This patch updates the SUSE Linux Enterprise 10 SP1 kernel. It fixes various bugs and security issues.

The following security issues are addressed :

  - fs/open.c in the Linux kernel before 2.6.22 does not     properly strip setuid and setgid bits when there is a     write to a file, which allows local users to gain the     privileges of a different group, and obtain sensitive     information or possibly have unspecified other impact,     by creating an executable file in a setgid directory     through the (1) truncate or (2) ftruncate function in     conjunction with memory-mapped I/O. (CVE-2008-4210)

  - The ext[234] filesystem code fails to properly handle     corrupted data structures. With a mounted filesystem     image or partition that have corrupted dir->i_size and     dir->i_blocks, a user performing either a read or write     operation on the mounted image or partition can lead to     a possible denial of service by spamming the logfile.
    (CVE-2008-3528)

  - fs/direct-io.c in the dio subsystem in the Linux kernel     did not properly zero out the dio struct, which allows     local users to cause a denial of service (OOPS), as     demonstrated by a certain fio test. (CVE-2007-6716)

All other bugfixes can be found by looking at the RPM changelog.

a. Service Console update for DHCP and third-party library update    for DHCP client.

   DHCP is an Internet-standard protocol by which a computer can be    connected to a local network, ask to be given configuration    information, and receive from a server enough information to    configure itself as a member of that network.

   A stack-based buffer overflow in the script_write_params method in    ISC DHCP dhclient allows remote DHCP servers to execute arbitrary    code via a crafted subnet-mask option.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-0692 to this issue.

   An insecure temporary file use flaw was discovered in the DHCP    daemon's init script ('/etc/init.d/dhcpd'). A local attacker could    use this flaw to overwrite an arbitrary file with the output of the    'dhcpd -t' command via a symbolic link attack, if a system    administrator executed the DHCP init script with the 'configtest',    'restart', or 'reload' option.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-1893 to this issue.

b. Updated Service Console package kernel

   Service Console package kernel update to version    kernel-2.4.21-58.EL.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-4210, CVE-2008-3275, CVE-2008-0598,    CVE-2008-2136, CVE-2008-2812, CVE-2007-6063, CVE-2008-3525 to the    security issues fixed in kernel-2.4.21-58.EL

c. JRE Security Update

   JRE update to version 1.5.0_18, which addresses multiple security    issues that existed in earlier releases of JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the following names to the security issues fixed in    JRE 1.5.0_17: CVE-2008-2086, CVE-2008-5347, CVE-2008-5348,    CVE-2008-5349, CVE-2008-5350, CVE-2008-5351, CVE-2008-5352,    CVE-2008-5353, CVE-2008-5354, CVE-2008-5356, CVE-2008-5357,    CVE-2008-5358, CVE-2008-5359, CVE-2008-5360, CVE-2008-5339,    CVE-2008-5342, CVE-2008-5344, CVE-2008-5345, CVE-2008-5346,    CVE-2008-5340, CVE-2008-5341, CVE-2008-5343, and CVE-2008-5355.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the following names to the security issues fixed in    JRE 1.5.0_18: CVE-2009-1093, CVE-2009-1094, CVE-2009-1095,    CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1099,    CVE-2009-1100, CVE-2009-1101, CVE-2009-1102, CVE-2009-1103,    CVE-2009-1104, CVE-2009-1105, CVE-2009-1106, and CVE-2009-1107.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-6716     Joe Jin reported a local denial of service vulnerability     that allows system users to trigger an oops due to an     improperly initialized data structure.

  - CVE-2008-1514     Jan Kratochvil reported a local denial of service     vulnerability in the ptrace interface for the s390     architecture. Local users can trigger an invalid pointer     dereference, leading to a system panic.

  - CVE-2008-3276     Eugene Teo reported an integer overflow in the DCCP     subsystem that may allow remote attackers to cause a     denial of service in the form of a kernel panic.

  - CVE-2008-3525     Eugene Teo reported a lack of capability checks in the     kernel driver for Granch SBNI12 leased line adapters     (sbni), allowing local users to perform privileged     operations.

  - CVE-2008-3833     The S_ISUID/S_ISGID bits were not being cleared during     an inode splice, which, under certain conditions, can be     exploited by local users to obtain the privileges of a     group for which they are not a member. Mark Fasheh     reported this issue.

