Updated kernel packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* a flaw was found in the IPv6 Extension Header (EH) handling implementation in the Linux kernel. The skb->dst data structure was not properly validated in the ipv6_hop_jumbo() function. This could possibly lead to a remote denial of service. (CVE-2007-4567, Important)

* a flaw was found in each of the following Intel PRO/1000 Linux drivers in the Linux kernel: e1000 and e1000e. A remote attacker using packets larger than the MTU could bypass the existing fragment check, resulting in partial, invalid frames being passed to the network stack. These flaws could also possibly be used to trigger a remote denial of service. (CVE-2009-4536, CVE-2009-4538, Important)

* a flaw was found in the Realtek r8169 Ethernet driver in the Linux kernel. Receiving overly-long frames with network cards supported by this driver could possibly result in a remote denial of service.
(CVE-2009-4537, Important)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5.2 Extended Update Support.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* a flaw was found in the IPv6 Extension Header (EH) handling implementation in the Linux kernel. The skb->dst data structure was not properly validated in the ipv6_hop_jumbo() function. This could possibly lead to a remote denial of service. (CVE-2007-4567, Important)

* the possibility of a timeout value overflow was found in the Linux kernel high-resolution timers functionality, hrtimers. This could allow a local, unprivileged user to execute arbitrary code, or cause a denial of service (kernel panic). (CVE-2007-5966, Important)

* memory leaks were found on some error paths in the icmp_send() function in the Linux kernel. This could, potentially, cause the network connectivity to cease. (CVE-2009-0778, Important)

* a deficiency was found in the Linux kernel system call auditing implementation on 64-bit systems. This could allow a local, unprivileged user to circumvent a system call audit configuration, if that configuration filtered based on the 'syscall' number or arguments. (CVE-2009-0834, Important)

* a flaw was found in the Intel PRO/1000 Linux driver (e1000) in the Linux kernel. Frames with sizes near the MTU of an interface may be split across multiple hardware receive descriptors. Receipt of such a frame could leak through a validation check, leading to a corruption of the length check. A remote attacker could use this flaw to send a specially crafted packet that would cause a denial of service or code execution. (CVE-2009-1385, Important)

* the ADDR_COMPAT_LAYOUT and MMAP_PAGE_ZERO flags were not cleared when a setuid or setgid program was executed. A local, unprivileged user could use this flaw to bypass the mmap_min_addr protection mechanism and perform a NULL pointer dereference attack, or bypass the Address Space Layout Randomization (ASLR) security feature.
(CVE-2009-1895, Important)

* a flaw was found in each of the following Intel PRO/1000 Linux drivers in the Linux kernel: e1000 and e1000e. A remote attacker using packets larger than the MTU could bypass the existing fragment check, resulting in partial, invalid frames being passed to the network stack. These flaws could also possibly be used to trigger a remote denial of service. (CVE-2009-4536, CVE-2009-4538, Important)

* a flaw was found in the Realtek r8169 Ethernet driver in the Linux kernel. Receiving overly-long frames with a certain revision of the network cards supported by this driver could possibly result in a remote denial of service. (CVE-2009-4537, Important)

Note: This update also fixes several bugs. Documentation for these bug fixes will be available shortly from www.redhat.com/docs/en-US/errata/RHSA-2010-0079/Kernel_Security_Update / index.html

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The minix filesystem did not properly validate certain filesystem values. If a local attacker could trick the system into attempting to mount a corrupted minix filesystem, the kernel could be made to hang for long periods of time, resulting in a denial of service. This was only vulnerable in Ubuntu 7.04 and 7.10. (CVE-2006-6058)

The signal handling on PowerPC systems using HTX allowed local users to cause a denial of service via floating point corruption. This was only vulnerable in Ubuntu 6.10 and 7.04. (CVE-2007-3107)

The Linux kernel did not properly validate the hop-by-hop IPv6 extended header. Remote attackers could send a crafted IPv6 packet and cause a denial of service via kernel panic. This was only vulnerable in Ubuntu 7.04. (CVE-2007-4567)

The JFFS2 filesystem with ACL support enabled did not properly store permissions during inode creation and ACL setting. Local users could possibly access restricted files after a remount. This was only vulnerable in Ubuntu 7.04 and 7.10. (CVE-2007-4849)

