New kernel packages are available for Slackware x86_64 13.1, and
-current to fix security issues.

This update fixes the following security issues :

  - Missing sanity checks in the Intel i915 driver in the     Linux kernel could allow a local, unprivileged user to     escalate their privileges. (CVE-2010-2962, Important)

  - compat_alloc_user_space() in the Linux kernel 32/64-bit     compatibility layer implementation was missing sanity     checks. This function could be abused in other areas of     the Linux kernel if its length argument can be     controlled from user-space. On 64-bit systems, a local,     unprivileged user could use this flaw to escalate their     privileges. (CVE-2010-3081, Important)

  - A buffer overflow flaw in niu_get_ethtool_tcam_all() in     the niu Ethernet driver in the Linux kernel, could allow     a local user to cause a denial of service or escalate     their privileges. (CVE-2010-3084, Important)

  - A flaw in the IA32 system call emulation provided in     64-bit Linux kernels could allow a local user to     escalate their privileges. (CVE-2010-3301, Important)

  - A flaw in sctp_packet_config() in the Linux kernel's     Stream Control Transmission Protocol (SCTP)     implementation could allow a remote attacker to cause a     denial of service. (CVE-2010-3432, Important)

  - A missing integer overflow check in snd_ctl_new() in the     Linux kernel's sound subsystem could allow a local,     unprivileged user on a 32-bit system to cause a denial     of service or escalate their privileges. (CVE-2010-3442,     Important)

  - A flaw was found in sctp_auth_asoc_get_hmac() in the     Linux kernel's SCTP implementation. When iterating     through the hmac_ids array, it did not reset the last id     element if it was out of range. This could allow a     remote attacker to cause a denial of service.
    (CVE-2010-3705, Important)

  - A function in the Linux kernel's Reliable Datagram     Sockets (RDS) protocol implementation was missing sanity     checks, which could allow a local, unprivileged user to     escalate their privileges. (CVE-2010-3904, Important)

  - A flaw in drm_ioctl() in the Linux kernel's Direct     Rendering Manager (DRM) implementation could allow a     local, unprivileged user to cause an information leak.
    (CVE-2010-2803, Moderate)

  - It was found that wireless drivers might not always     clear allocated buffers when handling a driver-specific     IOCTL information request. A local user could trigger     this flaw to cause an information leak. (CVE-2010-2955,     Moderate)

  - A NULL pointer dereference flaw in ftrace_regex_lseek()     in the Linux kernel's ftrace implementation could allow     a local, unprivileged user to cause a denial of service.
    Note: The debugfs file system must be mounted locally to     exploit this issue. It is not mounted by default.
    (CVE-2010-3079, Moderate)

  - A flaw in the Linux kernel's packet writing driver could     be triggered via the PKT_CTRL_CMD_STATUS IOCTL request,     possibly allowing a local, unprivileged user with access     to '/dev/pktcdvd/control' to cause an information leak.
    Note: By default, only users in the cdrom group have     access to '/dev/pktcdvd/control'. (CVE-2010-3437,     Moderate)

  - A flaw was found in the way KVM (Kernel-based Virtual     Machine) handled the reloading of fs and gs segment     registers when they had invalid selectors. A privileged     host user with access to '/dev/kvm' could use this flaw     to crash the host. (CVE-2010-3698, Moderate)

This update also fixes several bugs.

The system must be rebooted for this update to take effect.

Updated kernel packages that fix one security issue are now available for Red Hat Enterprise Linux 5.3 Extended Update Support.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issue :

* The compat_alloc_user_space() function in the Linux kernel 32/64-bit compatibility layer implementation was missing sanity checks. This function could be abused in other areas of the Linux kernel if its length argument can be controlled from user-space. On 64-bit systems, a local, unprivileged user could use this flaw to escalate their privileges. (CVE-2010-3081, Important)

Red Hat would like to thank Ben Hawkes for reporting this issue.

Red Hat is aware that a public exploit for this issue is available.
Refer to Knowledgebase article DOC-40265 for further details:
https://access.redhat.com/kb/docs/DOC-40265

Users should upgrade to these updated packages, which contain a backported patch to correct this issue. The system must be rebooted for this update to take effect.

