SuSE 11.1 Security Update : Linux kernel (SAT Patch Numbers 3462 / 3463)

high Nessus Plugin ID 51615

Language:

Synopsis

The remote SuSE 11 host is missing one or more security updates.

Description

This update of the SUSE Linux Enterprise Server 11 SP1 kernel brings the kernel to 2.6.32.24 and fixes some critical security bugs and other non-security bugs.

Following security bugs were fixed :

- A iovec integer overflow in RDS sockets was fixed which could lead to local attackers gaining kernel privileges.
(CVE-2010-3865)

- A local privilege escalation in RDS sockets allowed local attackers to gain privileges. Please note that the net/rds socket protocol module only lives in the.
(CVE-2010-3904)

-extra kernel package, which is not installed by default on the SUSE Linux Enterprise Server 11.

- A problem in the compat ioctl handling in video4linux allowed local attackers with a video device plugged in to gain privileges on x86_64 systems. (CVE-2010-2963)

Solution

Apply SAT patch number 3462 / 3463 as appropriate.

Plugin Details

Severity: High

ID: 51615

File Name: suse_11_kernel-ec2-101103.nasl

Version: 1.11

Type: local

Agent: unix

Family: SuSE Local Security Checks

Published: 1/21/2011

Updated: 1/14/2021

Supported Sensors: Nessus Agent

Risk Information

VPR

Risk Factor: Critical

Score: 9.2

CVSS v2

Risk Factor: High

Base Score: 7.2

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:11:kernel-ec2, p-cpe:/a:novell:suse_linux:11:kernel-ec2-base, cpe:/o:novell:suse_linux:11

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/3/2010

Exploitable With

CANVAS (CANVAS)

Core Impact

Metasploit (Reliable Datagram Sockets (RDS) Privilege Escalation)

Reference Information

CVE: CVE-2010-2963, CVE-2010-3865, CVE-2010-3904