The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0413 advisory.

    The glibc packages contain the standard C libraries used by multiple     programs on the system. These packages contain the standard C and the     standard math libraries. Without these two libraries, a Linux system cannot     function properly.

    The fix for CVE-2010-3847 introduced a regression in the way the dynamic     loader expanded the $ORIGIN dynamic string token specified in the RPATH and     RUNPATH entries in the ELF library header. A local attacker could use this     flaw to escalate their privileges via a setuid or setgid program using     such a library. (CVE-2011-0536)

    It was discovered that the glibc fnmatch() function did not properly     restrict the use of alloca(). If the function was called on sufficiently     large inputs, it could cause an application using fnmatch() to crash or,     possibly, execute arbitrary code with the privileges of the application.
    (CVE-2011-1071)

    It was discovered that the locale command did not produce properly escaped     output as required by the POSIX specification. If an attacker were able to     set the locale environment variables in the environment of a script that     performed shell evaluation on the output of the locale command, and that     script were run with different privileges than the attacker's, it could     execute arbitrary code with the privileges of the script. (CVE-2011-1095)

    All users should upgrade to these updated packages, which contain     backported patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0413 advisory.

    - Avoid too much stack use in fnmatch (#681054, CVE-2011-1071)
    - Properly quote output of locale (#625893, CVE-2011-1095)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0125 advisory.

  - glibc: __tzfile_read integer overflow to buffer overflow (CVE-2009-5029)

  - glibc: ldd unexpected code execution issue (CVE-2009-5064)

  - glibc: Improper encoding of names with certain special character in utilities for writing to mtab table     (CVE-2010-0296)

  - glibc: ld.so d_tag signedness error in elf_get_dynamic_info (CVE-2010-0830)

  - glibc: fnmatch() alloca()-based memory corruption flaw (CVE-2011-1071, CVE-2011-1659)

  - glibc: Suid mount helpers fail to anticipate RLIMIT_FSIZE (CVE-2011-1089)

  - glibc: insufficient quoting in the locale command output (CVE-2011-1095)

  - glibc: svc_run() produces high cpu usage when accept() fails with EMFILE error (CVE-2011-4609)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The GNU C Library (aka glibc or libc6) before 2.12.2 and Embedded GLIBC (EGLIBC) allow context-dependent attackers to execute arbitrary code or cause a denial of service (memory consumption) via a long UTF8 string that is used in an fnmatch call, aka a 'stack extension attack,' a related issue to CVE-2010-2898, CVE-2010-1917, and CVE-2007-4782, as originally reported for use of this library by Google Chrome. (CVE-2011-1071)

This update contains the following fixes :

  - Specially crafted input to the fnmatch function could     cause an integer overflow. (CVE-2011-1071)

  - The output of the 'locale' command was not properly     quoted. (CVE-2011-1095)

  - Don't search the current directory if $ORIGIN is in     RPATH of libraries called by setuid binaries.
    (CVE-2011-0536)

This update fixes the following security issues found in glibc :

  - Specially crafted input to the fnmatch function could     cause an integer overflow. (CVE-2011-1071)

  - The output of the 'locale' command was not properly     quoted. (CVE-2011-1095)

  - Unprivileged users could read the NIS shadow database.
    (CVE-2010-0015)

  - Don't search the current directory if $ORIGIN is in     RPATH of libraries called by setuid binaries.
    (CVE-2011-0536) The update also includes fixes for     non-security bugs. Please refer to the package changelog     for details.

The following bugs have been fixed :

  - Specially crafted input to the fnmatch function could     cause an integer overflow. (CVE-2011-1071)

  - The output of the 'locale' command was not properly     quoted. (CVE-2011-1095)

  - Don't search the current directory if $ORIGIN is in     RPATH of libraries called by setuid binaries.
    (CVE-2011-0536)

  - The update also includes fixes for non-security bugs.
    Please refer to the package changelog for details.

The remote VMware ESX host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including arbitrary code execution vulnerabilities, in several third-party components and libraries :

  - DHCP
  - glibc

From Red Hat Security Advisory 2012:0125 :

Updated glibc packages that fix multiple security issues and one bug are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly.