  - CVE-2008-4210     David Watson reported an issue in the open()/creat()     system calls which, under certain conditions, can be     exploited by local users to obtain the privileges of a     group for which they are not a member.

  - CVE-2008-4302     A coding error in the splice subsystem allows local     users to attempt to unlock a page structure that has not     been locked, resulting in a system crash.

Updated kernel packages that fix a number of security issues are now available for Red Hat Enterprise Linux 2.1 running on 32-bit architectures.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

These updated packages fix the following security issues :

* a flaw was found in the IPv4 forwarding base. This could allow a local, unprivileged user to cause a denial of service. (CVE-2007-2172, Important)

* a flaw was found in the handling of process death signals. This allowed a local, unprivileged user to send arbitrary signals to the suid-process executed by that user. Successful exploitation of this flaw depends on the structure of the suid-program and its signal handling. (CVE-2007-3848, Important)

* when accessing kernel memory locations, certain Linux kernel drivers registering a fault handler did not perform required range checks. A local, unprivileged user could use this flaw to gain read or write access to arbitrary kernel memory, or possibly cause a denial of service. (CVE-2008-0007, Important)

* a possible kernel memory leak was found in the Linux kernel Simple Internet Transition (SIT) INET6 implementation. This could allow a local, unprivileged user to cause a denial of service. (CVE-2008-2136, Important)

* missing capability checks were found in the SBNI WAN driver which could allow a local, unprivileged user to bypass intended capability restrictions. (CVE-2008-3525, Important)

* a flaw was found in the way files were written using truncate() or ftruncate(). This could allow a local, unprivileged user to acquire the privileges of a different group and obtain access to sensitive information. (CVE-2008-4210, Important)

* a race condition in the mincore system core allowed a local, unprivileged user to cause a denial of service. (CVE-2006-4814, Moderate)

* a flaw was found in the aacraid SCSI driver. This allowed a local, unprivileged user to make ioctl calls to the driver which should otherwise be restricted to privileged users. (CVE-2007-4308, Moderate)

* two buffer overflow flaws were found in the Integrated Services Digital Network (ISDN) subsystem. A local, unprivileged user could use these flaws to cause a denial of service. (CVE-2007-6063, CVE-2007-6151, Moderate)

* a flaw was found in the way core dump files were created. If a local, unprivileged user could make a root-owned process dump a core file into a user-writable directory, the user could gain read access to that core file, potentially compromising sensitive information.
(CVE-2007-6206, Moderate)

* a deficiency was found in the Linux kernel virtual file system (VFS) implementation. This could allow a local, unprivileged user to attempt file creation within deleted directories, possibly causing a denial of service. (CVE-2008-3275, Moderate)

All users of Red Hat Enterprise Linux 2.1 on 32-bit architectures should upgrade to these updated packages which address these vulnerabilities. For this update to take effect, the system must be rebooted.

Updated kernel packages that resolve several security issues and fix various bugs are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* a flaw was found in the Linux kernel's Direct-IO implementation.
This could have allowed a local unprivileged user to cause a denial of service. (CVE-2007-6716, Important)

* when running ptrace in 31-bit mode on an IBM S/390 or IBM System z kernel, a local unprivileged user could cause a denial of service by reading from or writing into a padding area in the user_regs_struct32 structure. (CVE-2008-1514, Important)

* the do_truncate() and generic_file_splice_write() functions did not clear the setuid and setgid bits. This could have allowed a local unprivileged user to obtain access to privileged information.
(CVE-2008-4210, Important)

* Tobias Klein reported a missing check in the Linux kernel's Open Sound System (OSS) implementation. This deficiency could have led to an information leak. (CVE-2008-3272, Moderate)

* a potential denial of service attack was discovered in the Linux kernel's PWC USB video driver. A local unprivileged user could have used this flaw to bring the kernel USB subsystem into the busy-waiting state. (CVE-2007-5093, Low)

* the ext2 and ext3 file systems code failed to properly handle corrupted data structures, leading to a possible local denial of service issue when read or write operations were performed.
(CVE-2008-3528, Low)

In addition, these updated packages fix the following bugs :

* when using the CIFS 'forcedirectio' option, appending to an open file on a CIFS share resulted in that file being overwritten with the data to be appended.

