/cve/CVE-2017-1000251.html
https://www.suse.com/security/cve/CVE-2017-15274.html
http://www.nessus.org/u?8ea65627

Solution :

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Server 12-LTSS:zypper in -t patch
SUSE-SLE-SERVER-12-2017-1727=1

To bring your system up-to-date, use 'zypper patch'.

Risk factor :

High / CVSS Base Score : 8.3
(CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.9
(CVSS2#E:F/RL:U/RC:ND)
Public Exploit Available : true

This script is Copyright (C) 2017 Tenable Network Security, Inc.

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2783-1) (BlueBorne)


Synopsis:

The remote SUSE host is missing one or more security updates.

Description:

This update for the Linux Kernel 3.12.69-60_64_29 fixes one issue. The
following security bugs were fixed :

- CVE-2017-15274: security/keys/keyctl.c in the Linux
kernel did not consider the case of a NULL payload in
conjunction with a nonzero length value, which allowed
local users to cause a denial of service (NULL pointer
dereference and OOPS) via a crafted add_key or keyctl
system call (bsc#1045327).

- CVE-2017-1000251: The native Bluetooth stack in the
Linux Kernel (BlueZ) was vulnerable to a stack overflow
vulnerability in the processing of L2CAP configuration
responses resulting in Remote code execution in kernel
space (bsc#1057950).

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

See also :

https://bugzilla.suse.com/1045327
https://bugzilla.suse.com/1057950
https://www.suse.com/security/cve/CVE-2017-1000251.html
https://www.suse.com/security/cve/CVE-2017-15274.html
http://www.nessus.org/u?afd1e3e0

Solution :

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Server for SAP 12-SP1:zypper in -t patch
SUSE-SLE-SAP-12-SP1-2017-1723=1

SUSE Linux Enterprise Server 12-SP1-LTSS:zypper in -t patch
SUSE-SLE-SERVER-12-SP1-2017-1723=1

To bring your system up-to-date, use 'zypper patch'.

Risk factor :

High / CVSS Base Score : 8.3
(CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.9
(CVSS2#E:F/RL:U/RC:ND)
Public Exploit Available : true

This script is Copyright (C) 2017 Tenable Network Security, Inc.

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2782-1) (BlueBorne)


Synopsis:

The remote SUSE host is missing one or more security updates.

Description:

This update for the Linux Kernel 3.12.69-60_64_32 fixes one issue. The
following security bugs were fixed :

- CVE-2017-15274: security/keys/keyctl.c in the Linux
kernel did not consider the case of a NULL payload in
conjunction with a nonzero length value, which allowed
local users to cause a denial of service (NULL pointer
dereference and OOPS) via a crafted add_key or keyctl
system call (bsc#1045327).

- CVE-2017-1000251: The native Bluetooth stack in the
Linux Kernel (BlueZ) was vulnerable to a stack overflow
vulnerability in the processing of L2CAP configuration
responses resulting in Remote code execution in kernel
space (bsc#1057950).

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

See also :

https://bugzilla.suse.com/1045327
https://bugzilla.suse.com/1057950
https://www.suse.com/security/cve/CVE-2017-1000251.html
https://www.suse.com/security/cve/CVE-2017-15274.html
http://www.nessus.org/u?e144ec0d

Solution :

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Server for SAP 12-SP1:zypper in -t patch
SUSE-SLE-SAP-12-SP1-2017-1724=1

SUSE Linux Enterprise Server 12-SP1-LTSS:zypper in -t patch
SUSE-SLE-SERVER-12-SP1-2017-1724=1

To bring your system up-to-date, use 'zypper patch'.

Risk factor :

High / CVSS Base Score : 8.3
(CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.9
(CVSS2#E:F/RL:U/RC:ND)
Public Exploit Available : true

This script is Copyright (C) 2017 Tenable Network Security, Inc.

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2781-1) (BlueBorne)


Synopsis:

The remote SUSE host is missing one or more security updates.

Description:

This update for the Linux Kernel 3.12.61-52_83 fixes one issue. The
following security bugs were fixed :

- CVE-2017-15274: security/keys/keyctl.c in the Linux
kernel did not consider the case of a NULL payload in
conjunction with a nonzero length value, which allowed
local users to cause a denial of service (NULL pointer
dereference and OOPS) via a crafted add_key or keyctl
system call (bsc#1045327).

- CVE-2017-1000251: The native Bluetooth stack in the
Linux Kernel (BlueZ) was vulnerable to a stack overflow
vulnerability in the processing of L2CAP configuration
responses resulting in Remote code execution in kernel
space (bsc#1057950).

