The remote VMware ESXi 5.0 host is affected by multiple vulnerabilities :

  - A denial of service vulnerability exists in the     big2_toUtf8() function in file lib/xmltok.c in the     libexpat library. A remote attacker can exploit this,     via an XML document having malformed UTF-8 sequences, to     cause a buffer over-read, thus crashing the application.
    (CVE-2009-3560)

  - A denial of service vulnerability exists in the     updatePosition() function in file lib/xmltok.c in the     libexpat library. A remote attacker can exploit this,     via an XML document having malformed UTF-8 sequences, to     cause a buffer over-read, thus crashing the application.
    (CVE-2009-3720)

  - An integer overflow condition exists in the     BZ2_decompress() function in file decompress.c in the     bzip2 and libbzip2 library. A remote attacker can     exploit this, via a crafted compressed file, to cause     a denial of service or the execution of arbitrary code.
    (CVE-2010-0405)

  - A denial of service vulnerability exists in the audioop     module due to multiple integer overflows conditions in     file audioop.c. A remote attacker can exploit this, via     a large fragment or argument, to cause a buffer     overflow, resulting in an application crash.
    (CVE-2010-1634)

  - A denial of service vulnerability exists in the audioop     module due to a failure to verify the relationships     between size arguments and byte string length. A remote     attacker can exploit this, via crafted arguments, to     cause memory corruption, resulting in an application     crash. (CVE-2010-2089)

  - A flaw exists in the urllib and urllib2 modules due to     processing Location headers that specify redirection to     a file. A remote attacker can exploit this, via a     crafted URL, to gain sensitive information or cause a     denial of service. (CVE-2011-1521)

  - A privilege escalation vulnerability exists due to an     incorrect ACL being used for the VMware Tools folder. An     attacker on an adjacent network with access to a guest     operating system can exploit this to gain elevated     privileges on the guest operating system.
    (CVE-2012-1518)

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2011-10:01 advisory.

    Python is an interpreted, interactive, object-oriented programming language often compared to Tcl, Perl,     Scheme or Java. Python includes modules, classes, exceptions, very high level dynamic data types and     dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various     windowing systems (X11, Motif, Tk, Mac and MFC).
    Programmers can write new built-in modules for Python in C or C++. Python can be used as an extension     language for applications that need a programmable interface. This package contains most of the standard     Python modules, as well as modules for interfacing to the Tix widget set for Tk and RPM.
    Note that documentation for Python is provided in the python-docs package.
    Security issues fixed with this release:
    CVE-2008-5983     Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2.6 and earlier, and     possibly later versions, prepends an empty string to sys.path when the argv[0] argument does not contain a     path separator, which might allow local users to execute arbitrary code via a Trojan horse Python file in     the current working directory.
    CVE-2009-4134     Buffer underflow in the rgbimg module in Python 2.5 allows remote attackers to cause a denial of service     (application crash) via a large ZSIZE value in a black-and-white (aka B/W) RGB image that triggers an     invalid pointer dereference.
    CVE-2010-1449     Integer overflow in rgbimgmodule.c in the rgbimg module in Python 2.5 allows remote attackers to have an     unspecified impact via a large image that triggers a buffer overflow. NOTE: this vulnerability exists     because of an incomplete fix for CVE-2008-3143.12.
    CVE-2010-1450     Multiple buffer overflows in the RLE decoder in the rgbimg module in Python 2.5 allow remote attackers to     have an unspecified impact via an image file containing crafted data that triggers improper processing     within the (1) longimagedata or (2) expandrow function.
    CVE-2010-1634     Multiple integer overflows in audioop.c in the audioop module in Python 2.6, 2.7, 3.1, and 3.2 allow     context-dependent attackers to cause a denial of service (application crash) via a large fragment, as     demonstrated by a call to audioop.lin2lin with a long string in the first argument, leading to a buffer     overflow. NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-3143.5.
    CVE-2010-2089     The audioop module in Python 2.7 and 3.2 does not verify the relationships between size arguments and byte     string lengths, which allows context-dependent attackers to cause a denial of service (memory corruption     and application crash) via crafted arguments, as demonstrated by a call to audioop.reverse with a one-byte     string, a different vulnerability than CVE-2010-1634.
    Fixed bugs:
    * When starting a child process from the subprocess module in Python 2.4, the parent process could leak     file descriptors if an error occurred. This update resolves the issue.
    * Prior to Python 2.7, programs that used 'ulimit -n' to enable communication with large numbers of     subprocesses could still monitor only 1024 file descriptors at a time, which caused an exception:
    ValueError: filedescriptor out of range in select()     This was due to the subprocess module using the 'select' system call. The module now uses the 'poll'     system call, removing this limitation.
    * Prior to Python 2.5, the tarfile module failed to unpack tar files if the path was longer than 100     characters. This update backports the tarfile module from Python 2.5 and the issue no longer occurs.
    * The email module incorrectly implemented the logic for obtaining attachment file names: the     get_filename() fallback for using the deprecated 'name' parameter of the 'Content-Type' header erroneously     used the 'Content-Disposition' header. This update backports a fix from Python 2.6, which resolves this     issue.
    * Prior to version 2.5, Python's optimized memory allocator never released memory back to the system. The     memory usage of a long-running Python process would resemble a 'high-water mark'. This update backports a     fix from Python 2.5a1, which frees unused arenas, and adds a non-standard sys._debugmallocstats()     function, which prints diagnostic information to stderr. Finally, when running under Valgrind, the     optimized allocator is deactivated, to allow more convenient debugging of Python memory usage issues.
    * The urllib and urllib2 modules ignored the no_proxy variable, which could lead to programs such as 'yum'     erroneously accessing a proxy server for URLs covered by a 'no_proxy' exclusion. This has been fixed by     backporting fixes of urllib and urllib2, which respect the 'no_proxy' variable.
    Enhancements:
    * This update introduces a new python-libs package, subsuming the majority of the content of the core     python package. This makes both 32-bit and 64-bit Python libraries available on PowerPC systems.
    * The python-libs.i386 package is now available for 64-bit Itanium with the 32-bit Itanium compatibility     mode.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of Mac OS X 10.6 that does not have Security Update 2011-006 applied.  This update contains numerous security-related fixes for the following components :

