This kernel update for SUSE Linux Enterprise 10 Service Pack 2 fixes various bugs and some security problems :

  - When creating a file, open()/creat() allowed the setgid     bit to be set via the mode argument even when, due to     the bsdgroups mount option or the file being created in     a setgid directory, the new file's group is one which     the user is not a member of. The local attacker could     then use ftruncate() and memory-mapped I/O to turn the     new file into an arbitrary binary and thus gain the     privileges of this group, since these operations do not     clear the setgid bit.'. (CVE-2008-4210)

  - The ext[234] filesystem code fails to properly handle     corrupted data structures. With a mounted filesystem     image or partition that have corrupted dir->i_size and     dir->i_blocks, a user performing either a read or write     operation on the mounted image or partition can lead to     a possible denial of service by spamming the logfile.
    (CVE-2008-3528)

  - The S/390 ptrace code allowed local users to cause a     denial of service (kernel panic) via the     user-area-padding test from the ptrace testsuite in     31-bit mode, which triggers an invalid dereference.
    (CVE-2008-1514)

  - fs/direct-io.c in the dio subsystem in the Linux kernel     did not properly zero out the dio struct, which allows     local users to cause a denial of service (OOPS), as     demonstrated by a certain fio test. (CVE-2007-6716)

  - Added missing capability checks in sbni_ioctl().
    (CVE-2008-3525)

Also OCFS2 was updated to version v1.4.1-1.

The full amount of changes can be reviewed in the RPM changelog.

- a flaw was found in the Linux kernel's Direct-IO     implementation. This could have allowed a local     unprivileged user to cause a denial of service.
    (CVE-2007-6716, Important)

  - when running ptrace in 31-bit mode on an IBM S/390 or     IBM System z kernel, a local unprivileged user could     cause a denial of service by reading from or writing     into a padding area in the user_regs_struct32 structure.
    (CVE-2008-1514, Important)

  - the do_truncate() and generic_file_splice_write()     functions did not clear the setuid and setgid bits. This     could have allowed a local unprivileged user to obtain     access to privileged information. (CVE-2008-4210,     Important)

  - Tobias Klein reported a missing check in the Linux     kernel's Open Sound System (OSS) implementation. This     deficiency could have led to an information leak.
    (CVE-2008-3272, Moderate)

  - a potential denial of service attack was discovered in     the Linux kernel's PWC USB video driver. A local     unprivileged user could have used this flaw to bring the     kernel USB subsystem into the busy-waiting state.
    (CVE-2007-5093, Low)

  - the ext2 and ext3 file systems code failed to properly     handle corrupted data structures, leading to a possible     local denial of service issue when read or write     operations were performed. (CVE-2008-3528, Low)

In addition, these updated packages fix the following bugs :

  - when using the CIFS 'forcedirectio' option, appending to     an open file on a CIFS share resulted in that file being     overwritten with the data to be appended.

  - a kernel panic occurred when a device with PCI ID     8086:10c8 was present on a system with a loaded ixgbe     driver.

  - due to an aacraid driver regression, the kernel failed     to boot when trying to load the aacraid driver and     printed the following error message: 'aac_srb:
    aac_fib_send failed with status: 8195'.

  - due to an mpt driver regression, when RAID 1 was     configured on Primergy systems with an LSI SCSI IME     53C1020/1030 controller, the kernel panicked during     boot.

  - the mpt driver produced a large number of extraneous     debugging messages when performing a 'Host reset'     operation.

  - due to a regression in the sym driver, the kernel     panicked when a SCSI hot swap was performed using MCP18     hardware.

  - all cores on a multi-core system now scale their     frequencies in accordance with the policy set by the     system's CPU frequency governor.

  - the netdump subsystem suffered from several stability     issues. These are addressed in this updated kernel.

  - under certain conditions, the ext3 file system reported     a negative count of used blocks.

  - reading /proc/self/mem incorrectly returned 'Invalid     argument' instead of 'input/output error' due to a     regression.

  - under certain conditions, the kernel panicked when a USB     device was removed while the system was busy accessing     the device.

  - a race condition in the kernel could have led to a     kernel crash during the creation of a new process.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2008-531:11 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system.  The     kernel handles the basic functions of the operating system:  memory allocation, process allocation, device     input and output, etc.
    Fixed bugs     CVE-2008-2372     The Linux kernel 2.6.24 and 2.6.25 before 2.6.25.9 allows local users to cause a denial of service (memory     consumption) via a large number of calls to the get_user_pages function, which lacks a ZERO_PAGE     optimization and results in allocation of useless newly zeroed pages.
    CVE-2008-3276     Integer overflow in the dccp_setsockopt_change function in net/dccp/proto.c in the Datagram Congestion     Control Protocol (DCCP) subsystem in the Linux kernel 2.6.17-rc1 through 2.6.26.2 allows remote attackers     to cause a denial of service (panic) via a crafted integer value, related to Change L and Change R options     without at least one byte in the dccpsf_val field.
    CVE-2008-3527     arch/i386/kernel/sysenter.c in the Virtual Dynamic Shared Objects (vDSO) implementation in the Linux     kernel before 2.6.21 does not properly check boundaries, which allows local users to gain privileges or     cause a denial of service via unspecified vectors, related to the install_special_mapping, syscall, and     syscall32_nopage functions.
    CVE-2008-3833     The generic_file_splice_write function in fs/splice.c in the Linux kernel before 2.6.19 does not properly     strip setuid and setgid bits when there is a write to a file, which allows local users to gain the     privileges of a different group, and obtain sensitive information or possibly have unspecified other     impact, by splicing into an inode in order to create an executable file in a setgid directory, a different     vulnerability than CVE-2008-4210.
    CVE-2008-4210     fs/open.c in the Linux kernel before 2.6.22 does not properly strip setuid and setgid bits when there is a     write to a file, which allows local users to gain the privileges of a different group, and obtain     sensitive information or possibly have unspecified other impact, by creating an executable file in a     setgid directory through the (1) truncate or (2) ftruncate function in conjunction with memory-mapped I/O.
    CVE-2008-4302     fs/splice.c in the splice subsystem in the Linux kernel before 2.6.22.2 does not properly handle a failure     of the add_to_page_cache_lru function, and subsequently attempts to unlock a page that was not locked,     which allows local users to cause a denial of service (kernel BUG and system crash), as demonstrated by     the fio I/O tool.
    Bug fixed:
     - process's coredump did not include POSIX shared memory in AXS3
     - added MTD map driver for ATCA-7221 (blade-type single board computer by Motorola for telecom     equipment).

