Scientific Linux Security Update : kexec-tools on SL7.x x86_64

This script is Copyright (C) 2015 Tenable Network Security, Inc.


Synopsis :

The remote Scientific Linux host is missing one or more security
updates.

Description :

It was found that the module-setup.sh script provided by kexec-tools
created temporary files in an insecure way. A malicious, local user
could use this flaw to conduct a symbolic link attack, allowing them
to overwrite the contents of arbitrary files. (CVE-2015-0267)

This update also fixes the following bug :

- On Atomic Host systems, the kdump tool previously saved
kernel crash dumps in the /sysroot/crash file instead of
the /var/crash file. The parsing error that caused this
problem has been fixed, and the kernel crash dumps are
now correctly saved in /var/crash.

In addition, this update adds the following enhancement :

- The makedumpfile command now supports the new sadump
format that can represent more than 16 TB of physical
memory space. This allows users of makedumpfile to read
dump files over 16 TB, generated by sadump on certain
upcoming server models.

See also :

http://www.nessus.org/u?56c42f79

Solution :

Update the affected kexec-tools, kexec-tools-debuginfo and / or
kexec-tools-eppic packages.

Risk factor :

Low / CVSS Base Score : 3.6
(CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:P)

Family: Scientific Linux Local Security Checks

Nessus Plugin ID: 83452 ()

Bugtraq ID:

CVE ID: CVE-2015-0267

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now