  - Apache
  - Application Firewall
  - ATS
  - BIND
  - Certificate Trust Policy
  - CFNetwork
  - CoreFoundation
  - CoreMedia
  - File Systems
  - IOGraphics
  - iChat Server
  - Mailman
  - MediaKit
  - PHP
  - postfix
  - python
  - QuickTime
  - Tomcat
  - User Documentation
  - Web Server
  - X11

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The audioop module in Python 2.7 and 3.2 does not verify the relationships between size arguments and byte     string lengths, which allows context-dependent attackers to cause a denial of service (memory corruption     and application crash) via crafted arguments, as demonstrated by a call to audioop.reverse with a one-byte     string, a different vulnerability than CVE-2010-1634. (CVE-2010-2089)

Note that Nessus relies on the presence of the package as reported by the vendor.

a. ESX third-party update for Service Console kernel      The ESX Service Console Operating System (COS) kernel is updated to    kernel-2.6.18-274.3.1.el5 to fix multiple security issues in the    COS kernel.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2011-0726, CVE-2011-1078, CVE-2011-1079,    CVE-2011-1080, CVE-2011-1093, CVE-2011-1163, CVE-2011-1166,    CVE-2011-1170, CVE-2011-1171, CVE-2011-1172, CVE-2011-1494,    CVE-2011-1495, CVE-2011-1577, CVE-2011-1763, CVE-2010-4649,    CVE-2011-0695, CVE-2011-0711, CVE-2011-1044, CVE-2011-1182,    CVE-2011-1573, CVE-2011-1576, CVE-2011-1593, CVE-2011-1745,    CVE-2011-1746, CVE-2011-1776, CVE-2011-1936, CVE-2011-2022,    CVE-2011-2213, CVE-2011-2492, CVE-2011-1780, CVE-2011-2525,    CVE-2011-2689, CVE-2011-2482, CVE-2011-2491, CVE-2011-2495,    CVE-2011-2517, CVE-2011-2519, CVE-2011-2901 to these issues.
  b. ESX third-party update for Service Console cURL RPM      The ESX Service Console (COS) curl RPM is updated to cURL-7.15.5.9    resolving a security issues.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the name CVE-2011-2192 to this issue.
  c. ESX third-party update for Service Console nspr and nss RPMs      The ESX Service Console (COS) nspr and nss RPMs are updated to    nspr-4.8.8-1.el5_7 and nss-3.12.10-4.el5_7 respectively resolving    a security issues.
     A Certificate Authority (CA) issued fraudulent SSL certificates and    Netscape Portable Runtime (NSPR) and Network Security Services (NSS)    contain the built-in tokens of this fraudulent Certificate    Authority. This update renders all SSL certificates signed by the    fraudulent CA as untrusted for all uses.
  d. ESX third-party update for Service Console rpm RPMs      The ESX Service Console Operating System (COS) rpm packages are    updated to popt-1.10.2.3-22.el5_7.2, rpm-4.4.2.3-22.el5_7.2,    rpm-libs-4.4.2.3-22.el5_7.2 and rpm-python-4.4.2.3-22.el5_7.2    which fixes multiple security issues.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2010-2059 and CVE-2011-3378 to these    issues.
  e. ESX third-party update for Service Console samba RPMs      The ESX Service Console Operating System (COS) samba packages are    updated to samba-client-3.0.33-3.29.el5_7.4,    samba-common-3.0.33-3.29.el5_7.4 and    libsmbclient-3.0.33-3.29.el5_7.4 which fixes multiple security    issues in the Samba client.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2010-0547, CVE-2010-0787, CVE-2011-1678,    CVE-2011-2522 and CVE-2011-2694 to these issues.
