The SUSE Linux Enterprise 11 kernel was updated to 2.6.27.48, fixing various bugs and security issues :

  - The do_gfs2_set_flags() function in fs/gfs2/file.c of     the Linux kernel does not verify the ownership of a     file, which allows local users to bypass intended access     restrictions via a SETFLAGS ioctl request.
    (CVE-2010-1641)

  - The nfs_wait_on_request() function in fs/nfs/pagelist.c     of the Linux kernel allows attackers to cause a denial     of service (Oops) via unknown vectors related to     truncating a file and an operation that is not     interruptible. (CVE-2010-1087)

  - When strict overcommit is enabled, mm/shmem.c does not     properly handle the export of shmemfs objects by knfsd,     which allows attackers to cause a denial of service     (NULL pointer dereference and knfsd crash) or possibly     have unspecified other impact via unknown vectors.
    (CVE-2010-1643)

  - A race condition in the find_keyring_by_name() function     in security/keys/keyring.c of the Linux kernel allows     local users to cause a denial of service (memory     corruption and system crash) or possibly have     unspecified other impact via keyctl session commands     that trigger access to a dead keyring that is undergoing     deletion by the key_cleanup() function. (CVE-2010-1437)

  - arch/1/mm/fsl_booke_mmu.c in KGDB in the Linux kernel,     when running on PowerPC, does not properly perform a     security check for access to a kernel page, which allows     local users to overwrite arbitrary kernel memory.
    (CVE-2010-1446)

  - The release_one_tty() function in drivers/char/tty_io.c     of the Linux kernel omits certain required calls to the     put_pid() function, which has an unspecified impact and     local attack vectors. (CVE-2010-1162)

  - The r8169 driver of the Linux kernel does not properly     check the size of an Ethernet frame that exceeds the     MTU, which allows remote attackers to cause a denial of     service (temporary network outage) via a packet with a     crafted size, in conjunction with certain packets     containing A characters and certain packets containing E     characters; or cause a denial of service (system crash)     via a packet with a crafted size, in conjunction with     certain packets containing '0' characters, related to     the value of the status register and erroneous behavior     associated with the RxMaxSize register. This     vulnerability exists due to an incorrect fix for     CVE-2009-1389. (CVE-2009-4537)

For a list of non-security related fixes please refer to the kernel RPM changelog.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-4537     Fabian Yamaguchi reported a missing check for Ethernet     frames larger than the MTU in the r8169 driver. This may     allow users on the local network to crash a system,     resulting in a denial of service.

  - CVE-2010-0727     Sachin Prabhu reported an issue in the GFS2 filesystem.
    Local users can trigger a BUG() altering the permissions     on a locked file, resulting in a denial of service.

  - CVE-2010-1083     Linus Torvalds reported an issue in the USB subsystem,     which may allow local users to obtain portions of     sensitive kernel memory.

  - CVE-2010-1084     Neil Brown reported an issue in the Bluetooth subsystem     that may permit remote attackers to overwrite memory     through the creation of large numbers of sockets,     resulting in a denial of service.

  - CVE-2010-1086     Ang Way Chuang reported an issue in the DVB subsystem     for Digital TV adapters. By creating a specially-encoded     MPEG2-TS frame, a remote attacker could cause the     receiver to enter an endless loop, resulting in a denial     of service.

  - CVE-2010-1087     Trond Myklebust reported an issue in the NFS filesystem.
    A local user may cause an oops by sending a fatal signal     during a file truncation operation, resulting in a     denial of service.

  - CVE-2010-1088     Al Viro reported an issue where automount symlinks may     not be followed when LOOKUP_FOLLOW is not set. This has     an unknown security impact.

  - CVE-2010-1162     Catalin Marinas reported an issue in the tty subsystem     that allows local attackers to cause a kernel memory     leak, possibly resulting in a denial of service.

  - CVE-2010-1173     Chris Guo from Nokia China and Jukka Taimisto and Olli     Jarva from Codenomicon Ltd reported an issue in the SCTP     subsystem that allows a remote attacker to cause a     denial of service using a malformed init package.

