Security fixes :

  - a NULL pointer dereference flaw was found in the Linux     kernel NFSv4 implementation. Several of the NFSv4 file     locking functions failed to check whether a file had     been opened on the server before performing locking     operations on it. A local, unprivileged user on a system     with an NFSv4 share mounted could possibly use this flaw     to cause a kernel panic (denial of service) or escalate     their privileges. (CVE-2009-3726, Important)

  - a flaw was found in the sctp_process_unk_param()     function in the Linux kernel Stream Control Transmission     Protocol (SCTP) implementation. A remote attacker could     send a specially crafted SCTP packet to an SCTP     listening port on a target system, causing a kernel     panic (denial of service). (CVE-2010-1173, Important)

  - a race condition between finding a keyring by name and     destroying a freed keyring was found in the Linux kernel     key management facility. A local, unprivileged user     could use this flaw to cause a kernel panic (denial of     service) or escalate their privileges. (CVE-2010-1437,     Important)

Red Hat would like to thank Simon Vallet for responsibly reporting CVE-2009-3726; and Jukka Taimisto and Olli Jarva of Codenomicon Ltd, Nokia Siemens Networks, and Wind River on behalf of their customer, for responsibly reporting CVE-2010-1173.

Bug fixes :

  - RHBA-2007:0791 introduced a regression in the Journaling     Block Device (JBD). Under certain circumstances,     removing a large file (such as 300 MB or more) did not     result in inactive memory being freed, leading to the     system having a large amount of inactive memory. Now,     the memory is correctly freed. (BZ#589155)

  - the timer_interrupt() routine did not scale lost real     ticks to logical ticks correctly, possibly causing time     drift for 64-bit Scientific Linux 4 KVM (Kernel-based     Virtual Machine) guests that were booted with the     'divider=x' kernel parameter set to a value greater than     1. 'warning: many lost ticks' messages may have been     logged on the affected guest systems. (BZ#590551)

  - a bug could have prevented NFSv3 clients from having the     most up-to-date file attributes for files on a given     NFSv3 file system. In cases where a file type changed,     such as if a file was removed and replaced with a     directory of the same name, the NFSv3 client may not     have noticed this change until stat(2) was called (for     example, by running 'ls -l'). (BZ#596372)

  - RHBA-2007:0791 introduced bugs in the Linux kernel PCI-X     subsystem. These could have caused a system deadlock on     some systems where the BIOS set the default Maximum     Memory Read Byte Count (MMRBC) to 4096, and that also     use the Intel PRO/1000 Linux driver, e1000. Errors such     as 'e1000: eth[x]: e1000_clean_tx_irq: Detected Tx Unit     Hang' were logged. (BZ#596374)

  - an out of memory condition in a KVM guest, using the     virtio-net network driver and also under heavy network     stress, could have resulted in that guest being unable     to receive network traffic. Users had to manually remove     and re-add the virtio_net module and restart the network     service before networking worked as expected. Such     memory conditions no longer prevent KVM guests receiving     network traffic. (BZ#597310)

  - when an SFQ qdisc that limited the queue size to two     packets was added to a network interface, sending     traffic through that interface resulted in a kernel     crash. Such a qdisc no longer results in a kernel crash.
    (BZ#597312)

  - when an NFS client opened a file with the O_TRUNC flag     set, it received a valid stateid, but did not use that     stateid to perform the SETATTR call. Such cases were     rejected by Red Hat Enterprise Linux 4 NFS servers with     an 'NFS4ERR_BAD_STATEID' error, possibly preventing some     NFS clients from writing files to an NFS file system.
    (BZ#597314)