     Note that ESX does not include the Samba Web Administration Tool    (SWAT) and therefore ESX COS is not affected by CVE-2011-2522 and    CVE-2011-2694.
  f. ESX third-party update for Service Console python package      The ESX Service Console (COS) python package is updated to    2.4.3-44 which fixes multiple security issues.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2009-3720, CVE-2010-3493, CVE-2011-1015 and    CVE-2011-1521 to these issues.
  g. ESXi update to third-party component python      The python third-party library is updated to python 2.5.6 which    fixes multiple security issues.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2009-3560, CVE-2009-3720, CVE-2010-1634,    CVE-2010-2089, and CVE-2011-1521 to these issues.

- Fri Jun 4 2010 David Malcolm <dmalcolm at redhat.com> -     2.6.4-27

    - ensure that the compiler is invoked with '-fwrapv'       (rhbz#594819)

    - CVE-2010-1634: fix various integer overflow checks in       the audioop module (patch 113)

  - CVE-2010-2089: further checks within the audioop module     (patch 114)

    - CVE-2008-5983: the new PySys_SetArgvEx entry point       from r81399 (patch 115)

    - Mon Apr 26 2010 Dennis Gilmore <dennis at ausil.us> -       2.6.4-26

    - disable --with-valgrind on sparc arches

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Backport from F14: - Fix for lone surrogates, utf8 and     certain encode error handlers. - Fix an incompatibility     between pyexpat and the system expat-2.0.1 that led to a     segfault running test_pyexpat.py (patch 110; upstream     issue 9054; rhbz#610312)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- a race condition in the accept() implementation of     smtpd.py could lead to a denial of service     (CVE-2010-3493).

  - integer overflows and insufficient size checks could     crash the audioop module (CVE-2010-2089, CVE-2010-1634).

It was found that many applications embedding the Python interpreter did not specify a valid full path to the script or application when calling the PySys_SetArgv API function, which could result in the addition of the current working directory to the module search path (sys.path). A local attacker able to trick a victim into running such an application in an attacker-controlled directory could use this flaw to execute code with the victim's privileges. This update adds the PySys_SetArgvEx API. Developers can modify their applications to use this new API, which sets sys.argv without modifying sys.path.
(CVE-2008-5983)

Multiple flaws were found in the Python rgbimg module. If an application written in Python was using the rgbimg module and loaded a specially crafted SGI image file, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2009-4134, CVE-2010-1449, CVE-2010-1450)

Multiple flaws were found in the Python audioop module. Supplying certain inputs could cause the audioop module to crash or, possibly, execute arbitrary code. (CVE-2010-1634, CVE-2010-2089)

This update also fixes the following bugs :

  - When starting a child process from the subprocess module     in Python 2.4, the parent process could leak file     descriptors if an error occurred. This update resolves     the issue. (BZ#609017)

