Security fixes :

  - Kernel update 2.6.9-89.EL introduced a flaw in the     ptrace implementation on Itanium systems.
    ptrace_check_attach() was not called during certain     ptrace() requests. Under certain circumstances, a local,     unprivileged user could use this flaw to call ptrace()     on a process they do not own, giving them control over     that process. (CVE-2010-0729, Important)

  - a flaw was found in the kernel's Unidirectional     Lightweight Encapsulation (ULE) implementation. A remote     attacker could send a specially crafted ISO MPEG-2     Transport Stream (TS) frame to a target system,     resulting in a denial of service. (CVE-2010-1086,     Important)

  - a use-after-free flaw was found in     tcp_rcv_state_process() in the kernel's TCP/IP protocol     suite implementation. If a system using IPv6 had the     IPV6_RECVPKTINFO option set on a listening socket, a     remote attacker could send an IPv6 packet to that     system, causing a kernel panic. (CVE-2010-1188,     Important)

  - a divide-by-zero flaw was found in azx_position_ok() in     the Intel High Definition Audio driver, snd-hda-intel. A     local, unprivileged user could trigger this flaw to     cause a denial of service. (CVE-2010-1085, Moderate)

  - an information leak flaw was found in the kernel's USB     implementation. Certain USB errors could result in an     uninitialized kernel buffer being sent to user-space. An     attacker with physical access to a target system could     use this flaw to cause an information leak.
    (CVE-2010-1083, Low)

Bug fixes :

  - a regression prevented the Broadcom BCM5761 network     device from working when in the first (top) PCI-E slot     of Hewlett-Packard (HP) Z600 systems. Note: The card     worked in the 2nd or 3rd PCI-E slot. (BZ#567205)

  - the Xen hypervisor supports 168 GB of RAM for 32-bit     guests. The physical address range was set incorrectly,     however, causing 32-bit, para-virtualized Scientific     Linux 4.8 guests to crash when launched on AMD64 or     Intel 64 hosts that have more than 64 GB of RAM.
    (BZ#574392)

  - Kernel update 2.6.9-89.EL introduced a regression,     causing diskdump to fail on systems with certain     adapters using the qla2xxx driver. (BZ#577234)

  - a race condition caused TX to stop in a guest using the     virtio_net driver. (BZ#580089)

  - on some systems, using the 'arp_validate=3' bonding     option caused both links to show as 'down' even though     the arp_target was responding to ARP requests sent by     the bonding driver. (BZ#580842)

  - in some circumstances, when a Scientific Linux client     connected to a re-booted Windows-based NFS server,     server-side filehandle-to-inode mapping changes caused a     kernel panic. 'bad_inode_ops' handling was changed to     prevent this. Note: filehandle-to-inode mapping changes     may still cause errors, but not panics. (BZ#582908)

  - when installing a Scientific Linux 4 guest via PXE,     hard-coded fixed-size scatterlists could conflict with     host requests, causing the guest's kernel to panic. With     this update, dynamically allocated scatterlists are     used, resolving this issue. (BZ#582911)

Enhancements :

  - kernel support for connlimit. Note: iptables errata     update RHBA-2010:0395 is also required for connlimit to     work correctly. (BZ#563223)

  - support for the Intel architectural performance     monitoring subsystem (arch_perfmon). On supported CPUs,     arch_perfmon offers means to mark performance events and     options for configuring and counting these events.
    (BZ#582913)

  - kernel support for OProfile sampling of Intel     microarchitecture (Nehalem) CPUs. This update alone does     not address OProfile support for such CPUs. A future     oprofile package update will allow OProfile to work on     Intel Nehalem CPUs. (BZ#582241)

The system must be rebooted for this update to take effect.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in the Linux Kernel in the     do_anonymous_page() function due to improper separation     of the stack and the heap. An attacker can exploit this     to execute arbitrary code. (CVE-2010-2240)

  - A packet filter bypass exists in the Linux Kernel e1000     driver due to processing trailing payload data as a     complete frame. A remote attacker can exploit this to     bypass packet filters via a large packet with a crafted     payload. (CVE-2009-4536)

  - A use-after-free error exists in the Linux Kernel when     IPV6_RECVPKTINFO is set on a listening socket. A remote     attacker can exploit this, via a SYN packet while the     socket is in a listening (TCP_LISTEN) state, to cause a     kernel panic, resulting in a denial of service     condition. (CVE-2010-1188)

  - An array index error exists in the Linux Kernel in the     gdth_read_event() function. A local attacker can exploit     this, via a negative event index in an IOCTL request, to     cause a denial of service condition. (CVE-2009-3080)

  - A race condition exists in the VMware Host Guest File     System (HGFS) that allows guest operating system users     to gain privileges by mounting a filesystem on top of an     arbitrary directory. (CVE-2011-1787)

  - A flaw exists in the VMware Host Guest File System     (HGFS) that allows a Solaris or FreeBSD guest operating     system user to modify arbitrary guest operating system     files. (CVE-2011-2145)

  - A flaw exists in the VMware Host Guest File System     (HGFS) that allows guest operating system users to     disclose host operating system files and directories.
    (CVE-2011-2146)

  - A flaw exists in the bundled Tom Sawyer GET Extension     Factory that allows a remote attacker to cause a denial     of service condition or the execution of arbitrary code     via a crafted HTML document. (CVE-2011-2217)

This update fixes various security issues and some bugs in the SUSE Linux Enterprise 9 kernel.