Updated kernel packages that fix one security issue are now available for Red Hat Enterprise Linux 4.7 Extended Update Support.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issue :

* The compat_alloc_user_space() function in the Linux kernel 32/64-bit compatibility layer implementation was missing sanity checks. This function could be abused in other areas of the Linux kernel if its length argument can be controlled from user-space. On 64-bit systems, a local, unprivileged user could use this flaw to escalate their privileges. (CVE-2010-3081, Important)

Red Hat would like to thank Ben Hawkes for reporting this issue.

Refer to Knowledgebase article DOC-40265 for further details:
https://access.redhat.com/kb/docs/DOC-40265

Users should upgrade to these updated packages, which contain a backported patch to correct this issue. The system must be rebooted for this update to take effect.

- Fix possible local privilege escalation on x86_64     systems (CVE-2010-3081, CVE-2010-3301).

    - Mitigate denial of service attack with large argument       lists.

    - Fix possible hang on suspend introduced in 2.6.34.6-54

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated kernel packages that fix one security issue are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issue :

* The compat_alloc_user_space() function in the Linux kernel 32/64-bit compatibility layer implementation was missing sanity checks. This function could be abused in other areas of the Linux kernel if its length argument can be controlled from user-space. On 64-bit systems, a local, unprivileged user could use this flaw to escalate their privileges. (CVE-2010-3081, Important)

Red Hat would like to thank Ben Hawkes for reporting this issue.

Refer to Knowledgebase article DOC-40265 for further details:
https://access.redhat.com/kb/docs/DOC-40265

Users should upgrade to these updated packages, which contain a backported patch to correct this issue. The system must be rebooted for this update to take effect.

This update fixes the following security issue :

  - The compat_alloc_user_space() function in the Linux     kernel 32/64-bit compatibility layer implementation was     missing sanity checks. This function could be abused in     other areas of the Linux kernel if its length argument     can be controlled from user-space. On 64-bit systems, a     local, unprivileged user could use this flaw to escalate     their privileges. (CVE-2010-3081, Important)

The system must be rebooted for this update to take effect.

Updated kernel packages that fix one security issue are now available for Red Hat Enterprise Linux 5.4 Extended Update Support.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issue :

* The compat_alloc_user_space() function in the Linux kernel 32/64-bit compatibility layer implementation was missing sanity checks. This function could be abused in other areas of the Linux kernel if its length argument can be controlled from user-space. On 64-bit systems, a local, unprivileged user could use this flaw to escalate their privileges. (CVE-2010-3081, Important)

Red Hat would like to thank Ben Hawkes for reporting this issue.

Red Hat is aware that a public exploit for this issue is available.
Refer to Knowledgebase article DOC-40265 for further details:
https://access.redhat.com/kb/docs/DOC-40265

Users should upgrade to these updated packages, which contain a backported patch to correct this issue. The system must be rebooted for this update to take effect.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leak. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2010-2492     Andre Osterhues reported an issue in the eCryptfs     subsystem. A buffer overflow condition may allow local     users to cause a denial of service or gain elevated     privileges.

  - CVE-2010-2954     Tavis Ormandy reported an issue in the irda subsystem     which may allow local users to cause a denial of service     via a NULL pointer dereference.

  - CVE-2010-3078     Dan Rosenberg discovered an issue in the XFS file system     that allows local users to read potentially sensitive     kernel memory.

  - CVE-2010-3080     Tavis Ormandy reported an issue in the ALSA sequencer     OSS emulation layer. Local users with sufficient     privileges to open /dev/sequencer (by default on Debian,     this is members of the 'audio' group) can cause a denial     of service via a NULL pointer dereference.

  - CVE-2010-3081     Ben Hawkes discovered an issue in the 32-bit     compatibility code for 64-bit systems. Local users can     gain elevated privileges due to insufficient checks in     compat_alloc_user_space allocations.

This SUSE Linux Enterprise 11 Service Pack 1 kernel contains various security fixes and lots of other bugfixes.