Chris Evans discovered an issue with certain drivers that use the ieee80211_rx function. Remote attackers could send a crafted 802.11 frame and cause a denial of service via crash. This was only vulnerable in Ubuntu 7.04 and 7.10. (CVE-2007-4997)

Alex Smith discovered an issue with the pwc driver for certain webcam devices. A local user with physical access to the system could remove the device while a userspace application had it open and cause the USB subsystem to block. This was only vulnerable in Ubuntu 7.04.
(CVE-2007-5093)

Scott James Remnant discovered a coding error in ptrace. Local users could exploit this and cause the kernel to enter an infinite loop.
This was only vulnerable in Ubuntu 7.04 and 7.10. (CVE-2007-5500)

It was discovered that the Linux kernel could dereference a NULL pointer when processing certain IPv4 TCP packets. A remote attacker could send a crafted TCP ACK response and cause a denial of service via crash. This was only vulnerable in Ubuntu 7.10. (CVE-2007-5501)

Warren Togami discovered that the hrtimer subsystem did not properly check for large relative timeouts. A local user could exploit this and cause a denial of service via soft lockup. (CVE-2007-5966)

Venustech AD-LAB discovered a buffer overflow in the isdn net subsystem. This issue is exploitable by local users via crafted input to the isdn_ioctl function. (CVE-2007-6063)

It was discovered that the isdn subsystem did not properly check for NULL termination when performing ioctl handling. A local user could exploit this to cause a denial of service. (CVE-2007-6151)

Blake Frantz discovered that when a root process overwrote an existing core file, the resulting core file retained the previous core file's ownership. Local users could exploit this to gain access to sensitive information. (CVE-2007-6206)

Hugh Dickins discovered the when using the tmpfs filesystem, under rare circumstances, a kernel page may be improperly cleared. A local user may be able to exploit this and read sensitive kernel data or cause a denial of service via crash. (CVE-2007-6417)

Bill Roman discovered that the VFS subsystem did not properly check access modes. A local user may be able to gain removal privileges on directories. (CVE-2008-0001).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2013-0039 for details.

a. Service Console update for COS kernel

   Updated COS package 'kernel' addresses the security issues that are    fixed through versions 2.6.18-164.11.1.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2009-2695, CVE-2009-2908, CVE-2009-3228,    CVE-2009-3286, CVE-2009-3547, CVE-2009-3613 to the security issues    fixed in kernel 2.6.18-164.6.1

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2009-3612, CVE-2009-3620, CVE-2009-3621,    CVE-2009-3726 to the security issues fixed in kernel 2.6.18-164.9.1.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2007-4567, CVE-2009-4536, CVE-2009-4537,    CVE-2009-4538 to the security issues fixed in kernel 2.6.18-164.10.1

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2006-6304, CVE-2009-2910, CVE-2009-3080,    CVE-2009-3556, CVE-2009-3889, CVE-2009-3939, CVE-2009-4020,    CVE-2009-4021, CVE-2009-4138, CVE-2009-4141, and CVE-2009-4272 to    the security issues fixed in kernel 2.6.18-164.11.1.

b. ESXi userworld update for ntp

   The Network Time Protocol (NTP) is used to synchronize the time of    a computer client or server to another server or reference time    source.

   A vulnerability in ntpd could allow a remote attacker to cause a    denial of service (CPU and bandwidth consumption) by using    MODE_PRIVATE to send a spoofed (1) request or (2) response packet    that triggers a continuous exchange of MODE_PRIVATE error responses    between two NTP daemons.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-3563 to this issue.

c. Service Console package openssl updated to 0.9.8e-12.el5_4.1

   OpenSSL is a toolkit implementing SSL v2/v3 and TLS protocols with    full-strength cryptography world-wide.

   A memory leak in the zlib could allow a remote attacker to cause a    denial of service (memory consumption) via vectors that trigger    incorrect calls to the CRYPTO_cleanup_all_ex_data function.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-4355 to this issue.

   A vulnerability was discovered which may allow remote attackers to    spoof certificates by using MD2 design flaws to generate a hash    collision in less than brute-force time. NOTE: the scope of this    issue is currently limited because the amount of computation    required is still large.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-2409 to this issue.

   This update also includes security fixes that were first addressed    in version openssl-0.9.8e-12.el5.i386.rpm.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the names CVE-2009-0590, CVE-2009-1377, CVE-2009-1378,    CVE-2009-1379, CVE-2009-1386 and CVE-2009-1387 to these issues.

d. Service Console update for krb5 to 1.6.1-36.el5_4.1 and pam_krb5 to    2.2.14-15.