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This patch updates the SUSE Linux Enterprise 10 SP1 kernel. It fixes various bugs and security issues.

The following security issues are addressed :

  - fs/open.c in the Linux kernel before 2.6.22 does not     properly strip setuid and setgid bits when there is a     write to a file, which allows local users to gain the     privileges of a different group, and obtain sensitive     information or possibly have unspecified other impact,     by creating an executable file in a setgid directory     through the (1) truncate or (2) ftruncate function in     conjunction with memory-mapped I/O. (CVE-2008-4210)

  - The ext[234] filesystem code fails to properly handle     corrupted data structures. With a mounted filesystem     image or partition that have corrupted dir->i_size and     dir->i_blocks, a user performing either a read or write     operation on the mounted image or partition can lead to     a possible denial of service by spamming the logfile.
    (CVE-2008-3528)

  - fs/direct-io.c in the dio subsystem in the Linux kernel     did not properly zero out the dio struct, which allows     local users to cause a denial of service (OOPS), as     demonstrated by a certain fio test. (CVE-2007-6716)

All other bugfixes can be found by looking at the RPM changelog.

a. Service Console update for DHCP and third-party library update    for DHCP client.

   DHCP is an Internet-standard protocol by which a computer can be    connected to a local network, ask to be given configuration    information, and receive from a server enough information to    configure itself as a member of that network.

   A stack-based buffer overflow in the script_write_params method in    ISC DHCP dhclient allows remote DHCP servers to execute arbitrary    code via a crafted subnet-mask option.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-0692 to this issue.

   An insecure temporary file use flaw was discovered in the DHCP    daemon's init script ('/etc/init.d/dhcpd'). A local attacker could    use this flaw to overwrite an arbitrary file with the output of the    'dhcpd -t' command via a symbolic link attack, if a system    administrator executed the DHCP init script with the 'configtest',    'restart', or 'reload' option.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-1893 to this issue.

b. Updated Service Console package kernel

   Service Console package kernel update to version    kernel-2.4.21-58.EL.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-4210, CVE-2008-3275, CVE-2008-0598,    CVE-2008-2136, CVE-2008-2812, CVE-2007-6063, CVE-2008-3525 to the    security issues fixed in kernel-2.4.21-58.EL

c. JRE Security Update

   JRE update to version 1.5.0_18, which addresses multiple security    issues that existed in earlier releases of JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the following names to the security issues fixed in    JRE 1.5.0_17: CVE-2008-2086, CVE-2008-5347, CVE-2008-5348,    CVE-2008-5349, CVE-2008-5350, CVE-2008-5351, CVE-2008-5352,    CVE-2008-5353, CVE-2008-5354, CVE-2008-5356, CVE-2008-5357,    CVE-2008-5358, CVE-2008-5359, CVE-2008-5360, CVE-2008-5339,    CVE-2008-5342, CVE-2008-5344, CVE-2008-5345, CVE-2008-5346,    CVE-2008-5340, CVE-2008-5341, CVE-2008-5343, and CVE-2008-5355.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the following names to the security issues fixed in    JRE 1.5.0_18: CVE-2009-1093, CVE-2009-1094, CVE-2009-1095,    CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1099,    CVE-2009-1100, CVE-2009-1101, CVE-2009-1102, CVE-2009-1103,    CVE-2009-1104, CVE-2009-1105, CVE-2009-1106, and CVE-2009-1107.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
41535	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 5668)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	high
60497	Scientific Linux Security Update : kernel on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
284413	MiracleLinux 3 : kernel-2.6.18-53.16AXS3 (AXSA:2008-531:11)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/2/12	medium
35026	SuSE 10 Security Update : Linux Kernel (x86) (ZYPP Patch Number 5734)	Nessus	SuSE Local Security Checks	2008/12/3	2021/1/14	medium
59132	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 5667)	Nessus	SuSE Local Security Checks	2012/5/17	2021/1/14	high
59134	SuSE 10 Security Update : Linux Kernel (x86_64) (ZYPP Patch Number 5735)	Nessus	SuSE Local Security Checks	2012/5/17	2021/1/14	medium
42179	VMSA-2009-0014 : VMware ESX patches for DHCP, Service Console kernel, and JRE resolve multiple security issues	Nessus	VMware ESX Local Security Checks	2009/10/19	2021/1/6	high

检测

插件搜索

high

medium

medium

medium

high

medium

high