The following security issues were fixed :

  - local users could crash the system by causing a NULL     deref in the keyctl_session_to_parent() function.
    (CVE-2010-2960)

  - local users could crash the system by causing a NULL     deref via IRDA sockets. (CVE-2010-2954)

  - local users could crash the system by causing a NULL     deref in ftrace. (CVE-2010-3079)

  - several kernel functions could leak kernel stack memory     contents. (CVE-2010-3078 / CVE-2010-3297 / CVE-2010-3298     / CVE-2010-3081 / CVE-2010-3296)

  - local users could cause dereference of an uninitialized     pointer via /dev/sequencer. (CVE-2010-3080)

  - local users could corrupt kernel heap memory via ROSE     sockets. (CVE-2010-3310)

  - local users could write to any kernel memory location     via the i915 GEM ioctl interface Additionally this     update restores the compat_alloc_userspace() inline     function. (CVE-2010-2962)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0007 advisory.

    - [kvm] x86: zero kvm_vcpu_events->interrupt.pad (Marcelo Tosatti) [665471 665409] {CVE-2010-4525}

    email_6.RHSA-2011-0007 178L, 11970C written
    - [netdrv] igb: only use vlan_gro_receive if vlans are registered (Stefan Assmann) [652804 660192]     {CVE-2010-4263}
    - [kernel] posix-cpu-timers: workaround to suppress the problems with mt exec (Oleg Nesterov) [656267     656268] {CVE-2010-4248}
    - [fs] bio: take care not overflow page count when mapping/copying user data (Danny Feng) [652530 652531]     {CVE-2010-4162}
    - [net] can-bcm: fix minor heap overflow (Danny Feng) [651846 651847] {CVE-2010-3874}
    - [net] filter: make sure filters dont read uninitialized memory (Jiri Pirko) [651704 651705]     {CVE-2010-4158}
    - [net] inet_diag: Make sure we actually run the same bytecode we audited (Jiri Pirko) [651268 651269]     {CVE-2010-3880}
    - [v4l] ivtvfb: prevent reading uninitialized stack memory (Mauro Carvalho Chehab) [648832 648833]     {CVE-2010-4079}
    - [drm] via/ioctl.c: prevent reading uninitialized stack memory (Dave Airlie) [648718 648719]     {CVE-2010-4082}
    - [char] nozomi: clear data before returning to userspace on TIOCGICOUNT (Mauro Carvalho Chehab) [648705     648706] {CVE-2010-4077}
    - [serial] clean data before filling it on TIOCGICOUNT (Mauro Carvalho Chehab) [648702 648703]     {CVE-2010-4075}
    - [net] af_unix: limit unix_tot_inflight (Neil Horman) [656761 656762] {CVE-2010-4249}
    - [block] check for proper length of iov entries in blk_rq_map_user_iov() (Danny Feng) [652958 652959]     {CVE-2010-4163}
    - [net] Limit sendto()/recvfrom()/iovec total length to INT_MAX (Jiri Pirko) [651894 651895]     {CVE-2010-4160}
    - [net] bluetooth: Fix missing NULL check (Jarod Wilson) [655667 655668] {CVE-2010-4242}
    - [kernel] ipc: initialize structure memory to zero for compat functions (Danny Feng) [648694 648695]     {CVE-2010-4073}
    - [kernel] shm: fix information leak to userland (Danny Feng) [648688 648689] {CVE-2010-4072}
    - [fs] xfs: prevent reading uninitialized stack memory (Dave Chinner) [630808 630809] {CVE-2010-3078}
    - [net] fix rds_iovec page count overflow (Jiri Pirko) [647423 647424] {CVE-2010-3865}
    - [usb] serial/mos*: prevent reading uninitialized stack memory (Don Zickus) [648697 648698]     {CVE-2010-4074}
    - [kernel] ecryptfs_uid_hash() buffer overflow (Jerome Marchand) [626320 611388] {CVE-2010-2492}
    - [sound] seq/oss - Fix double-free at error path of snd_seq_oss_open() (Jaroslav Kysela) [630554 630555]     {CVE-2010-3080}
    - [netdrv] prevent reading uninitialized memory in hso driver (Thomas Graf) [633143 633144]     {CVE-2010-3298}
    - [fs] aio: check for multiplication overflow in do_io_submit (Jeff Moyer) [629450 629451] {CVE-2010-3067}
    - [net] fix info leak from kernel in ethtool operation (Neil Horman) [646727 646728] {CVE-2010-3861}
    - [net] packet: fix information leak to userland (Jiri Pirko) [649899 649900] {CVE-2010-3876}
    - [net] clean up info leak in act_police (Neil Horman) [636393 636394] {CVE-2010-3477}
    - [net] Fix priv escalation in rds protocol (Neil Horman) [642899 642900] {CVE-2010-3904}
    - [v4l] Remove compat code for VIDIOCSMICROCODE (Mauro Carvalho Chehab) [642472 642473] {CVE-2010-2963}
    - [kernel] tracing: do not allow llseek to set_ftrace_filter (Jiri Olsa) [631625 631626] {CVE-2010-3079}
    - [drm] fix ioctls infoleak (Danny Feng) [626319 621437] {CVE-2010-2803}
    - [netdrv] wireless extensions: fix kernel heap content leak (John Linville) [628437 628438]     {CVE-2010-2955}
    - [netdrv] niu: buffer overflow for ETHTOOL_GRXCLSRLALL (Danny Feng) [632071 632072] {CVE-2010-3084}
    - [virt] KVM: Fix fs/gs reload oops with invalid ldt (Avi Kivity) [639884 639885] {CVE-2010-3698}
    - [drm] i915: prevent arbitrary kernel memory write (Jerome Marchand) [637690 637691] {CVE-2010-2962}
    - [kernel] prevent heap corruption in snd_ctl_new() (Jerome Marchand) [638485 638486] {CVE-2010-3442}
    - [block] Fix pktcdvd ioctl dev_minor range check (Jerome Marchand) [638088 638089] {CVE-2010-3437}
    - [net] sctp: Fix out-of-bounds reading in sctp_asoc_get_hmac() (Jiri Pirko) [640461 640462]     {CVE-2010-3705}
    - [net] sctp: Do not reset the packet during sctp_packet_config() (Jiri Pirko) [637681 637682]     {CVE-2010-3432}
    - [misc] make compat_alloc_user_space() incorporate the access_ok() (Xiaotian Feng) [634465 634466]     {CVE-2010-3081}
    - [x86] kernel: fix IA32 System Call Entry Point Vulnerability (Xiaotian Feng) [634451 634452]     {CVE-2010-3301}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel :

fs/namei.c in Linux kernel 2.6.18 through 2.6.34 does not always follow NFS automount symlinks, which allows attackers to have an unknown impact, related to LOOKUP_FOLLOW. (CVE-2010-1088)

The tc_fill_tclass function in net/sched/sch_api.c in the tc subsystem in the Linux kernel 2.4.x before 2.4.37.6 and 2.6.x before 2.6.31-rc9 does not initialize certain (1) tcm__pad1 and (2) tcm__pad2 structure members, which might allow local users to obtain sensitive information from kernel memory via unspecified vectors. (CVE-2009-3228)

The do_pages_move function in mm/migrate.c in the Linux kernel before 2.6.33-rc7 does not validate node values, which allows local users to read arbitrary kernel memory locations, cause a denial of service (OOPS), and possibly have unspecified other impact by specifying a node that is not part of the kernel node set. (CVE-2010-0415)

The ATI Rage 128 (aka r128) driver in the Linux kernel before 2.6.31-git11 does not properly verify Concurrent Command Engine (CCE) state initialization, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly gain privileges via unspecified ioctl calls. (CVE-2009-3620)

The wake_futex_pi function in kernel/futex.c in the Linux kernel before 2.6.33-rc7 does not properly handle certain unlock operations for a Priority Inheritance (PI) futex, which allows local users to cause a denial of service (OOPS) and possibly have unspecified other impact via vectors involving modification of the futex value from user space. (CVE-2010-0622)

The kvm_arch_vcpu_ioctl_set_sregs function in the KVM in Linux kernel 2.6 before 2.6.30, when running on x86 systems, does not validate the page table root in a KVM_SET_SREGS call, which allows local users to cause a denial of service (crash or hang) via a crafted cr3 value, which triggers a NULL pointer dereference in the gfn_to_rmap function.
(CVE-2009-2287)