   Kerberos is a network authentication protocol. It is designed to    provide strong authentication for client/server applications by    using secret-key cryptography.

   Multiple integer underflows in the AES and RC4 functionality in the    crypto library could allow remote attackers to cause a denial of    service (daemon crash) or possibly execute arbitrary code by    providing ciphertext with a length that is too short to be valid.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-4212 to this issue.

   The service console package for pam_krb5 is updated to version    pam_krb5-2.2.14-15. This update fixes a flaw found in pam_krb5. In    some non-default configurations (specifically, where pam_krb5 would    be the first module to prompt for a password), a remote attacker    could use this flaw to recognize valid usernames, which would aid a    dictionary-based password guess attack.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-1384 to this issue.

e. Service Console package bind updated to 9.3.6-4.P1.el5_4.2

   BIND (Berkeley Internet Name Daemon) is by far the most widely used    Domain Name System (DNS) software on the Internet.

   A vulnerability was discovered which could allow remote attacker to    add the Authenticated Data (AD) flag to a forged NXDOMAIN response    for an existing domain.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2010-0097 to this issue.

   A vulnerability was discovered which could allow remote attackers    to conduct DNS cache poisoning attacks by receiving a recursive    client query and sending a response that contains CNAME or DNAME    records, which do not have the intended validation before caching.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2010-0290 to this issue.

   A vulnerability was found in the way that bind handles out-of-    bailiwick data accompanying a secure response without re-fetching    from the original source, which could allow remote attackers to    have an unspecified impact via a crafted response.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2010-0382 to this issue.

   NOTE: ESX does not use the BIND name service daemon by default.

f. Service Console package gcc updated to 3.2.3-60

   The GNU Compiler Collection includes front ends for C, C++,    Objective-C, Fortran, Java, and Ada, as well as libraries for these    languages

   GNU Libtool's ltdl.c attempts to open .la library files in the    current working directory.  This could allow a local user to gain    privileges via a Trojan horse file.  The GNU C Compiler collection    (gcc) provided in ESX contains a statically linked version of the    vulnerable code, and is being replaced.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-3736 to this issue.

g. Service Console package gzip update to 1.3.3-15.rhel3

   gzip is a software application used for file compression

   An integer underflow in gzip's unlzw function on 64-bit platforms    may allow a remote attacker to trigger an array index error    leading to a denial of service (application crash) or possibly    execute arbitrary code via a crafted LZW compressed file.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2010-0001 to this issue.

h. Service Console package sudo updated to 1.6.9p17-6.el5_4

   Sudo (su 'do') allows a system administrator to delegate authority    to give certain users (or groups of users) the ability to run some    (or all) commands as root or another user while providing an audit    trail of the commands and their arguments.

   When a pseudo-command is enabled, sudo permits a match between the    name of the pseudo-command and the name of an executable file in an    arbitrary directory, which allows local users to gain privileges    via a crafted executable file.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2010-0426 to this issue.

   When the runas_default option is used, sudo does not properly set    group memberships, which allows local users to gain privileges via    a sudo command.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2010-0427 to this issue.

The minix filesystem did not properly validate certain filesystem values. If a local attacker could trick the system into attempting to mount a corrupted minix filesystem, the kernel could be made to hang for long periods of time, resulting in a denial of service.
(CVE-2006-6058)

Certain calculations in the hugetlb code were not correct. A local attacker could exploit this to cause a kernel panic, leading to a denial of service. (CVE-2007-4133)

Eric Sesterhenn and Victor Julien discovered that the hop-by-hop IPv6 extended header was not correctly validated. If a system was configured for IPv6, a remote attacker could send a specially crafted IPv6 packet and cause the kernel to panic, leading to a denial of service. This was only vulnerable in Ubuntu 7.04. (CVE-2007-4567)

Permissions were not correctly stored on JFFS2 ACLs. For systems using ACLs on JFFS2, a local attacker may gain access to private files.
(CVE-2007-4849)

Chris Evans discovered that the 802.11 network stack did not correctly handle certain QOS frames. A remote attacker on the local wireless network could send specially crafted packets that would panic the kernel, resulting in a denial of service. (CVE-2007-4997)

The Philips USB Webcam driver did not correctly handle disconnects. If a local attacker tricked another user into disconnecting a webcam unsafely, the kernel could hang or consume CPU resources, leading to a denial of service. (CVE-2007-5093)