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the glibc library read timezone files. If a carefully-crafted timezone file was loaded by an application linked against glibc, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2009-5029)

A flaw was found in the way the ldd utility identified dynamically linked libraries. If an attacker could trick a user into running ldd on a malicious binary, it could result in arbitrary code execution with the privileges of the user running ldd. (CVE-2009-5064)

It was discovered that the glibc addmntent() function, used by various mount helper utilities, did not sanitize its input properly. A local attacker could possibly use this flaw to inject malformed lines into the mtab (mounted file systems table) file via certain setuid mount helpers, if the attacker were allowed to mount to an arbitrary directory under their control. (CVE-2010-0296)

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the glibc library loaded ELF (Executable and Linking Format) files. If a carefully-crafted ELF file was loaded by an application linked against glibc, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2010-0830)

It was discovered that the glibc fnmatch() function did not properly restrict the use of alloca(). If the function was called on sufficiently large inputs, it could cause an application using fnmatch() to crash or, possibly, execute arbitrary code with the privileges of the application. (CVE-2011-1071)

It was found that the glibc addmntent() function, used by various mount helper utilities, did not handle certain errors correctly when updating the mtab (mounted file systems table) file. If such utilities had the setuid bit set, a local attacker could use this flaw to corrupt the mtab file. (CVE-2011-1089)

It was discovered that the locale command did not produce properly escaped output as required by the POSIX specification. If an attacker were able to set the locale environment variables in the environment of a script that performed shell evaluation on the output of the locale command, and that script were run with different privileges than the attacker's, it could execute arbitrary code with the privileges of the script. (CVE-2011-1095)

An integer overflow flaw was found in the glibc fnmatch() function. If an attacker supplied a long UTF-8 string to an application linked against glibc, it could cause the application to crash.
(CVE-2011-1659)

A denial of service flaw was found in the remote procedure call (RPC) implementation in glibc. A remote attacker able to open a large number of connections to an RPC service that is using the RPC implementation from glibc, could use this flaw to make that service use an excessive amount of CPU time. (CVE-2011-4609)

Red Hat would like to thank the Ubuntu Security Team for reporting CVE-2010-0830, and Dan Rosenberg for reporting CVE-2011-1089. The Ubuntu Security Team acknowledges Dan Rosenberg as the original reporter of CVE-2010-0830.

This update also fixes the following bug :

* When using an nscd package that is a different version than the glibc package, the nscd service could fail to start. This update makes the nscd package require a specific glibc version to prevent this problem. (BZ#657009)

Users should upgrade to these updated packages, which resolve these issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Switch to use malloc when the input line is too long     [Orabug 19951108]

  - Use a /sys/devices/system/cpu/online for
    _SC_NPROCESSORS_ONLN implementation [Orabug 17642251]     (Joe Jin)

  - Fix parsing of numeric hosts in gethostbyname_r     (CVE-2015-0235, #1183532).

  - Remove gconv transliteration loadable modules support     (CVE-2014-5119, - _nl_find_locale: Improve handling of     crafted locale names (CVE-2014-0475, 

  - Fix patch for integer overflows in *valloc and memalign.
    (CVE-2013-4332, #1011805).

  - Fix return code when starting an already started nscd     daemon (#979413).

  - Fix getnameinfo for many PTR record queries (#1020486).

  - Return EINVAL error for negative sizees to getgroups     (#995207).

  - Fix integer overflows in *valloc and memalign.
    (CVE-2013-4332, #1011805).

  - Add support for newer L3 caches on x86-64 and correctly     count the number of hardware threads sharing a cacheline     (#1003420).

  - Revert incomplete fix for bug #758193.

  - Fix _nl_find_msg malloc failure case, and callers     (#957089).

  - Test on init_fct, not result->__init_fct, after     demangling (#816647).

  - Don't handle ttl == 0 specially (#929035).

  - Fix multibyte character processing crash in regexp     (CVE-2013-0242, #951132)

  - Fix getaddrinfo stack overflow resulting in application     crash (CVE-2013-1914, #951132)

  - Add missing patch to avoid use after free (#816647)

  - Fix race in initgroups compat_call (#706571)

  - Fix return value from getaddrinfo when servers are down.
    (#758193)

  - Fix fseek on wide character streams. Sync's seeking code     with RHEL 6 (#835828)

  - Call feraiseexcept only if exceptions are not masked     (#861871).

  - Always demangle function before checking for NULL value.
    (#816647).