The handle_dr function in arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 2.6.31.1 does not properly verify the Current Privilege Level (CPL) before accessing a debug register, which allows guest OS users to cause a denial of service (trap) on the host OS via a crafted application. (CVE-2009-3722)

The ext4_decode_error function in fs/ext4/super.c in the ext4 filesystem in the Linux kernel before 2.6.32 allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference), and possibly have unspecified other impact, via a crafted read-only filesystem that lacks a journal. (CVE-2009-4308)

The eisa_eeprom_read function in the parisc isa-eeprom component (drivers/parisc/eisa_eeprom.c) in the Linux kernel before 2.6.31-rc6 allows local users to access restricted memory via a negative ppos argument, which bypasses a check that assumes that ppos is positive and causes an out-of-bounds read in the readb function.
(CVE-2009-2846)

Multiple buffer overflows in fs/nfsd/nfs4xdr.c in the XDR implementation in the NFS server in the Linux kernel before 2.6.34-rc6 allow remote attackers to cause a denial of service (panic) or possibly execute arbitrary code via a crafted NFSv4 compound WRITE request, related to the read_buf and nfsd4_decode_compound functions.
(CVE-2010-2521)

mm/shmem.c in the Linux kernel before 2.6.28-rc8, when strict overcommit is enabled and CONFIG_SECURITY is disabled, does not properly handle the export of shmemfs objects by knfsd, which allows attackers to cause a denial of service (NULL pointer dereference and knfsd crash) or possibly have unspecified other impact via unknown vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-1643. (CVE-2008-7256)

The release_one_tty function in drivers/char/tty_io.c in the Linux kernel before 2.6.34-rc4 omits certain required calls to the put_pid function, which has unspecified impact and local attack vectors.
(CVE-2010-1162)

mm/shmem.c in the Linux kernel before 2.6.28-rc3, when strict overcommit is enabled, does not properly handle the export of shmemfs objects by knfsd, which allows attackers to cause a denial of service (NULL pointer dereference and knfsd crash) or possibly have unspecified other impact via unknown vectors. (CVE-2010-1643)

The sctp_process_unk_param function in net/sctp/sm_make_chunk.c in the Linux kernel 2.6.33.3 and earlier, when SCTP is enabled, allows remote attackers to cause a denial of service (system crash) via an SCTPChunkInit packet containing multiple invalid parameters that require a large amount of error data. (CVE-2010-1173)

The Transparent Inter-Process Communication (TIPC) functionality in Linux kernel 2.6.16-rc1 through 2.6.33, and possibly other versions, allows local users to cause a denial of service (kernel OOPS) by sending datagrams through AF_TIPC before entering network mode, which triggers a NULL pointer dereference. (CVE-2010-1187)

The sctp_process_unk_param function in net/sctp/sm_make_chunk.c in the Linux kernel 2.6.33.3 and earlier, when SCTP is enabled, allows remote attackers to cause a denial of service (system crash) via an SCTPChunkInit packet containing multiple invalid parameters that require a large amount of error data. (CVE-2010-1173)

fs/cifs/cifssmb.c in the CIFS implementation in the Linux kernel before 2.6.34-rc4 allows remote attackers to cause a denial of service (panic) via an SMB response packet with an invalid CountHigh value, as demonstrated by a response from an OS/2 server, related to the CIFSSMBWrite and CIFSSMBWrite2 functions. (CVE-2010-2248)

Buffer overflow in the ecryptfs_uid_hash macro in fs/ecryptfs/messaging.c in the eCryptfs subsystem in the Linux kernel before 2.6.35 might allow local users to gain privileges or cause a denial of service (system crash) via unspecified vectors.
(CVE-2010-2492)

The xfs_swapext function in fs/xfs/xfs_dfrag.c in the Linux kernel before 2.6.35 does not properly check the file descriptors passed to the SWAPEXT ioctl, which allows local users to leverage write access and obtain read access by swapping one file into another file.
(CVE-2010-2226)