Scott James Remnant discovered that the waitid function could be made to hang the system. A local attacker could execute a specially crafted program which would leave the system unresponsive, resulting in a denial of service. (CVE-2007-5500)

Ilpo Jarvinen discovered that it might be possible for the TCP stack to panic the kernel when receiving a crafted ACK response. Only Ubuntu 7.10 contained the vulnerable code, and it is believed not to have been exploitable. (CVE-2007-5501)

When mounting the same remote NFS share to separate local locations, the first location's mount options would apply to all subsequent mounts of the same NFS share. In some configurations, this could lead to incorrectly configured permissions, allowing local users to gain additional access to the mounted share.
(https://launchpad.net/bugs/164231)

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated kernel packages that fix multiple security issues and two bugs are now available for Red Hat Enterprise Linux 5.3 Extended Update Support.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* a flaw was found in the IPv6 Extension Header (EH) handling implementation in the Linux kernel. The skb->dst data structure was not properly validated in the ipv6_hop_jumbo() function. This could possibly lead to a remote denial of service. (CVE-2007-4567, Important)

* a flaw was found in each of the following Intel PRO/1000 Linux drivers in the Linux kernel: e1000 and e1000e. A remote attacker using packets larger than the MTU could bypass the existing fragment check, resulting in partial, invalid frames being passed to the network stack. These flaws could also possibly be used to trigger a remote denial of service. (CVE-2009-4536, CVE-2009-4538, Important)

* a flaw was found in the Realtek r8169 Ethernet driver in the Linux kernel. Receiving overly-long frames with a certain revision of the network cards supported by this driver could possibly result in a remote denial of service. (CVE-2009-4537, Important)

This update also fixes the following bugs :

* on certain hardware, the igb driver was unable to detect link statuses correctly for Serializer-Deserializer (SERDES) interface Ethernet ports. This may have caused problems for network interface bonding, such as failover not occurring. (BZ#548023)

* in certain situations, kdump occasionally dumped a vmcore file with no registers on Intel Itanium systems that were under high disk I/O load. In these cases, this prevented the kernel stack backtrace in the vmcore from being viewed with the crash utility. (BZ#542581)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0019 advisory.

    [2.6.18-164.10.1.0.1.el5]
    - [xen] check to see if hypervisor supports memory reservation change       (Chuck Anderson) [orabug 7556514]
    - Add entropy support to igb ( John Sobecki) [orabug 7607479]
    - [nfs] convert ENETUNREACH to ENOTCONN  [orabug 7689332]
    - [NET] Add xen pv/bonding  netconsole support (Tina yang) [orabug 6993043]       [bz 7258]
    - [MM] shrink zone patch (John Sobecki,Chris Mason) [orabug 6086839]
    - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042]
    - [nfsd] fix failure of file creation from hpux client (Wen gang Wang)       [orabug 7579314]
    - FP register state is corrupted during the handling a SIGSEGV (Chuck Anderson)       [orabug 7708133]