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

See also :

https://bugzilla.suse.com/1045327
https://bugzilla.suse.com/1057950
https://www.suse.com/security/cve/CVE-2017-1000251.html
https://www.suse.com/security/cve/CVE-2017-15274.html
http://www.nessus.org/u?b1825a32

Solution :

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Server 12-LTSS:zypper in -t patch
SUSE-SLE-SERVER-12-2017-1719=1

To bring your system up-to-date, use 'zypper patch'.

Risk factor :

High / CVSS Base Score : 8.3
(CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.9
(CVSS2#E:F/RL:U/RC:ND)
Public Exploit Available : true

This script is Copyright (C) 2017 Tenable Network Security, Inc.

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2780-1) (BlueBorne)


Synopsis:

The remote SUSE host is missing one or more security updates.

Description:

This update for the Linux Kernel 3.12.61-52_72 fixes one issue. The
following security bugs were fixed :

- CVE-2017-15274: security/keys/keyctl.c in the Linux
kernel did not consider the case of a NULL payload in
conjunction with a nonzero length value, which allowed
local users to cause a denial of service (NULL pointer
dereference and OOPS) via a crafted add_key or keyctl
system call (bsc#1045327).

- CVE-2017-1000251: The native Bluetooth stack in the
Linux Kernel (BlueZ) was vulnerable to a stack overflow
vulnerability in the processing of L2CAP configuration
responses resulting in Remote code execution in kernel
space (bsc#1057950).

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

See also :

https://bugzilla.suse.com/1045327
https://bugzilla.suse.com/1057950
https://www.suse.com/security/cve/CVE-2017-1000251.html
https://www.suse.com/security/cve/CVE-2017-15274.html
http://www.nessus.org/u?1ccd276d

Solution :

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Server 12-LTSS:zypper in -t patch
SUSE-SLE-SERVER-12-2017-1726=1

To bring your system up-to-date, use 'zypper patch'.

Risk factor :

High / CVSS Base Score : 8.3
(CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.9
(CVSS2#E:F/RL:U/RC:ND)
Public Exploit Available : true

This script is Copyright (C) 2017 Tenable Network Security, Inc.

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2779-1) (BlueBorne)


Synopsis:

The remote SUSE host is missing one or more security updates.

Description:

This update for the Linux Kernel 3.12.67-60_64_21 fixes one issue. The
following security bugs were fixed :

- CVE-2017-15274: security/keys/keyctl.c in the Linux
kernel did not consider the case of a NULL payload in
conjunction with a nonzero length value, which allowed
local users to cause a denial of service (NULL pointer
dereference and OOPS) via a crafted add_key or keyctl
system call (bsc#1045327).

- CVE-2017-1000251: The native Bluetooth stack in the
Linux Kernel (BlueZ) was vulnerable to a stack overflow
vulnerability in the processing of L2CAP configuration
responses resulting in Remote code execution in kernel
space (bsc#1057950).

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

See also :

https://bugzilla.suse.com/1045327
https://bugzilla.suse.com/1057950
https://www.suse.com/security/cve/CVE-2017-1000251.html
https://www.suse.com/security/cve/CVE-2017-15274.html
http://www.nessus.org/u?b29fa281

Solution :

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Server for SAP 12-SP1:zypper in -t patch
SUSE-SLE-SAP-12-SP1-2017-1721=1

SUSE Linux Enterprise Server 12-SP1-LTSS:zypper in -t patch
SUSE-SLE-SERVER-12-SP1-2017-1721=1

To bring your system up-to-date, use 'zypper patch'.

Risk factor :

High / CVSS Base Score : 8.3
(CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.9
(CVSS2#E:F/RL:U/RC:ND)
Public Exploit Available : true

This script is Copyright (C) 2017 Tenable Network Security, Inc.

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2778-1) (BlueBorne)


Synopsis:

The remote SUSE host is missing one or more security updates.

Description:

This update for the Linux Kernel 3.12.67-60_64_18 fixes one issue. The
following security bugs were fixed :

- CVE-2017-15274: security/keys/keyctl.c in the Linux
kernel did not consider the case of a NULL payload in
conjunction with a nonzero length value, which allowed
local users to cause a denial of service (NULL pointer
dereference and OOPS) via a crafted add_key or keyctl
system call (bsc#1045327).