  - CVE-2010-1187     Neil Hormon reported an issue in the TIPC subsystem.
    Local users can cause a denial of service by way of a     NULL pointer dereference by sending datagrams through     AF_TIPC before entering network mode.

  - CVE-2010-1437     Toshiyuki Okajima reported a race condition in the     keyring subsystem. Local users can cause memory     corruption via keyctl commands that access a keyring in     the process of being deleted, resulting in a denial of     service.

  - CVE-2010-1446     Wufei reported an issue with kgdb on the PowerPC     architecture, allowing local users to write to kernel     memory. Note: this issue does not affect binary kernels     provided by Debian. The fix is provided for the benefit     of users who build their own kernels from Debian source.

  - CVE-2010-1451     Brad Spengler reported an issue on the SPARC     architecture that allows local users to execute     non-executable pages.

This update also includes fixes a regression introduced by a previous update. See the referenced Debian bug page for details.

Security fixes :

  - a NULL pointer dereference flaw was found in the Linux     kernel NFSv4 implementation. Several of the NFSv4 file     locking functions failed to check whether a file had     been opened on the server before performing locking     operations on it. A local, unprivileged user on a system     with an NFSv4 share mounted could possibly use this flaw     to cause a kernel panic (denial of service) or escalate     their privileges. (CVE-2009-3726, Important)

  - a flaw was found in the sctp_process_unk_param()     function in the Linux kernel Stream Control Transmission     Protocol (SCTP) implementation. A remote attacker could     send a specially crafted SCTP packet to an SCTP     listening port on a target system, causing a kernel     panic (denial of service). (CVE-2010-1173, Important)

  - a race condition between finding a keyring by name and     destroying a freed keyring was found in the Linux kernel     key management facility. A local, unprivileged user     could use this flaw to cause a kernel panic (denial of     service) or escalate their privileges. (CVE-2010-1437,     Important)

Red Hat would like to thank Simon Vallet for responsibly reporting CVE-2009-3726; and Jukka Taimisto and Olli Jarva of Codenomicon Ltd, Nokia Siemens Networks, and Wind River on behalf of their customer, for responsibly reporting CVE-2010-1173.

Bug fixes :

  - RHBA-2007:0791 introduced a regression in the Journaling     Block Device (JBD). Under certain circumstances,     removing a large file (such as 300 MB or more) did not     result in inactive memory being freed, leading to the     system having a large amount of inactive memory. Now,     the memory is correctly freed. (BZ#589155)

  - the timer_interrupt() routine did not scale lost real     ticks to logical ticks correctly, possibly causing time     drift for 64-bit Scientific Linux 4 KVM (Kernel-based     Virtual Machine) guests that were booted with the     'divider=x' kernel parameter set to a value greater than     1. 'warning: many lost ticks' messages may have been     logged on the affected guest systems. (BZ#590551)

  - a bug could have prevented NFSv3 clients from having the     most up-to-date file attributes for files on a given     NFSv3 file system. In cases where a file type changed,     such as if a file was removed and replaced with a     directory of the same name, the NFSv3 client may not     have noticed this change until stat(2) was called (for     example, by running 'ls -l'). (BZ#596372)

  - RHBA-2007:0791 introduced bugs in the Linux kernel PCI-X     subsystem. These could have caused a system deadlock on     some systems where the BIOS set the default Maximum     Memory Read Byte Count (MMRBC) to 4096, and that also     use the Intel PRO/1000 Linux driver, e1000. Errors such     as 'e1000: eth[x]: e1000_clean_tx_irq: Detected Tx Unit     Hang' were logged. (BZ#596374)

  - an out of memory condition in a KVM guest, using the     virtio-net network driver and also under heavy network     stress, could have resulted in that guest being unable     to receive network traffic. Users had to manually remove     and re-add the virtio_net module and restart the network     service before networking worked as expected. Such     memory conditions no longer prevent KVM guests receiving     network traffic. (BZ#597310)

  - when an SFQ qdisc that limited the queue size to two     packets was added to a network interface, sending     traffic through that interface resulted in a kernel     crash. Such a qdisc no longer results in a kernel crash.
    (BZ#597312)