The following security issues were fixed :

  - A crafted NFS write request might have caused a buffer     overwrite, potentially causing a kernel crash.
    (CVE-2010-2521)

  - The x86_64 copy_to_user implementation might have leaked     kernel memory depending on specific user buffer setups.
    (CVE-2008-0598)

  - drivers/net/r8169.c in the r8169 driver in the Linux     kernel did not properly check the size of an Ethernet     frame that exceeds the MTU, which allows remote     attackers to (1) cause a denial of service (temporary     network outage) via a packet with a crafted size, in     conjunction with certain packets containing A characters     and certain packets containing E characters; or (2)     cause a denial of service (system crash) via a packet     with a crafted size, in conjunction with certain packets     containing '\0' characters, related to the value of the     status register and erroneous behavior associated with     the RxMaxSize register. NOTE: this vulnerability exists     because of an incorrect fix for CVE-2009-1389.
    (CVE-2009-4537)

  - Use-after-free vulnerability in net/ipv4/tcp_input.c in     the Linux kernel 2.6 when IPV6_RECVPKTINFO is set on a     listening socket, allowed remote attackers to cause a     denial of service (kernel panic) via a SYN packet while     the socket is in a listening (TCP_LISTEN) state, which     is not properly handled causes the skb structure to be     freed. (CVE-2010-1188)

  - The (1) real_lookup and (2) __lookup_hash functions in     fs/namei.c in the vfs implementation in the Linux kernel     did not prevent creation of a child dentry for a deleted     (aka S_DEAD) directory, which allowed local users to     cause a denial of service ('overflow' of the UBIFS     orphan area) via a series of attempted file creations     within deleted directories. (CVE-2008-3275)

  - The nfs_lock function in fs/nfs/file.c in the Linux     kernel did not properly remove POSIX locks on files that     are setgid without group-execute permission, which     allows local users to cause a denial of service (BUG and     system crash) by locking a file on an NFS filesystem and     then changing this files permissions, a related issue to     CVE-2010-0727. (CVE-2007-6733)

  - The do_coredump function in fs/exec.c in Linux kernel     did not change the UID of a core dump file if it exists     before a root process creates a core dump in the same     location, which might have allowed local users to obtain     sensitive information. (CVE-2007-6206)

  - fs/namei.c in the Linux kernel did not always follow NFS     automount 'symlinks,' which allowed attackers to have an     unknown impact, related to LOOKUP_FOLLOW.
    (CVE-2010-1088)

  - Stack-based buffer overflow in the hfs subsystem in the     Linux kernel allowed remote attackers to have an     unspecified impact via a crafted Hierarchical File     System (HFS) filesystem, related to the hfs_readdir     function in fs/hfs/dir.c. (CVE-2009-4020)

  - The processcompl_compat function in     drivers/usb/core/devio.c in Linux kernel did not clear     the transfer buffer before returning to userspace when a     USB command fails, which might have made it easier for     physically proximate attackers to obtain sensitive     information (kernel memory). (CVE-2010-1083)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2013-0039 for details.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2011-47:01 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of your Asianux operating system. The     kernel handles the basic functions of the operating system: memory allocation, process allocation, device     input and output, etc.
    Security issues fixed with this release:
    CVE-2009-3080     Array index error in the gdth_read_event function in drivers/scsi/gdth.c in the Linux kernel before     2.6.32-rc8 allows local users to cause a denial of service or possibly gain privileges via a negative     event index in an IOCTL request.
    CVE-2009-3620     The ATI Rage 128 (aka r128) driver in the Linux kernel before 2.6.31-git11 does not properly verify     Concurrent Command Engine (CCE) state initialization, which allows local users to cause a denial of     service (NULL pointer dereference and system crash) or possibly gain privileges via unspecified ioctl     calls.
    CVE-2009-4536     drivers/net/e1000/e1000_main.c in the e1000 driver in the Linux kernel 2.6.32.3 and earlier handles     Ethernet frames that exceed the MTU by processing certain trailing payload data as if it were a complete     frame, which allows remote attackers to bypass packet filters via a large packet with a crafted payload.
    NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-1385.
    CVE-2010-1188     Use-after-free vulnerability in net/ipv4/tcp_input.c in the Linux kernel 2.6 before 2.6.20, when     IPV6_RECVPKTINFO is set on a listening socket, allows remote attackers to cause a denial of service     (kernel panic) via a SYN packet while the socket is in a listening (TCP_LISTEN) state, which is not     properly handled causes the skb structure to be freed.
    CVE-2010-2240     The do_anonymous_page function in mm/memory.c in the Linux kernel before 2.6.27.52, 2.6.32.x before     2.6.32.19, 2.6.34.x before 2.6.34.4, and 2.6.35.x before 2.6.35.2 does not properly separate the stack and     the heap, which allows context-dependent attackers to execute arbitrary code by writing to the bottom page     of a shared memory segment, as demonstrated by a memory-exhaustion attack against the X.Org X server.
    CVE-2010-3081     The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before     2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the userspace memory required for the 32-bit     compatibility layer, which allows local users to gain privileges by leveraging the ability of the     compat_mc_getsockopt function (aka the MCAST_MSFILTER getsockopt support) to control a certain length     value, related to a 'stack pointer underflow' issue, as exploited in the wild in September 2010.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0178 advisory.