The system must be rebooted for this update to take effect.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2010-377:12 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system. The kernel     handles the basic functions of the operating system: memory allocation, process allocation, device input     and output, etc.
    Security issues fixed with this release:
    CVE-2010-0291     The Linux kernel before 2.6.32.4 allows local users to gain privileges or cause a denial of service     (panic) by calling the (1) mmap or (2) mremap function, aka the 'do_mremap() mess' or 'mremap/mmap mess.'     CVE-2010-0622     The wake_futex_pi function in kernel/futex.c in the Linux kernel before 2.6.33-rc7 does not properly     handle certain unlock operations for a Priority Inheritance (PI) futex, which allows local users to cause     a denial of service (OOPS) and possibly have unspecified other impact via vectors involving modification     of the futex value from user space.
    CVE-2010-1087     The nfs_wait_on_request function in fs/nfs/pagelist.c in Linux kernel 2.6.x through 2.6.33-rc5 allows     attackers to cause a denial of service (Oops) via unknown vectors related to truncating a file and an     operation that is not interruptible.
    CVE-2010-1088     fs/namei.c in Linux kernel 2.6.18 through 2.6.34 does not always follow NFS automount 'symlinks,' which     allows attackers to have an unknown impact, related to LOOKUP_FOLLOW.
    CVE-2010-1173     The sctp_process_unk_param function in net/sctp/sm_make_chunk.c in the Linux kernel 2.6.33.3 and earlier,     when SCTP is enabled, allows remote attackers to cause a denial of service (system crash) via an     SCTPChunkInit packet containing multiple invalid parameters that require a large amount of error data.
    CVE-2010-1187     The Transparent Inter-Process Communication (TIPC) functionality in Linux kernel 2.6.16-rc1 through     2.6.33, and possibly other versions, allows local users to cause a denial of service (kernel OOPS) by     sending datagrams through AF_TIPC before entering network mode, which triggers a NULL pointer dereference.
    CVE-2010-1436     gfs2 in the Linux kernel 2.6.18, and possibly other versions, does not properly handle when the gfs2_quota     struct occupies two separate pages, which allows local users to cause a denial of service (kernel panic)     via certain manipulations that cause an out-of-bounds write, as demonstrated by writing from an ext3 file     system to a gfs2 file system.
    CVE-2010-1437     Race condition in the find_keyring_by_name function in security/keys/keyring.c in the Linux kernel     2.6.34-rc5 and earlier allows local users to cause a denial of service (memory corruption and system     crash) or possibly have unspecified other impact via keyctl session commands that trigger access to a dead     keyring that is undergoing deletion by the key_cleanup function.
    CVE-2010-1641     The do_gfs2_set_flags function in fs/gfs2/file.c in the Linux kernel before 2.6.34-git10 does not verify     the ownership of a file, which allows local users to bypass intended access restrictions via a SETFLAGS     ioctl request.
    Fixed bugs:
    acpi
    - warn on hot-add of memory exceeding 4G boundary
    - fix WARN on unregister in power meter driver     block
    - cfq-iosched: fix IOPRIO_CLASS_IDLE accounting
    - cfq-iosched: async queue allocation per priority
    - cfq-iosched: fix async queue behaviour
    - cfq-iosched: propagate down request sync flag
    - introduce the rq_is_sync macro     fs
    - remove unneccessary f_ep_lock from fasync_helper     misc
    - add atomic64_cmpxcgh to x86_64 include files     mm
    - fix hugepage corruption using vm.drop_caches
    - clear page errors when issuing a fresh read of page     net
    - e1000: fix WoL init when WoL disabled in EEPROM
    - tg3: fix INTx fallback when MSI fails
    - sched: fix SFQ qdisc crash w/limit of 2 packets
    - bonding: fix broken multicast with round-robin mode
    - cnic: Fix crash during bnx2x MTU change
    - bxn2x: add dynamic lro disable support
    - sctp: file must be valid before setting timeout
    - e1000/e1000e: implement simple interrupt moderation
    - neigh: fix state transitions via Netlink request
    - tg3: fix panic in tg3_interrupt
    - cnic: fix bnx2x panic w/multiple interfaces enabled     nfs
    - revert retcode check in nfs_revalidate_mapping()
    - don't unhash dentry in nfs_lookup_revalidate     virt
    - don't compute pvclock adjustments if we trust tsc
    - add a global synchronization point for pvclock
    - enable pvclock flags in vcpu_time_info structure     virtio
    - fix GFP flags passed by virtio balloon driver     x86
    - grab atomic64 types from upstream     x86_64
    - fix time drift due to faulty lost tick tracking     xen
    - set hypervisor present CPUID bit