* a kernel panic occurred when a device with PCI ID 8086:10c8 was present on a system with a loaded ixgbe driver.

* due to an aacraid driver regression, the kernel failed to boot when trying to load the aacraid driver and printed the following error message: 'aac_srb: aac_fib_send failed with status: 8195'.

* due to an mpt driver regression, when RAID 1 was configured on Primergy systems with an LSI SCSI IME 53C1020/1030 controller, the kernel panicked during boot.

* the mpt driver produced a large number of extraneous debugging messages when performing a 'Host reset' operation.

* due to a regression in the sym driver, the kernel panicked when a SCSI hot swap was performed using MCP18 hardware.

* all cores on a multi-core system now scale their frequencies in accordance with the policy set by the system's CPU frequency governor.

* the netdump subsystem suffered from several stability issues. These are addressed in this updated kernel.

* under certain conditions, the ext3 file system reported a negative count of used blocks.

* reading /proc/self/mem incorrectly returned 'Invalid argument' instead of 'input/output error' due to a regression.

* under certain conditions, the kernel panicked when a USB device was removed while the system was busy accessing the device.

* a race condition in the kernel could have led to a kernel crash during the creation of a new process.

All Red Hat Enterprise Linux 4 Users should upgrade to these updated packages, which contain backported patches to correct these issues.

It was discovered that the Xen hypervisor block driver did not correctly validate requests. A user with root privileges in a guest OS could make a malicious IO request with a large number of blocks that would crash the host OS, leading to a denial of service. This only affected Ubuntu 7.10. (CVE-2007-5498)

It was discovered the the i915 video driver did not correctly validate memory addresses. A local attacker could exploit this to remap memory that could cause a system crash, leading to a denial of service. This issue did not affect Ubuntu 6.06 and was previous fixed for Ubuntu 7.10 and 8.04 in USN-659-1. Ubuntu 8.10 has now been corrected as well. (CVE-2008-3831)

David Watson discovered that the kernel did not correctly strip permissions when creating files in setgid directories. A local user could exploit this to gain additional group privileges. This issue only affected Ubuntu 6.06. (CVE-2008-4210)

Olaf Kirch and Miklos Szeredi discovered that the Linux kernel did not correctly reject the 'append' flag when handling file splice requests.
A local attacker could bypass append mode and make changes to arbitrary locations in a file. This issue only affected Ubuntu 7.10 and 8.04. (CVE-2008-4554)

It was discovered that the SCTP stack did not correctly handle INIT-ACK. A remote user could exploit this by sending specially crafted SCTP traffic which would trigger a crash in the system, leading to a denial of service. This issue did not affect Ubuntu 8.10.
(CVE-2008-4576)

It was discovered that the SCTP stack did not correctly handle bad packet lengths. A remote user could exploit this by sending specially crafted SCTP traffic which would trigger a crash in the system, leading to a denial of service. This issue did not affect Ubuntu 8.10.
(CVE-2008-4618)

Eric Sesterhenn discovered multiple flaws in the HFS+ filesystem. If a local user or automated system were tricked into mounting a malicious HFS+ filesystem, the system could crash, leading to a denial of service. (CVE-2008-4933, CVE-2008-4934, CVE-2008-5025)

It was discovered that the Unix Socket handler did not correctly process the SCM_RIGHTS message. A local attacker could make a malicious socket request that would crash the system, leading to a denial of service. (CVE-2008-5029)

It was discovered that the driver for simple i2c audio interfaces did not correctly validate certain function pointers. A local user could exploit this to gain root privileges or crash the system, leading to a denial of service. (CVE-2008-5033).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- the Xen implementation did not prevent applications     running in a para-virtualized guest from modifying CR4     TSC. This could cause a local denial of service.
    (CVE-2007-5907, Important)

  - Tavis Ormandy reported missing boundary checks in the     Virtual Dynamic Shared Objects (vDSO) implementation.
    This could allow a local unprivileged user to cause a     denial of service or escalate privileges.
    (CVE-2008-3527, Important)