    - [fs] gfs2: locking fix for potential dos (Steven Whitehouse) [572390] {CVE-2010-0727}
    - [net] sctp: backport cleanups for ootb handling (Neil Horman) [555667] {CVE-2010-0008}
    - [mm] fix sys_move_pages infoleak (Eugene Teo) [562590] {CVE-2010-0415}
    - [net] netfilter: enforce CAP_NET_ADMIN in ebtables (Danny Feng) [555243] {CVE-2010-0007}
    - [misc] fix kernel info leak with print-fatal-signals=1 (Danny Feng) [554584] {CVE-2010-0003}
    - [net] emergency route cache flushing fixes (Thomas Graf) [545663] {CVE-2009-4272}
    - [fs] fasync: split 'fasync_helper()' into separate add/remove functions (Danny Feng) [548657]     {CVE-2009-4141}
    - [scsi] qla2xxx: NPIV vport management pseudofiles are world writable (Tom Coughlan) [537318]     {CVE-2009-3556}
    - [net] ipv6: fix ipv6_hop_jumbo remote system crash (Amerigo Wang) [548643] {CVE-2007-4567}
    - [net] e1000e: fix rx length check errors (Amerigo Wang) [551223] {CVE-2009-4538}
    - [net] e1000: fix rx length check errors (Neil Horman) [552138] {CVE-2009-4536}
    - [net] r8169: improved frame length filtering (Neil Horman) [550915] {CVE-2009-4537}
    - [firewire] ohci: handle receive packets with zero data (Jay Fenlason) [547242] {CVE-2009-4138}
    - [fs] respect flag in do_coredump (Danny Feng) [544189] {CVE-2009-4036}
    - [fs] ext4: fix insufficient checks in EXT4_IOC_MOVE_EXT (Eric Sandeen) [546105] {CVE-2009-4131}
    - [fs] hfs: fix a potential buffer overflow (Amerigo Wang) [540741] {CVE-2009-4020}
    - [fuse] prevent fuse_put_request on invalid pointer (Danny Feng) [538737] {CVE-2009-4021}
    - [scsi] gdth: prevent negative offsets in ioctl (Amerigo Wang) [539421] {CVE-2009-3080}
    - [scsi] megaraid: fix sas permissions in sysfs (Casey Dahlin) [537313] {CVE-2009-3889 CVE-2009-3939}
    - [fs] pipe.c null pointer dereference (Jeff Moyer ) [530939] {CVE-2009-3547}
    - [nfs] v4: fix setting lock on open file with no state (Jeff Layton ) [533115] {CVE-2009-3726}
    - [drm] r128: check for init on all ioctls that require it (Danny Feng ) [529603] {CVE-2009-3620}
    - [security] require root for mmap_min_addr (Eric Paris ) [518143] {CVE-2009-2695}
    - [net] AF_UNIX: deadlock on connecting to shutdown socket (Jiri Pirko ) [529631] {CVE-2009-3621}
    - [fs] eCryptfs: prevent lower dentry from going negative (Eric Sandeen ) [527835] {CVE-2009-2908}
    - [nfs] knfsd: fix NFSv4 O_EXCL creates (Jeff Layton ) [524521] {CVE-2009-3286}
    - Revert: [net] atalk/irda: memory leak to user in getname (Don Zickus ) [519310] {CVE-2009-3001     CVE-2009-3002}
    - [net] atalk/irda: memory leak to user in getname (Danny Feng ) [519310] {CVE-2009-3001 CVE-2009-3002}
    - [md] prevent crash when accessing suspend_* sysfs attr (Danny Feng ) [518136] {CVE-2009-2849}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
60787	Scientific Linux Security Update : kernel on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
89678	VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2011-0009) (remote check)	Nessus	Misc.	2016/3/4	2021/1/6	high
48901	SuSE9 Security Update : Linux kernel (YOU Patch Number 12636)	Nessus	SuSE Local Security Checks	2010/8/27	2021/1/14	critical
79507	OracleVM 2.2 : kernel (OVMSA-2013-0039)	Nessus	OracleVM Local Security Checks	2014/11/26	2021/1/4	high
284227	MiracleLinux 3 : kernel-2.6.18-194.10.AXS3 (AXSA:2011-47:01)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/2/12	high
180620	Oracle Linux 5 : Oracle / Enterprise / Linux / 5.5 / kernel (ELSA-2010-0178)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2026/2/9	medium

检测

插件搜索

high

high

critical

high

high

medium