  - Do not fail in ttyname if /proc is not available     (#851450).

  - Fix errno for various overflow situations in vfprintf.
    Add missing overflow checks. (#857387)

  - Handle failure of _nl_explode_name in all cases     (#848481)

  - Define the default fuzz factor to 2 to make it easier to     manipulate RHEL 5 RPMs on RHEL 6 and newer systems.

  - Fix race in intl/* testsuite (#849202)

  - Fix out of bounds array access in strto* exposed by     847930 patch.

  - Really fix POWER4 strncmp crash (#766832).

  - Fix integer overflow leading to buffer overflow in     strto* (#847930)

  - Fix race in msort/qsort (#843672)

  - Fix regression due to 797096 changes (#845952)

  - Do not use PT_IEEE_IP ptrace calls (#839572)

  - Update ULPs (#837852)

  - Fix various transcendentals in non-default rounding     modes (#837852)

  - Fix unbound alloca in vfprintf (#826947)

  - Fix iconv segfault if the invalid multibyte character     0xffff is input when converting from IBM930. (#823905)

  - Fix fnmatch when '*' wildcard is applied on a file name     containing multibyte chars. (#819430)

  - Fix unbound allocas use in glob_in_dir, getaddrinfo and     others. (#797096)

  - Fix segfault when running ld.so --verify on some DSO's     in current working directory. (#808342)

  - Incorrect initialization order for dynamic loader     (#813348)

  - Fix return code when stopping already stopped nscd     daemon (#678227)

  - Remove MAP_32BIT for pthread stack mappings, use     MAP_STACK instead (#641094)

  - Fix setuid vs sighandler_setxid race (#769852)

  - Fix access after end of search string in regex matcher     (#757887)

  - Fix POWER4 strncmp crash (#766832)

  - Fix SC_*CACHE detection for X5670 cpus (#692182)

  - Fix parsing IPV6 entries in /etc/resolv.conf (#703239)

  - Fix double-free in nss_nis code (#500767)

  - Add kernel VDSO support for s390x (#795896)

  - Fix race in malloc arena creation and make     implementation match documented behaviour (#800240)

  - Do not override TTL of CNAME with TTL of its alias     (#808014)

  - Fix short month names in fi_FI locale #(657266).

  - Fix nscd crash for group with large number of members     (#788989)

  - Fix Slovakia currency (#799853)

  - Fix getent malloc failure check (#806403)

  - Fix short month names in zh_CN locale (#657588)

  - Fix decimal point symbol for Portuguese currency     (#710216)

  - Avoid integer overflow in sbrk (#767358)

  - Avoid race between [,__de]allocate_stack and
    __reclaim_stacks during fork (#738665)

  - Fix race between IO_flush_all_lockp & pthread_cancel     (#751748)

  - Fix memory leak in NIS endgrent (#809325)

  - Allow getaddr to accept SCTP socket types in hints     (#765710)

  - Fix errno handling in vfprintf (#794814)

  - Filter out <built-in> when building file lists     (#784646).

  - Avoid 'nargs' integer overflow which could be used to     bypass FORTIFY_SOURCE (#794814)

  - Fix currency_symbol for uk_UA (#639000)

  - Correct test for detecting cycle during topo sort     (#729661)

  - Check values from TZ file header (#767688)

  - Complete the numeric settings fix (#675259)

  - Complete the change for error codes from pthread_create     (#707998)

  - Truncate time values in Linux futimes when falling back     to utime (#758252)

  - Update systemtaparches

  - Add rules to build libresolv with SSP flags (#756453)

  - Fix PLT reference

  - Workaround misconfigured system (#702300)

  - Update systemtaparches

  - Correct cycle detection during dependency sorting     (#729661)

  - Add gdb hooks (#711924)

  - Fix alloca accounting in strxfm and strcoll (#585433)

  - Correct cycle detection during dependency sorting     (#729661)

  - ldd: never run file directly (#531160)

  - Implement greedy matching of weekday and month names     (#657570)

  - Fix incorrect numeric settings (#675259)

  - Implement new mode for NIS passwd.adjunct.byname table     (#678318)

  - Query NIS domain only when needed (#703345)

  - Count total processors using sysfs (#706894)

  - Translate clone error if necessary (#707998)

  - Workaround kernel clobbering robust list (#711531)

  - Use correct type when casting d_tag (#599056,     CVE-2010-0830)