The gfs2_dirent_find_space function in fs/gfs2/dir.c in the Linux kernel before 2.6.35 uses an incorrect size value in calculations associated with sentinel directory entries, which allows local users to cause a denial of service (NULL pointer dereference and panic) and possibly have unspecified other impact by renaming a file in a GFS2 filesystem, related to the gfs2_rename function in fs/gfs2/ops_inode.c. (CVE-2010-2798)

The do_anonymous_page function in mm/memory.c in the Linux kernel before 2.6.27.52, 2.6.32.x before 2.6.32.19, 2.6.34.x before 2.6.34.4, and 2.6.35.x before 2.6.35.2 does not properly separate the stack and the heap, which allows context-dependent attackers to execute arbitrary code by writing to the bottom page of a shared memory segment, as demonstrated by a memory-exhaustion attack against the X.Org X server. (CVE-2010-2240)

The drm_ioctl function in drivers/gpu/drm/drm_drv.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.27.53, 2.6.32.x before 2.6.32.21, 2.6.34.x before 2.6.34.6, and 2.6.35.x before 2.6.35.4 allows local users to obtain potentially sensitive information from kernel memory by requesting a large memory-allocation amount. (CVE-2010-2803)

Integer overflow in net/can/bcm.c in the Controller Area Network (CAN) implementation in the Linux kernel before 2.6.27.53, 2.6.32.x before 2.6.32.21, 2.6.34.x before 2.6.34.6, and 2.6.35.x before 2.6.35.4 allows attackers to execute arbitrary code or cause a denial of service (system crash) via crafted CAN traffic. (CVE-2010-2959)

Double free vulnerability in the snd_seq_oss_open function in sound/core/seq/oss/seq_oss_init.c in the Linux kernel before 2.6.36-rc4 might allow local users to cause a denial of service or possibly have unspecified other impact via an unsuccessful attempt to open the /dev/sequencer device. (CVE-2010-3080)

A vulnerability in Linux kernel caused by insecure allocation of user space memory when translating system call inputs to 64-bit. A stack pointer underflow can occur when using the compat_alloc_user_space method with an arbitrary length input. (CVE-2010-3081)

The IA32 system call emulation functionality in arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.36-rc4-git2 on the x86_64 platform does not zero extend the %eax register after the 32-bit entry path to ptrace is used, which allows local users to gain privileges by triggering an out-of-bounds access to the system call table using the %rax register. NOTE: this vulnerability exists because of a CVE-2007-4573 regression. (CVE-2010-3301)

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

Fix possible local privilege escalation on x86_64 systems (CVE-2010-3081, CVE-2010-3301).

  - NOTE: All users should update because of this bug. Fix     denial of service attack with large argument lists. Add     support for perl and python scripting to perf. Nouveau     video driver fixes :

  - fix oops in acpi edid support

    - disable acceleration on nva3/nva5/nva8

    - misc fixes from upstream + NVAF support Add support       for the eject key on the Dell Studio 1555 fix       rcu_dereference_check warning Restore appleir driver       that got lost in the 2.6.35 rebase. Fix DMA in       via-velocity network driver.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2010:0718 advisory.

  - kernel: 64-bit Compatibility Mode Stack Pointer Underflow (CVE-2010-3081)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2010-0704 advisory.

    [2.6.18-194.11.4.0.1.el5]
    - [xen] check to see if hypervisor supports memory reservation change       (Chuck Anderson) [orabug 7556514]
    - Add entropy support to igb (John Sobecki) [orabug 7607479]
    - [nfs] convert ENETUNREACH to ENOTCONN [orabug 7689332]
    - [NET] Add xen pv/bonding netconsole support (Tina Yang) [orabug 6993043]       [bz 7258]
    - [mm] shrink_zone patch (John Sobecki,Chris Mason) [orabug 6086839]
    - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042]
    - [nfsd] fix failure of file creation from hpux client (Wen gang Wang)       [orabug 7579314]
    - [qla] fix qla not to query hccr (Guru Anbalagane) [Orabug 8746702]
    - [net] bonding: fix xen+bonding+netconsole panic issue (Joe Jin) [orabug 9504524]
    - [rds] Patch rds to 1.4.2-14 (Andy Grover) [orabug 9471572, 9344105]       RDS: Fix BUG_ONs to not fire when in a tasklet       ipoib: Fix lockup of the tx queue       RDS: Do not call set_page_dirty() with irqs off (Sherman Pun)       RDS: Properly unmap when getting a remote access error (Tina Yang)       RDS: Fix locking in rds_send_drop_to()
    - [mm] Enhance shrink_zone patch allow full swap utilization, and also be       NUMA-aware (John Sobecki, Chris Mason, Herbert van den Bergh)       [orabug 9245919]
    - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson)       [orabug 9107465]
    - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson)       [orabug 9764220]
    - Support 256GB+ memory  for pv guest (Mukesh Rathor) [orabug 9450615]
    - fix overcommit memory to use percpu_counter for el5 (KOSAKI Motohiro,       Guru Anbalagane) [orabug 6124033]
    - [ipmi] make  configurable timeouts for kcs of ipmi [orabug 9752208]