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

a. Service Console OS update for COS kernel

   This patch updates the service console kernel to fix multiple    security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-0415, CVE-2010-0307,    CVE-2010-0291, CVE-2010-0622, CVE-2010-1087, CVE-2010-1437, and    CVE-2010-1088 to these issues.

b. Likewise package updates

   Updates to the likewisekrb5, likewiseopenldap, likewiseopen,    and pamkrb5 packages address several security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2009-0844, CVE-2009-0845,    CVE-2009-0846, CVE-2009-4212, and CVE-2010-1321 to these issues.

a. vCenter Server and vCenter Update Manager update Microsoft    SQL Server 2005 Express Edition to Service Pack 3

   Microsoft SQL Server 2005 Express Edition (SQL Express)    distributed with vCenter Server 4.1 Update 1 and vCenter Update    Manager 4.1 Update 1 is upgraded from  SQL Express Service Pack 2    to SQL Express Service Pack 3, to address multiple security    issues that exist in the earlier releases of Microsoft SQL Express.

   Customers using other database solutions need not update for    these issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-5416, CVE-2008-0085, CVE-2008-0086,    CVE-2008-0107 and CVE-2008-0106 to the issues addressed in MS SQL    Express Service Pack 3.

b. vCenter Apache Tomcat Management Application Credential Disclosure

   The Apache Tomcat Manager application configuration file contains    logon credentials that can be read by unprivileged local users.

   The issue is resolved by removing the Manager application in    vCenter 4.1 Update 1.

   If vCenter 4.1 is updated to vCenter 4.1 Update 1 the logon    credentials are not present in the configuration file after the    update.

   VMware would like to thank Claudio Criscione of Secure Networking    for reporting this issue to us.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2010-2928 to this issue.

c. vCenter Server and ESX, Oracle (Sun) JRE is updated to version    1.6.0_21

   Oracle (Sun) JRE update to version 1.6.0_21, which addresses    multiple security issues that existed in earlier releases of    Oracle (Sun) JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Oracle (Sun) JRE 1.6.0_19: CVE-2009-3555, CVE-2010-0082,    CVE-2010-0084, CVE-2010-0085, CVE-2010-0087, CVE-2010-0088,    CVE-2010-0089, CVE-2010-0090, CVE-2010-0091, CVE-2010-0092,    CVE-2010-0093, CVE-2010-0094, CVE-2010-0095, CVE-2010-0837,    CVE-2010-0838, CVE-2010-0839, CVE-2010-0840, CVE-2010-0841,    CVE-2010-0842, CVE-2010-0843, CVE-2010-0844, CVE-2010-0845,    CVE-2010-0846, CVE-2010-0847, CVE-2010-0848, CVE-2010-0849,    CVE-2010-0850.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following name to the security issue fixed in    Oracle (Sun) JRE 1.6.0_20: CVE-2010-0886.

d. vCenter Update Manager Oracle (Sun) JRE is updated to version   1.5.0_26

   Oracle (Sun) JRE update to version 1.5.0_26, which addresses    multiple security issues that existed in earlier releases of    Oracle (Sun) JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Oracle (Sun) JRE 1.5.0_26: CVE-2010-3556, CVE-2010-3566,    CVE-2010-3567, CVE-2010-3550, CVE-2010-3561, CVE-2010-3573,    CVE-2010-3565,CVE-2010-3568, CVE-2010-3569,  CVE-2009-3555,    CVE-2010-1321, CVE-2010-3548, CVE-2010-3551, CVE-2010-3562,    CVE-2010-3571, CVE-2010-3554, CVE-2010-3559, CVE-2010-3572,    CVE-2010-3553, CVE-2010-3549, CVE-2010-3557, CVE-2010-3541,    CVE-2010-3574.