  - when an NFS client opened a file with the O_TRUNC flag     set, it received a valid stateid, but did not use that     stateid to perform the SETATTR call. Such cases were     rejected by Red Hat Enterprise Linux 4 NFS servers with     an 'NFS4ERR_BAD_STATEID' error, possibly preventing some     NFS clients from writing files to an NFS file system.
    (BZ#597314)

The system must be rebooted for this update to take effect.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2010-377:12 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system. The kernel     handles the basic functions of the operating system: memory allocation, process allocation, device input     and output, etc.
    Security issues fixed with this release:
    CVE-2010-0291     The Linux kernel before 2.6.32.4 allows local users to gain privileges or cause a denial of service     (panic) by calling the (1) mmap or (2) mremap function, aka the 'do_mremap() mess' or 'mremap/mmap mess.'     CVE-2010-0622     The wake_futex_pi function in kernel/futex.c in the Linux kernel before 2.6.33-rc7 does not properly     handle certain unlock operations for a Priority Inheritance (PI) futex, which allows local users to cause     a denial of service (OOPS) and possibly have unspecified other impact via vectors involving modification     of the futex value from user space.
    CVE-2010-1087     The nfs_wait_on_request function in fs/nfs/pagelist.c in Linux kernel 2.6.x through 2.6.33-rc5 allows     attackers to cause a denial of service (Oops) via unknown vectors related to truncating a file and an     operation that is not interruptible.
    CVE-2010-1088     fs/namei.c in Linux kernel 2.6.18 through 2.6.34 does not always follow NFS automount 'symlinks,' which     allows attackers to have an unknown impact, related to LOOKUP_FOLLOW.
    CVE-2010-1173     The sctp_process_unk_param function in net/sctp/sm_make_chunk.c in the Linux kernel 2.6.33.3 and earlier,     when SCTP is enabled, allows remote attackers to cause a denial of service (system crash) via an     SCTPChunkInit packet containing multiple invalid parameters that require a large amount of error data.
    CVE-2010-1187     The Transparent Inter-Process Communication (TIPC) functionality in Linux kernel 2.6.16-rc1 through     2.6.33, and possibly other versions, allows local users to cause a denial of service (kernel OOPS) by     sending datagrams through AF_TIPC before entering network mode, which triggers a NULL pointer dereference.
    CVE-2010-1436     gfs2 in the Linux kernel 2.6.18, and possibly other versions, does not properly handle when the gfs2_quota     struct occupies two separate pages, which allows local users to cause a denial of service (kernel panic)     via certain manipulations that cause an out-of-bounds write, as demonstrated by writing from an ext3 file     system to a gfs2 file system.
    CVE-2010-1437     Race condition in the find_keyring_by_name function in security/keys/keyring.c in the Linux kernel     2.6.34-rc5 and earlier allows local users to cause a denial of service (memory corruption and system     crash) or possibly have unspecified other impact via keyctl session commands that trigger access to a dead     keyring that is undergoing deletion by the key_cleanup function.
    CVE-2010-1641     The do_gfs2_set_flags function in fs/gfs2/file.c in the Linux kernel before 2.6.34-git10 does not verify     the ownership of a file, which allows local users to bypass intended access restrictions via a SETFLAGS     ioctl request.
    Fixed bugs:
    acpi
    - warn on hot-add of memory exceeding 4G boundary
    - fix WARN on unregister in power meter driver     block
    - cfq-iosched: fix IOPRIO_CLASS_IDLE accounting
    - cfq-iosched: async queue allocation per priority
    - cfq-iosched: fix async queue behaviour
    - cfq-iosched: propagate down request sync flag
    - introduce the rq_is_sync macro     fs
    - remove unneccessary f_ep_lock from fasync_helper     misc
    - add atomic64_cmpxcgh to x86_64 include files     mm
    - fix hugepage corruption using vm.drop_caches
    - clear page errors when issuing a fresh read of page     net
    - e1000: fix WoL init when WoL disabled in EEPROM
    - tg3: fix INTx fallback when MSI fails
    - sched: fix SFQ qdisc crash w/limit of 2 packets
    - bonding: fix broken multicast with round-robin mode
    - cnic: Fix crash during bnx2x MTU change
    - bxn2x: add dynamic lro disable support
    - sctp: file must be valid before setting timeout
    - e1000/e1000e: implement simple interrupt moderation
    - neigh: fix state transitions via Netlink request
    - tg3: fix panic in tg3_interrupt
    - cnic: fix bnx2x panic w/multiple interfaces enabled     nfs
    - revert retcode check in nfs_revalidate_mapping()
    - don't unhash dentry in nfs_lookup_revalidate     virt
    - don't compute pvclock adjustments if we trust tsc
    - add a global synchronization point for pvclock
    - enable pvclock flags in vcpu_time_info structure     virtio
    - fix GFP flags passed by virtio balloon driver     x86
    - grab atomic64 types from upstream     x86_64
    - fix time drift due to faulty lost tick tracking     xen
    - set hypervisor present CPUID bit