  - Report write error in addmnt even for cached streams     (#688980, CVE-2011-1089)

  - Don't underestimate length of DST substitution (#694655)

  - Don't allocate executable stack when it cannot be     allocated in the first 4G (#448011)

  - Initialize resolver state in nscd (#676039)

  - No cancel signal in unsafe places (#684808)

  - Check size of pattern in wide character representation     in fnmatch (#681054)

  - Avoid too much stack use in fnmatch (#681054,     CVE-2011-1071)

  - Properly quote output of locale (#625893, CVE-2011-1095)

  - Don't leave empty element in rpath when skipping the     first element, ignore rpath elements containing     non-isolated use of $ORIGIN when privileged (#667974,     CVE-2011-0536)

  - Fix handling of newline in addmntent (#559579,     CVE-2010-0296)

  - Don't ignore $ORIGIN in libraries (#670988)

  - Fix false assertion (#604796)

  - Fix ordering of DSO constructors and destructors     (#604796)

  - Fix typo (#531576)

  - Fix concurrency problem between dl_open and     dl_iterate_phdr (#649956)

  - Require suid bit on audit objects in privileged programs     (#645678, CVE-2010-3856)

  - Never expand $ORIGIN in privileged programs (#643819,     CVE-2010-3847)

  - Add timestamps to nscd logs (#527558)

  - Fix index wraparound handling in memusage (#531576)

  - Handle running out of buffer space with IPv6 mapping     enabled (#533367)

  - Don't deadlock in __dl_iterate_phdr while (un)loading     objects (#549813)

  - Avoid alloca in setenv for long strings (#559974)

  - Recognize POWER7 and ISA 2.06 (#563563)

  - Add support for AT_BASE_PLATFORM (#563599)

  - Restore locking in free_check (#585674)

  - Fix lookup of collation sequence value during regexp     matching (#587360)

  - Fix POWER6 memcpy/memset (#579011)

  - Fix scope handling during dl_close (#593675)

  - Enable -fasynchronous-unwind-tables throughout (#593047)

  - Fix crash when aio thread creation fails (#566712)

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities in several third-party components and libraries :

  - Kernel
  - krb5
  - glibc
  - mtp2sas
  - mptsas
  - mptspi

ID	Name	Product	Family	Published	Updated	Severity
53292	RHEL 6 : glibc (RHSA-2011:0413)	Nessus	Red Hat Local Security Checks	4/5/2011	4/14/2025	high
68245	Oracle Linux 6 : glibc (ELSA-2011-0413)	Nessus	Oracle Linux Local Security Checks	7/12/2013	4/29/2025	high
57928	RHEL 4 : glibc (RHSA-2012:0125)	Nessus	Red Hat Local Security Checks	2/14/2012	4/27/2024	high
79606	F5 Networks BIG-IP : GNU C Library vulnerability (SOL15885)	Nessus	F5 Networks Local Security Checks	11/28/2014	3/10/2021	critical
55440	SuSE9 Security Update : glibc (YOU Patch Number 12775)	Nessus	SuSE Local Security Checks	6/28/2011	1/14/2021	medium
57106	SuSE 11.1 Security Update : glibc (SAT Patch Number 4572)	Nessus	SuSE Local Security Checks	12/13/2011	1/19/2021	high
55441	SuSE 11.1 Security Update : glibc (SAT Patch Number 4572)	Nessus	SuSE Local Security Checks	6/28/2011	1/19/2021	high
55442	SuSE 10 Security Update : glibc (ZYPP Patch Number 7575)	Nessus	SuSE Local Security Checks	6/28/2011	1/19/2021	medium
89679	VMware ESX Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0010) (remote check)	Nessus	Misc.	3/4/2016	1/6/2021	high
68455	Oracle Linux 4 : glibc (ELSA-2012-0125)	Nessus	Oracle Linux Local Security Checks	7/12/2013	1/14/2021	high
81118	OracleVM 3.2 : glibc (OVMSA-2015-0023) (GHOST)	Nessus	OracleVM Local Security Checks	2/2/2015	1/4/2021	high
89680	VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0012) (remote check)	Nessus	Misc.	3/4/2016	5/14/2023	high

Detections

Analytics

Plugins Search

high

high

high

critical

medium

high

high

medium

high

high

high

high