    [2.6.18-194.11.4.el5]
    - [misc] make compat_alloc_user_space() incorporate the access_ok() (Don Howard) [634463 634464]     {CVE-2010-3081}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

a. vCenter Server and vCenter Update Manager update Microsoft    SQL Server 2005 Express Edition to Service Pack 3

   Microsoft SQL Server 2005 Express Edition (SQL Express)    distributed with vCenter Server 4.1 Update 1 and vCenter Update    Manager 4.1 Update 1 is upgraded from  SQL Express Service Pack 2    to SQL Express Service Pack 3, to address multiple security    issues that exist in the earlier releases of Microsoft SQL Express.

   Customers using other database solutions need not update for    these issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-5416, CVE-2008-0085, CVE-2008-0086,    CVE-2008-0107 and CVE-2008-0106 to the issues addressed in MS SQL    Express Service Pack 3.

b. vCenter Apache Tomcat Management Application Credential Disclosure

   The Apache Tomcat Manager application configuration file contains    logon credentials that can be read by unprivileged local users.

   The issue is resolved by removing the Manager application in    vCenter 4.1 Update 1.

   If vCenter 4.1 is updated to vCenter 4.1 Update 1 the logon    credentials are not present in the configuration file after the    update.

   VMware would like to thank Claudio Criscione of Secure Networking    for reporting this issue to us.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2010-2928 to this issue.

c. vCenter Server and ESX, Oracle (Sun) JRE is updated to version    1.6.0_21

   Oracle (Sun) JRE update to version 1.6.0_21, which addresses    multiple security issues that existed in earlier releases of    Oracle (Sun) JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Oracle (Sun) JRE 1.6.0_19: CVE-2009-3555, CVE-2010-0082,    CVE-2010-0084, CVE-2010-0085, CVE-2010-0087, CVE-2010-0088,    CVE-2010-0089, CVE-2010-0090, CVE-2010-0091, CVE-2010-0092,    CVE-2010-0093, CVE-2010-0094, CVE-2010-0095, CVE-2010-0837,    CVE-2010-0838, CVE-2010-0839, CVE-2010-0840, CVE-2010-0841,    CVE-2010-0842, CVE-2010-0843, CVE-2010-0844, CVE-2010-0845,    CVE-2010-0846, CVE-2010-0847, CVE-2010-0848, CVE-2010-0849,    CVE-2010-0850.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following name to the security issue fixed in    Oracle (Sun) JRE 1.6.0_20: CVE-2010-0886.

d. vCenter Update Manager Oracle (Sun) JRE is updated to version   1.5.0_26

   Oracle (Sun) JRE update to version 1.5.0_26, which addresses    multiple security issues that existed in earlier releases of    Oracle (Sun) JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Oracle (Sun) JRE 1.5.0_26: CVE-2010-3556, CVE-2010-3566,    CVE-2010-3567, CVE-2010-3550, CVE-2010-3561, CVE-2010-3573,    CVE-2010-3565,CVE-2010-3568, CVE-2010-3569,  CVE-2009-3555,    CVE-2010-1321, CVE-2010-3548, CVE-2010-3551, CVE-2010-3562,    CVE-2010-3571, CVE-2010-3554, CVE-2010-3559, CVE-2010-3572,    CVE-2010-3553, CVE-2010-3549, CVE-2010-3557, CVE-2010-3541,    CVE-2010-3574.