    [2.6.18-164.10.1.el5]
    - [net] e1000, r9169: fix rx length check errors (Cong Wang ) [550914 550915]
    - [net] e1000e: fix rx length check errors (Amerigo Wang ) [551222 551223]
    - [net] ipv6: fix ipv6_hop_jumbo remote system crash (Amerigo Wang ) [548642 548643] {CVE-2007-4567}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2010-141:01 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system.  The     kernel handles the basic functions of the operating system:  memory allocation, process allocation, device     input and output, etc.
    Security bugs fixed with this release:
    CVE-2009-3612     The tcf_fill_node function in net/sched/cls_api.c in the netlink subsystem in the Linux kernel 2.6.x     before 2.6.32-rc5, and 2.4.37.6 and earlier, does not initialize a certain tcm__pad2 structure member,     which might allow local users to obtain sensitive information from kernel memory via unspecified vectors.
    NOTE: this issue exists because of an incomplete fix for CVE-2005-4881.
    CVE-2009-3620     The ATI Rage 128 (aka r128) driver in the Linux kernel before 2.6.31-git11 does not properly verify     Concurrent Command Engine (CCE) state initialization, which allows local users to cause a denial of     service (NULL pointer dereference and system crash) or possibly gain privileges via unspecified ioctl     calls.
    CVE-2009-3621     net/unix/af_unix.c in the Linux kernel 2.6.31.4 and earlier allows local users to cause a denial of     service (system hang) by creating an abstract-namespace AF_UNIX listening socket, performing a shutdown     operation on this socket, and then performing a series of connect operations to this socket.
    CVE-2009-3726     The nfs4_proc_lock function in fs/nfs/nfs4proc.c in the NFSv4 client in the Linux kernel before 2.6.31-rc4     allows remote NFS servers to cause a denial of service (NULL pointer dereference and panic) by sending a     certain response containing incorrect file attributes, which trigger attempted use of an open file that     lacks NFSv4 state.
    CVE-2007-4567     Linux kernel 2.6.22 and earlier, and possibly other versions, does not properly validate the hop-by-hop     IPv6 extended header, which allows remote attackers to cause a denial of service (kernel panic) via a     crafted IPv6 packet.
    CVE-2009-4536     drivers/net/e1000/e1000_main.c in the e1000 driver in the Linux kernel 2.6.32.3 and earlier handles     Ethernet frames that exceed the MTU by processing certain trailing payload data as if it were a complete     frame, which allows remote attackers to bypass packet filters via a large packet with a crafted payload.
    NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-1385.
    CVE-2009-4537     drivers/net/r8169.c in the r8169 driver in the Linux kernel 2.6.32.3 and earlier does not properly check     the size of an Ethernet frame that exceeds the MTU, which allows remote attackers to (1) cause a denial of     service (temporary network outage) via a packet with a crafted size, in conjunction with certain packets     containing A characters and certain packets containing E characters; or (2) cause a denial of service     (system crash) via a packet with a crafted size, in conjunction with certain packets containing '0'     characters, related to the value of the status register and erroneous behavior associated with the     RxMaxSize register. NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-1389.
    CVE-2009-4538     drivers/net/e1000e/netdev.c in the e1000e driver in the Linux kernel 2.6.32.3 and earlier does not     properly check the size of an Ethernet frame that exceeds the MTU, which allows remote attackers to have     an unspecified impact via crafted packets, a related issue to CVE-2009-4537.
    CVE-2009-4036     No description available at the time of writing.
    CVE-2009-2910     arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.31.4 on the x86_64 platform does not clear     certain kernel registers before a return to user mode, which allows local users to read register values     from an earlier process by switching an ia32 process to 64-bit mode.
    CVE-2009-3080     Array index error in the gdth_read_event function in drivers/scsi/gdth.c in the Linux kernel before     2.6.32-rc8 allows local users to cause a denial of service or possibly gain privileges via a negative     event index in an IOCTL request.
    CVE-2009-3556     A certain Red Hat configuration step for the qla2xxx driver in the Linux kernel 2.6.18 on Red Hat     Enterprise Linux (RHEL) 5, when N_Port ID Virtualization (NPIV) hardware is used, sets world-writable     permissions for the (1) vport_create and (2) vport_delete files under /sys/class/scsi_host/, which allows     local users to make arbitrary changes to SCSI host attributes by modifying these files.
    CVE-2009-3889     The dbg_lvl file for the megaraid_sas driver in the Linux kernel before 2.6.27 has world-writable     permissions, which allows local users to change the (1) behavior and (2) logging level of the driver by     modifying this file.
    CVE-2009-3939     The poll_mode_io file for the megaraid_sas driver in the Linux kernel 2.6.31.6 and earlier has world-     writable permissions, which allows local users to change the I/O mode of the driver by modifying this     file.
    CVE-2009-4020     Stack-based buffer overflow in the hfs subsystem in the Linux kernel 2.6.32 allows remote attackers to     have an unspecified impact via a crafted Hierarchical File System (HFS) filesystem, related to the     hfs_readdir function in fs/hfs/dir.c.
    CVE-2009-4021     The fuse_direct_io function in fs/fuse/file.c in the fuse subsystem in the Linux kernel before 2.6.32-rc7     might allow attackers to cause a denial of service (invalid pointer dereference and OOPS) via vectors     possibly related to a memory-consumption attack.
    CVE-2009-4138     drivers/firewire/ohci.c in the Linux kernel before 2.6.32-git9, when packet-per-buffer mode is used,     allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly     have unknown other impact via an unspecified ioctl associated with receiving an ISO packet that contains     zero in the payload-length field.
    CVE-2009-4141     Use-after-free vulnerability in the fasync_helper function in fs/fcntl.c in the Linux kernel before     2.6.33-rc4-git1 allows local users to gain privileges via vectors that include enabling O_ASYNC (aka     FASYNC or FIOASYNC) on a locked file, and then closing this file.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