e. vCenter Server and ESX Apache Tomcat updated to version 6.0.28

   Apache Tomcat updated to version 6.0.28, which addresses multiple    security issues that existed in earlier releases of Apache Tomcat

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Apache Tomcat 6.0.24: CVE-2009-2693, CVE-2009-2901, CVE-2009-2902,i    and CVE-2009-3548.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Apache Tomcat 6.0.28: CVE-2010-2227, CVE-2010-1157.

f. vCenter Server third-party component OpenSSL updated to version    0.9.8n

   The version of the OpenSSL library in vCenter Server is updated to    0.9.8n.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-0740 and CVE-2010-0433 to the    issues addressed in this version of OpenSSL.

g. ESX third-party component OpenSSL updated to version 0.9.8p

   The version of the ESX OpenSSL library is updated to 0.9.8p.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-3864 and CVE-2010-2939 to the    issues addressed in this update.

h. ESXi third-party component cURL updated

   The version of cURL library in ESXi is updated.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-0734 to the issues addressed in    this update.

i. ESX third-party component pam_krb5 updated

   The version of pam_krb5 library is updated.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-3825 and CVE-2009-1384 to the    issues addressed in the update.

j. ESX third-party update for Service Console kernel

   The Service Console kernel is updated to include kernel version    2.6.18-194.11.1.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-1084, CVE-2010-2066, CVE-2010-2070,    CVE-2010-2226, CVE-2010-2248, CVE-2010-2521, CVE-2010-2524,    CVE-2010-0008, CVE-2010-0415, CVE-2010-0437, CVE-2009-4308,    CVE-2010-0003, CVE-2010-0007, CVE-2010-0307, CVE-2010-1086,    CVE-2010-0410, CVE-2010-0730, CVE-2010-1085, CVE-2010-0291,    CVE-2010-0622, CVE-2010-1087, CVE-2010-1173, CVE-2010-1437,    CVE-2010-1088, CVE-2010-1187, CVE-2010-1436, CVE-2010-1641, and    CVE-2010-3081 to the issues addressed in the update.

   Notes :
   - The update also addresses the 64-bit compatibility mode    stack pointer underflow issue identified by CVE-2010-3081. This    issue was patched in an ESX 4.1 patch prior to the release of    ESX 4.1 Update 1 and in a previous ESX 4.0 patch release.
   - The update also addresses CVE-2010-2240 for ESX 4.0.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0504 advisory.

    - [fs] gfs2: fix permissions checking for setflags ioctl (Steven Whitehouse) [595580 595399]     {CVE-2010-1641}
    - [misc] keys: do not find already freed keyrings (Vitaly Mayatskikh) [585099 585100] {CVE-2010-1437}
    - [misc] futex: handle futex value corruption gracefully (Jerome Marchand) [563093 480396] {CVE-2010-0622}
    - [misc] futex: handle user space corruption gracefully (Jerome Marchand) [563093 480396] {CVE-2010-0622}
    - [misc] futex: fix fault handling in futex_lock_pi (Jerome Marchand) [563093 480396] {CVE-2010-0622}
    - [net] sctp: fix skb_over_panic w/too many unknown params (Neil Horman) [584657 584658] {CVE-2010-1173}
    - [mm] keep get_unmapped_area_prot functional (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] switch do_brk to get_unmapped_area (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] take arch_mmap_check into get_unmapped_area (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] get rid of open-coding in ia64_brk (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] unify sys_mmap* functions (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] kill ancient cruft in s390 compat mmap (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] fix pgoff in have to relocate case of mremap (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] fix the arch checks in MREMAP_FIXED case (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] fix checks for expand-in-place mremap (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] add new vma_expandable helper function (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] move MREMAP_FIXED into its own header (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] move locating vma code and checks on it (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [net] tipc: fix various oopses in uninitialized code (Neil Horman) [578058 558693] {CVE-2010-1187}
    - [fs] vfs: fix LOOKUP_FOLLOW on automount symlinks (Jeff Layton) [567815 567816] {CVE-2010-1088}
    - [nfs] fix an oops when truncating a file (Jeff Layton) [567194 567195] {CVE-2010-1087}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update fixes the following security issues :