  - the do_truncate() and generic_file_splice_write()     functions did not clear the setuid and setgid bits. This     could allow a local unprivileged user to obtain access     to privileged information. (CVE-2008-4210,     CVE-2008-3833, Important)

  - a flaw was found in the Linux kernel splice     implementation. This could cause a local denial of     service when there is a certain failure in the     add_to_page_cache_lru() function. (CVE-2008-4302,     Important)

  - a flaw was found in the Linux kernel when running on     AMD64 systems. During a context switch, EFLAGS were     being neither saved nor restored. This could allow a     local unprivileged user to cause a denial of service.
    (CVE-2006-5755, Low)

  - a flaw was found in the Linux kernel virtual memory     implementation. This could allow a local unprivileged     user to cause a denial of service. (CVE-2008-2372, Low)

  - an integer overflow was discovered in the Linux kernel     Datagram Congestion Control Protocol (DCCP)     implementation. This could allow a remote attacker to     cause a denial of service. By default, remote DCCP is     blocked by SELinux. (CVE-2008-3276, Low)

In addition, these updated packages fix the following bugs :

  - random32() seeding has been improved.

  - in a multi-core environment, a race between the QP async     event-handler and the destro_qp() function could occur.
    This led to unpredictable results during invalid memory     access, which could lead to a kernel crash.

  - a format string was omitted in the call to the     request_module() function.

  - a stack overflow caused by an infinite recursion bug in     the binfmt_misc kernel module was corrected.

  - the ata_scsi_rbuf_get() and ata_scsi_rbuf_put()     functions now check for scatterlist usage before calling     kmap_atomic().

  - a sentinel NUL byte was added to the device_write()     function to ensure that lspace.name is NUL-terminated.

  - in the character device driver, a range_is_allowed()     check was added to the read_mem() and write_mem()     functions. It was possible for an illegitimate     application to bypass these checks, and access /dev/mem     beyond the 1M limit by calling mmap_mem() instead. Also,     the parameters of range_is_allowed() were changed to     cleanly handle greater than 32-bits of physical address     on 32-bit architectures.

  - some of the newer Nehalem-based systems declare their     CPU DSDT entries as type 'Alias'. During boot, this     caused an 'Error attaching device data' message to be     logged.

  - the evtchn event channel device lacked locks and memory     barriers. This has led to xenstore becoming unresponsive     on the Itanium&reg; architecture.

  - sending of gratuitous ARP packets in the Xen frontend     network driver is now delayed until the backend signals     that its carrier status has been processed by the stack.

  - on forcedeth devices, whenever setting ethtool     parameters for link speed, the device could stop     receiving interrupts.

  - the CIFS 'forcedirectio' option did not allow text to be     appended to files.

  - the gettimeofday() function returned a backwards time on     Intel&reg; 64.

  - residual-count corrections during UNDERRUN handling were     added to the qla2xxx driver.

  - the fix for a small quirk was removed for certain     Adaptec controllers for which it caused problems.

  - the 'xm trigger init' command caused a domain panic if a     userland application was running on a guest on the     Intel&reg; 64 architecture.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
59134	SuSE 10 Security Update : Linux Kernel (x86_64) (ZYPP Patch Number 5735)	Nessus	SuSE Local Security Checks	2012/5/17	2021/1/14	medium
42179	VMSA-2009-0014 : VMware ESX patches for DHCP, Service Console kernel, and JRE resolve multiple security issues	Nessus	VMware ESX Local Security Checks	2009/10/19	2021/1/6	high
34392	Debian DSA-1653-1 : linux-2.6 - denial of service/privilege escalation	Nessus	Debian Local Security Checks	2008/10/14	2021/1/4	high
35323	RHEL 2.1 : kernel (RHSA-2009:0001)	Nessus	Red Hat Local Security Checks	2009/1/9	2021/1/14	high
37341	CentOS 4 : kernel (CESA-2008:0972)	Nessus	CentOS Local Security Checks	2009/4/23	2021/1/4	medium
37683	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : linux, linux-source-2.6.15/22 vulnerabilities (USN-679-1)	Nessus	Ubuntu Local Security Checks	2009/4/23	2021/1/19	high
60488	Scientific Linux Security Update : kernel on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high

检测

插件搜索

medium

high

high

high

medium

high

high