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

a. Service Console OS update for COS kernel

   This patch updates the service console kernel to fix multiple    security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-0415, CVE-2010-0307,    CVE-2010-0291, CVE-2010-0622, CVE-2010-1087, CVE-2010-1437, and    CVE-2010-1088 to these issues.

b. Likewise package updates

   Updates to the likewisekrb5, likewiseopenldap, likewiseopen,    and pamkrb5 packages address several security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2009-0844, CVE-2009-0845,    CVE-2009-0846, CVE-2009-4212, and CVE-2010-1321 to these issues.

a. vCenter Server and vCenter Update Manager update Microsoft    SQL Server 2005 Express Edition to Service Pack 3

   Microsoft SQL Server 2005 Express Edition (SQL Express)    distributed with vCenter Server 4.1 Update 1 and vCenter Update    Manager 4.1 Update 1 is upgraded from  SQL Express Service Pack 2    to SQL Express Service Pack 3, to address multiple security    issues that exist in the earlier releases of Microsoft SQL Express.

   Customers using other database solutions need not update for    these issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-5416, CVE-2008-0085, CVE-2008-0086,    CVE-2008-0107 and CVE-2008-0106 to the issues addressed in MS SQL    Express Service Pack 3.

b. vCenter Apache Tomcat Management Application Credential Disclosure

   The Apache Tomcat Manager application configuration file contains    logon credentials that can be read by unprivileged local users.

   The issue is resolved by removing the Manager application in    vCenter 4.1 Update 1.

   If vCenter 4.1 is updated to vCenter 4.1 Update 1 the logon    credentials are not present in the configuration file after the    update.

   VMware would like to thank Claudio Criscione of Secure Networking    for reporting this issue to us.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2010-2928 to this issue.

c. vCenter Server and ESX, Oracle (Sun) JRE is updated to version    1.6.0_21

   Oracle (Sun) JRE update to version 1.6.0_21, which addresses    multiple security issues that existed in earlier releases of    Oracle (Sun) JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Oracle (Sun) JRE 1.6.0_19: CVE-2009-3555, CVE-2010-0082,    CVE-2010-0084, CVE-2010-0085, CVE-2010-0087, CVE-2010-0088,    CVE-2010-0089, CVE-2010-0090, CVE-2010-0091, CVE-2010-0092,    CVE-2010-0093, CVE-2010-0094, CVE-2010-0095, CVE-2010-0837,    CVE-2010-0838, CVE-2010-0839, CVE-2010-0840, CVE-2010-0841,    CVE-2010-0842, CVE-2010-0843, CVE-2010-0844, CVE-2010-0845,    CVE-2010-0846, CVE-2010-0847, CVE-2010-0848, CVE-2010-0849,    CVE-2010-0850.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following name to the security issue fixed in    Oracle (Sun) JRE 1.6.0_20: CVE-2010-0886.