  - multiple flaws were found in the mmap and mremap     implementations. A local user could use these flaws to     cause a local denial of service or escalate their     privileges. (CVE-2010-0291, Important)

  - a NULL pointer dereference flaw was found in the Fast     Userspace Mutexes (futexes) implementation. The unlock     code path did not check if the futex value associated     with pi_state->owner had been modified. A local user     could use this flaw to modify the futex value, possibly     leading to a denial of service or privilege escalation     when the pi_state->owner pointer is dereferenced.
    (CVE-2010-0622, Important)

  - a NULL pointer dereference flaw was found in the Linux     kernel Network File System (NFS) implementation. A local     user on a system that has an NFS-mounted file system     could use this flaw to cause a denial of service or     escalate their privileges on that system.
    (CVE-2010-1087, Important)

  - a flaw was found in the sctp_process_unk_param()     function in the Linux kernel Stream Control Transmission     Protocol (SCTP) implementation. A remote attacker could     send a specially crafted SCTP packet to an SCTP     listening port on a target system, causing a kernel     panic (denial of service). (CVE-2010-1173, Important)

  - a flaw was found in the Linux kernel Transparent     Inter-Process Communication protocol (TIPC)     implementation. If a client application, on a local     system where the tipc module is not yet in network mode,     attempted to send a message to a remote TIPC node, it     would dereference a NULL pointer on the local system,     causing a kernel panic (denial of service).
    (CVE-2010-1187, Important)

  - a buffer overflow flaw was found in the Linux kernel     Global File System 2 (GFS2) implementation. In certain     cases, a quota could be written past the end of a memory     page, causing memory corruption, leaving the quota     stored on disk in an invalid state. A user with write     access to a GFS2 file system could trigger this flaw to     cause a kernel crash (denial of service) or escalate     their privileges on the GFS2 server. This issue can only     be triggered if the GFS2 file system is mounted with the     'quota=on' or 'quota=account' mount option.
    (CVE-2010-1436, Important)

  - a race condition between finding a keyring by name and     destroying a freed keyring was found in the Linux kernel     key management facility. A local user could use this     flaw to cause a kernel panic (denial of service) or     escalate their privileges. (CVE-2010-1437, Important)

  - a flaw was found in the link_path_walk() function in the     Linux kernel. Using the file descriptor returned by the     open() function with the O_NOFOLLOW flag on a     subordinate NFS-mounted file system, could result in a     NULL pointer dereference, causing a denial of service or     privilege escalation. (CVE-2010-1088, Moderate)

  - a missing permission check was found in the     gfs2_set_flags() function in the Linux kernel GFS2     implementation. A local user could use this flaw to     change certain file attributes of files, on a GFS2 file     system, that they do not own. (CVE-2010-1641, Low)

Red Hat would like to thank Jukka Taimisto and Olli Jarva of Codenomicon Ltd, Nokia Siemens Networks, and Wind River on behalf of their customer, for responsibly reporting CVE-2010-1173; Mario Mikocevic for responsibly reporting CVE-2010-1436; and Dan Rosenberg for responsibly reporting CVE-2010-1641.

This update also fixes several bugs.

The system must be rebooted for this update to take effect.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
60802	Scientific Linux Security Update : kernel on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
291412	MiracleLinux 3 : kernel-2.6.18-194.3.AXS3 (AXSA:2010-377:12)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/2/5	high
50611	VMSA-2010-0016 : VMware ESXi and ESX third-party updates for Service Console and Likewise components	Nessus	VMware ESX Local Security Checks	2010/11/16	2021/1/6	critical
51971	VMSA-2011-0003 : Third-party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX	Nessus	VMware ESX Local Security Checks	2011/2/14	2022/5/25	high
68056	Oracle Linux 5 : kernel (ELSA-2010-0504)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2026/2/9	high
60810	Scientific Linux Security Update : kernel on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high

检测

插件搜索

high

high

critical

high

high

high