- CVE-2017-1000251: The native Bluetooth stack in the
Linux Kernel (BlueZ) was vulnerable to a stack overflow
vulnerability in the processing of L2CAP configuration
responses resulting in Remote code execution in kernel
space (bsc#1057950).

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

See also :

https://bugzilla.suse.com/1045327
https://bugzilla.suse.com/1057950
https://www.suse.com/security/cve/CVE-2017-1000251.html
https://www.suse.com/security/cve/CVE-2017-15274.html
http://www.nessus.org/u?f880c61e

Solution :

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Server for SAP 12-SP1:zypper in -t patch
SUSE-SLE-SAP-12-SP1-2017-1722=1

SUSE Linux Enterprise Server 12-SP1-LTSS:zypper in -t patch
SUSE-SLE-SERVER-12-SP1-2017-1722=1

To bring your system up-to-date, use 'zypper patch'.

Risk factor :

High / CVSS Base Score : 8.3
(CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.9
(CVSS2#E:F/RL:U/RC:ND)
Public Exploit Available : true

This script is Copyright (C) 2017 Tenable Network Security, Inc.

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2777-1) (BlueBorne)


Synopsis:

The remote SUSE host is missing one or more security updates.

Description:

This update for the Linux Kernel 3.12.60-52_60 fixes one issue. The
following security bugs were fixed :

- CVE-2017-15274: security/keys/keyctl.c in the Linux
kernel did not consider the case of a NULL payload in
conjunction with a nonzero length value, which allowed
local users to cause a denial of service (NULL pointer
dereference and OOPS) via a crafted add_key or keyctl
system call (bsc#1045327).

- CVE-2017-1000251: The native Bluetooth stack in the
Linux Kernel (BlueZ) was vulnerable to a stack overflow
vulnerability in the processing of L2CAP configuration
responses resulting in Remote code execution in kernel
space (bsc#1057950).

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

See also :

https://bugzilla.suse.com/1045327
https://bugzilla.suse.com/1057950
https://www.suse.com/security/cve/CVE-2017-1000251.html
https://www.suse.com/security/cve/CVE-2017-15274.html
http://www.nessus.org/u?4f7e88e6

Solution :

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Server 12-LTSS:zypper in -t patch
SUSE-SLE-SERVER-12-2017-1718=1

To bring your system up-to-date, use 'zypper patch'.

Risk factor :

High / CVSS Base Score : 8.3
(CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.9
(CVSS2#E:F/RL:U/RC:ND)
Public Exploit Available : true

This script is Copyright (C) 2017 Tenable Network Security, Inc.

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2776-1) (BlueBorne)


Synopsis:

The remote SUSE host is missing one or more security updates.

Description:

This update for the Linux Kernel 3.12.60-52_57 fixes one issue. The
following security bugs were fixed :

- CVE-2017-15274: security/keys/keyctl.c in the Linux
kernel did not consider the case of a NULL payload in
conjunction with a nonzero length value, which allowed
local users to cause a denial of service (NULL pointer
dereference and OOPS) via a crafted add_key or keyctl
system call (bsc#1045327).

- CVE-2017-1000251: The native Bluetooth stack in the
Linux Kernel (BlueZ) was vulnerable to a stack overflow
vulnerability in the processing of L2CAP configuration
responses resulting in Remote code execution in kernel
space (bsc#1057950).

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

See also :

https://bugzilla.suse.com/1045327
https://bugzilla.suse.com/1057950
https://www.suse.com/security/cve/CVE-2017-1000251.html
https://www.suse.com/security/cve/CVE-2017-15274.html
http://www.nessus.org/u?e152064f

Solution :

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Server 12-LTSS:zypper in -t patch
SUSE-SLE-SERVER-12-2017-1717=1

To bring your system up-to-date, use 'zypper patch'.

Risk factor :

High / CVSS Base Score : 8.3
(CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.9
(CVSS2#E:F/RL:U/RC:ND)
Public Exploit Available : true

This script is Copyright (C) 2017 Tenable Network Security, Inc.

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2775-1)


Synopsis:

The remote SUSE host is missing one or more security updates.

Description:

This update for the Linux Kernel 3.12.61-52_92 fixes several issues.
The following security bugs were fixed :

- CVE-2017-15274: security/keys/keyctl.c in the Linux
kernel did not consider the case of a NULL payload in
conjunction with a nonzero length value, which allowed
local users to cause a denial of service (NULL pointer
dereference and OOPS) via a crafted add_key or keyctl
system call (bsc#1045327).