d. vCenter Update Manager Oracle (Sun) JRE is updated to version   1.5.0_26

   Oracle (Sun) JRE update to version 1.5.0_26, which addresses    multiple security issues that existed in earlier releases of    Oracle (Sun) JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Oracle (Sun) JRE 1.5.0_26: CVE-2010-3556, CVE-2010-3566,    CVE-2010-3567, CVE-2010-3550, CVE-2010-3561, CVE-2010-3573,    CVE-2010-3565,CVE-2010-3568, CVE-2010-3569,  CVE-2009-3555,    CVE-2010-1321, CVE-2010-3548, CVE-2010-3551, CVE-2010-3562,    CVE-2010-3571, CVE-2010-3554, CVE-2010-3559, CVE-2010-3572,    CVE-2010-3553, CVE-2010-3549, CVE-2010-3557, CVE-2010-3541,    CVE-2010-3574.

e. vCenter Server and ESX Apache Tomcat updated to version 6.0.28

   Apache Tomcat updated to version 6.0.28, which addresses multiple    security issues that existed in earlier releases of Apache Tomcat

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Apache Tomcat 6.0.24: CVE-2009-2693, CVE-2009-2901, CVE-2009-2902,i    and CVE-2009-3548.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Apache Tomcat 6.0.28: CVE-2010-2227, CVE-2010-1157.

f. vCenter Server third-party component OpenSSL updated to version    0.9.8n

   The version of the OpenSSL library in vCenter Server is updated to    0.9.8n.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-0740 and CVE-2010-0433 to the    issues addressed in this version of OpenSSL.

g. ESX third-party component OpenSSL updated to version 0.9.8p

   The version of the ESX OpenSSL library is updated to 0.9.8p.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-3864 and CVE-2010-2939 to the    issues addressed in this update.

h. ESXi third-party component cURL updated

   The version of cURL library in ESXi is updated.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-0734 to the issues addressed in    this update.

i. ESX third-party component pam_krb5 updated

   The version of pam_krb5 library is updated.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-3825 and CVE-2009-1384 to the    issues addressed in the update.

j. ESX third-party update for Service Console kernel

   The Service Console kernel is updated to include kernel version    2.6.18-194.11.1.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-1084, CVE-2010-2066, CVE-2010-2070,    CVE-2010-2226, CVE-2010-2248, CVE-2010-2521, CVE-2010-2524,    CVE-2010-0008, CVE-2010-0415, CVE-2010-0437, CVE-2009-4308,    CVE-2010-0003, CVE-2010-0007, CVE-2010-0307, CVE-2010-1086,    CVE-2010-0410, CVE-2010-0730, CVE-2010-1085, CVE-2010-0291,    CVE-2010-0622, CVE-2010-1087, CVE-2010-1173, CVE-2010-1437,    CVE-2010-1088, CVE-2010-1187, CVE-2010-1436, CVE-2010-1641, and    CVE-2010-3081 to the issues addressed in the update.

   Notes :
   - The update also addresses the 64-bit compatibility mode    stack pointer underflow issue identified by CVE-2010-3081. This    issue was patched in an ESX 4.1 patch prior to the release of    ESX 4.1 Update 1 and in a previous ESX 4.0 patch release.
   - The update also addresses CVE-2010-2240 for ESX 4.0.

ID	Name	Product	Family	Published	Updated	Severity
50922	SuSE 11 Security Update : Linux kernel (SAT Patch Numbers 2682 / 2687 / 2689)	Nessus	SuSE Local Security Checks	12/2/2010	1/14/2021	high
46725	Debian DSA-2053-1 : linux-2.6 - privilege escalation/denial of service/information leak	Nessus	Debian Local Security Checks	5/26/2010	1/4/2021	high
60802	Scientific Linux Security Update : kernel on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	high
291412	MiracleLinux 3 : kernel-2.6.18-194.3.AXS3 (AXSA:2010-377:12)	Nessus	Miracle Linux Local Security Checks	1/19/2026	2/5/2026	high
50611	VMSA-2010-0016 : VMware ESXi and ESX third-party updates for Service Console and Likewise components	Nessus	VMware ESX Local Security Checks	11/16/2010	1/6/2021	critical
51971	VMSA-2011-0003 : Third-party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX	Nessus	VMware ESX Local Security Checks	2/14/2011	5/25/2022	high

Detections

Analytics

Plugins Search

high

high

high

high

critical

high