CVE-2007-4567 kernel: ipv6_hop_jumbo remote system crash

CVE-2009-4537 kernel: r8169 issue reported at 26c3

CVE-2009-4538 kernel: e1000e frame fragment issue

CVE-2009-4536 kernel: e1000 issue reported at 26c3

This update fixes the following security issues :

  - a flaw was found in the IPv6 Extension Header (EH)     handling implementation in the Linux kernel. The     skb->dst data structure was not properly validated in     the ipv6_hop_jumbo() function. This could possibly lead     to a remote denial of service. (CVE-2007-4567,     Important)

  - a flaw was found in each of the following Intel PRO/1000     Linux drivers in the Linux kernel: e1000 and e1000e. A     remote attacker using packets larger than the MTU could     bypass the existing fragment check, resulting in     partial, invalid frames being passed to the network     stack. These flaws could also possibly be used to     trigger a remote denial of service. (CVE-2009-4536,     CVE-2009-4538, Important)

  - a flaw was found in the Realtek r8169 Ethernet driver in     the Linux kernel. Receiving overly-long frames with     network cards supported by this driver could possibly     result in a remote denial of service. (CVE-2009-4537,     Important)

The system must be rebooted for this update to take effect.

Note1: Due to the fuse kernel module now being part of the kernel, we are updating fuse on the older releases to match the fuse that was released by The Upstream Vendor.

Note2: xfs is now part of the kernel in x86_64. Because of this there is no kernel-module-xfs for x86_64.

Note3: ipw3945 support has been changed to iwlwifi3945 in SL 54, and is in the kernel. Because of this there is no kernel-module-ipw3945 for SL54.

Note4: Support for the Atheros chipset in now in the kernel. We are not sure if the infrastructure is in place for SL 50-53, so we are still providing the madwifi kernel modules for SL 50-53.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several components and third-party libraries :

  - libpng
  - VMnc Codec
  - vmrun
  - VMware Remote Console (VMrc)
  - VMware Tools
  - vmware-authd

ID	Name	Product	Family	Published	Updated	Severity
43832	CentOS 5 : kernel (CESA-2010:0019)	Nessus	CentOS Local Security Checks	1/10/2010	1/4/2021	critical
63915	RHEL 5 : kernel (RHSA-2010:0079)	Nessus	Red Hat Local Security Checks	1/24/2013	1/14/2021	critical
30183	Ubuntu 6.10 / 7.04 / 7.10 : linux-source-2.6.17/20/22 vulnerabilities (USN-574-1)	Nessus	Ubuntu Local Security Checks	2/5/2008	1/19/2021	high
79507	OracleVM 2.2 : kernel (OVMSA-2013-0039)	Nessus	OracleVM Local Security Checks	11/26/2014	1/4/2021	high
46765	VMSA-2010-0009 : ESXi ntp and ESX Service Console third-party updates	Nessus	VMware ESX Local Security Checks	6/1/2010	1/6/2021	high
29740	Ubuntu 6.10 / 7.04 / 7.10 : linux-source-2.6.17/20/22 vulnerabilities (USN-558-1)	Nessus	Ubuntu Local Security Checks	12/19/2007	1/19/2021	high
43820	RHEL 5 : kernel (RHSA-2010:0019)	Nessus	Red Hat Local Security Checks	1/8/2010	1/14/2021	critical
63913	RHEL 5 : kernel (RHSA-2010:0053)	Nessus	Red Hat Local Security Checks	1/24/2013	1/14/2021	critical
67982	Oracle Linux 5 : kernel (ELSA-2010-0019)	Nessus	Oracle Linux Local Security Checks	7/12/2013	2/9/2026	high
284091	MiracleLinux 3 : kernel-2.6.18-128.14.AXS3 (AXSA:2010-141:01)	Nessus	Miracle Linux Local Security Checks	1/14/2026	2/12/2026	high
60717	Scientific Linux Security Update : kernel on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	critical
89740	VMware ESX / ESXi Third-Party Libraries and Components (VMSA-2010-0009) (remote check)	Nessus	VMware ESX Local Security Checks	3/8/2016	1/6/2021	critical

Detections

Analytics

Plugins Search

critical

critical

high

high

high

high

critical

critical

high

high

critical

critical