- CVE-2017-1000112: Updated patch for this issue to be in
sync with the other livepatches. Description of the
issue: Prevent race condition in net-packet code that
could have been exploited by unprivileged users to gain
root access (bsc#1052368, bsc#1052311).

- CVE-2017-9242: The __ip6_append_data function in
net/ipv6/ip6_output.c was too late in checking whether
an overwrite of an skb data structure may occur, which
allowed local users to cause a denial of service (system
crash) via crafted system calls (bsc#1042892).

- CVE-2017-7645: The NFSv2/NFSv3 server in the nfsd
subsystem allowed remote attackers to cause a denial of
service (system crash) via a long RPC reply
(bsc#1046191).

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

See also :

https://bugzilla.suse.com/1042892
https://bugzilla.suse.com/1045327
https://bugzilla.suse.com/1046191
https://bugzilla.suse.com/1052311
https://bugzilla.suse.com/1052368
https://www.suse.com/security/cve/CVE-2017-1000112.html
https://www.suse.com/security/cve/CVE-2017-15274.html
https://www.suse.com/security/cve/CVE-2017-7645.html
https://www.suse.com/security/cve/CVE-2017-9242.html
http://www.nessus.org/u?a6c3a5f4

Solution :

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Server 12-LTSS:zypper in -t patch
SUSE-SLE-SERVER-12-2017-1716=1

To bring your system up-to-date, use 'zypper patch'.

Risk factor :

High / CVSS Base Score : 7.8
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS Temporal Score : 7.4
(CVSS2#E:F/RL:U/RC:ND)
Public Exploit Available : true

This script is Copyright (C) 2017 Tenable Network Security, Inc.

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2774-1) (BlueBorne)


Synopsis:

The remote SUSE host is missing one or more security updates.

Description:

This update for the Linux Kernel 3.12.61-52_86 fixes one issue. The
following security bugs were fixed :

- CVE-2017-15274: security/keys/keyctl.c in the Linux
kernel did not consider the case of a NULL payload in
conjunction with a nonzero length value, which allowed
local users to cause a denial of service (NULL pointer
dereference and OOPS) via a crafted add_key or keyctl
system call (bsc#1045327).

- CVE-2017-1000251: The native Bluetooth stack in the
Linux Kernel (BlueZ) was vulnerable to a stack overflow
vulnerability in the processing of L2CAP configuration
responses resulting in Remote code execution in kernel
space (bsc#1057950).

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

See also :

https://bugzilla.suse.com/1045327
https://bugzilla.suse.com/1057950
https://www.suse.com/security/cve/CVE-2017-1000251.html
https://www.suse.com/security/cve/CVE-2017-15274.html
http://www.nessus.org/u?745ce2fe

Solution :

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Server 12-LTSS:zypper in -t patch
SUSE-SLE-SERVER-12-2017-1711=1

To bring your system up-to-date, use 'zypper patch'.

Risk factor :

High / CVSS Base Score : 8.3
(CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.9
(CVSS2#E:F/RL:U/RC:ND)
Public Exploit Available : true

This script is Copyright (C) 2017 Tenable Network Security, Inc.

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2773-1) (BlueBorne)


Synopsis:

The remote SUSE host is missing one or more security updates.

Description:

This update for the Linux Kernel 3.12.61-52_89 fixes one issue. The
following security bugs were fixed :

- CVE-2017-15274: security/keys/keyctl.c in the Linux
kernel did not consider the case of a NULL payload in
conjunction with a nonzero length value, which allowed
local users to cause a denial of service (NULL pointer
dereference and OOPS) via a crafted add_key or keyctl
system call (bsc#1045327).

- CVE-2017-1000251: The native Bluetooth stack in the
Linux Kernel (BlueZ) was vulnerable to a stack overflow
vulnerability in the processing of L2CAP configuration
responses resulting in Remote code execution in kernel
space (bsc#1057950).

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

See also :

https://bugzilla.suse.com/1045327
https://bugzilla.suse.com/1057950
https://www.suse.com/security/cve/CVE-2017-1000251.html
https://www.suse.com/security/cve/CVE-2017-15274.html
http://www.nessus.org/u?fb0a3a96

Solution :

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Server 12-LTSS:zypper in -t patch
SUSE-SLE-SERVER-12-2017-1710=1

To bring your system up-to-date, use 'zypper patch'.

Risk factor :

High / CVSS Base Score : 8.3
(CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.9
(CVSS2#E:F/RL:U/RC:ND)
Public Exploit Available : true

This script is Copyright (C) 2017 Tenable Network Security, Inc.

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now