  - Prior to Python 2.7, programs that used 'ulimit -n' to     enable communication with large numbers of subprocesses     could still monitor only 1024 file descriptors at a     time, which caused an exception :

    ValueError: filedescriptor out of range in select()

This was due to the subprocess module using the 'select' system call.
The module now uses the 'poll' system call, removing this limitation.
(BZ#609020)

  - Prior to Python 2.5, the tarfile module failed to unpack     tar files if the path was longer than 100 characters.
    This update backports the tarfile module from Python 2.5     and the issue no longer occurs. (BZ#263401)

  - The email module incorrectly implemented the logic for     obtaining attachment file names: the get_filename()     fallback for using the deprecated 'name' parameter of     the 'Content-Type' header erroneously used the     'Content-Disposition' header. This update backports a     fix from Python 2.6, which resolves this issue.
    (BZ#644147)

  - Prior to version 2.5, Python's optimized memory     allocator never released memory back to the system. The     memory usage of a long-running Python process would     resemble a 'high-water mark'. This update backports a     fix from Python 2.5a1, which frees unused arenas, and     adds a non-standard sys._debugmallocstats() function,     which prints diagnostic information to stderr. Finally,     when running under Valgrind, the optimized allocator is     deactivated, to allow more convenient debugging of     Python memory usage issues. (BZ#569093)

  - The urllib and urllib2 modules ignored the no_proxy     variable, which could lead to programs such as 'yum'     erroneously accessing a proxy server for URLs covered by     a 'no_proxy' exclusion. This update backports fixes of     urllib and urllib2, which respect the 'no_proxy'     variable, which fixes these issues. (BZ#549372)

As well, this update adds the following enhancements :

  - This update introduces a new python-libs package,     subsuming the majority of the content of the core python     package. This makes both 32-bit and 64-bit Python     libraries available on PowerPC systems. (BZ#625372)

  - The python-libs.i386 package is now available for 64-bit     Itanium with the 32-bit Itanium compatibility mode.
    (BZ#644761)

The remote host is running a version of Mac OS X 10.7.x that is prior to 10.7.2. This version contains numerous security-related fixes for the following components :

  - Apache
  - Application Firewall
  - ATS
  - BIND
  - Certificate Trust Policy
  - CFNetwork
  - CoreMedia
  - CoreProcesses
  - CoreStorage
  - File Systems
  - iChat Server
  - Kernel
  - libsecurity
  - Open Directory
  - PHP
  - python
  - QuickTime
  - SMB File Server
  - X11

ID	Name	Product	Family	Published	Updated	Severity
70881	ESXi 5.0 < Build 608089 Multiple Vulnerabilities (remote check)	Nessus	Misc.	11/13/2013	11/15/2018	high
284342	MiracleLinux 3 : python-2.4.3-43.0.1.AXS3 (AXSA:2011-10:01)	Nessus	Miracle Linux Local Security Checks	1/14/2026	1/14/2026	high
56481	Mac OS X Multiple Vulnerabilities (Security Update 2011-006)	Nessus	MacOS X Local Security Checks	10/13/2011	5/28/2024	critical
217210	Linux Distros Unpatched Vulnerability : CVE-2010-2089	Nessus	Misc.	3/3/2025	9/2/2026	critical
57749	VMSA-2012-0001 : VMware ESXi and ESX updates to third-party library and ESX Service Console	Nessus	VMware ESX Local Security Checks	1/31/2012	1/6/2021	high
47547	Fedora 13 : python-2.6.4-27.fc13 (2010-9652)	Nessus	Fedora Local Security Checks	7/1/2010	1/11/2021	medium
49107	Fedora 13 : python3-3.1.2-7.fc13 (2010-13388)	Nessus	Fedora Local Security Checks	9/4/2010	1/11/2021	medium
53756	openSUSE Security Update : libpython2_6-1_0 (openSUSE-SU-2010:1049-1)	Nessus	SuSE Local Security Checks	5/5/2011	1/14/2021	medium
60935	Scientific Linux Security Update : python on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	high
56480	Mac OS X 10.7.x < 10.7.2 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	10/13/2011	5/28/2024	critical

Detections

Analytics

Plugins Search

high

high

critical

critical

high

medium

medium

medium

high

critical