e. vCenter Server and ESX Apache Tomcat updated to version 6.0.28

   Apache Tomcat updated to version 6.0.28, which addresses multiple    security issues that existed in earlier releases of Apache Tomcat

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Apache Tomcat 6.0.24: CVE-2009-2693, CVE-2009-2901, CVE-2009-2902,i    and CVE-2009-3548.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Apache Tomcat 6.0.28: CVE-2010-2227, CVE-2010-1157.

f. vCenter Server third-party component OpenSSL updated to version    0.9.8n

   The version of the OpenSSL library in vCenter Server is updated to    0.9.8n.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-0740 and CVE-2010-0433 to the    issues addressed in this version of OpenSSL.

g. ESX third-party component OpenSSL updated to version 0.9.8p

   The version of the ESX OpenSSL library is updated to 0.9.8p.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-3864 and CVE-2010-2939 to the    issues addressed in this update.

h. ESXi third-party component cURL updated

   The version of cURL library in ESXi is updated.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-0734 to the issues addressed in    this update.

i. ESX third-party component pam_krb5 updated

   The version of pam_krb5 library is updated.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-3825 and CVE-2009-1384 to the    issues addressed in the update.

j. ESX third-party update for Service Console kernel

   The Service Console kernel is updated to include kernel version    2.6.18-194.11.1.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-1084, CVE-2010-2066, CVE-2010-2070,    CVE-2010-2226, CVE-2010-2248, CVE-2010-2521, CVE-2010-2524,    CVE-2010-0008, CVE-2010-0415, CVE-2010-0437, CVE-2009-4308,    CVE-2010-0003, CVE-2010-0007, CVE-2010-0307, CVE-2010-1086,    CVE-2010-0410, CVE-2010-0730, CVE-2010-1085, CVE-2010-0291,    CVE-2010-0622, CVE-2010-1087, CVE-2010-1173, CVE-2010-1437,    CVE-2010-1088, CVE-2010-1187, CVE-2010-1436, CVE-2010-1641, and    CVE-2010-3081 to the issues addressed in the update.

   Notes :
   - The update also addresses the 64-bit compatibility mode    stack pointer underflow issue identified by CVE-2010-3081. This    issue was patched in an ESX 4.1 patch prior to the release of    ESX 4.1 Update 1 and in a previous ESX 4.0 patch release.
   - The update also addresses CVE-2010-2240 for ESX 4.0.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
54887	Slackware current : 64-bit kernel (SSA:2010-265-01)	Nessus	Slackware Local Security Checks	2011/5/28	2021/1/14	high
60893	Scientific Linux Security Update : kernel on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2023/5/14	high
63954	RHEL 5 : kernel (RHSA-2010:0711)	Nessus	Red Hat Local Security Checks	2013/1/24	2021/1/14	high
63955	RHEL 4 : kernel (RHSA-2010:0719)	Nessus	Red Hat Local Security Checks	2013/1/24	2021/1/14	high
49297	Fedora 13 : kernel-2.6.34.7-56.fc13 (2010-14890)	Nessus	Fedora Local Security Checks	2010/9/21	2021/1/11	high
49713	CentOS 4 : kernel (CESA-2010:0718)	Nessus	CentOS Local Security Checks	2010/10/6	2021/1/4	high
60859	Scientific Linux Security Update : kernel on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
63953	RHEL 5 : kernel (RHSA-2010:0705)	Nessus	Red Hat Local Security Checks	2013/1/24	2021/1/14	high
49276	Debian DSA-2110-1 : linux-2.6 - privilege escalation/denial of service/information leak	Nessus	Debian Local Security Checks	2010/9/20	2021/1/4	high
51612	SuSE 11.1 Security Update : Linux kernel (SAT Patch Numbers 3276 / 3280 / 3284)	Nessus	SuSE Local Security Checks	2011/1/21	2021/1/14	high
68177	Oracle Linux 6 : kernel (ELSA-2011-0007)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2026/2/9	high
49666	Mandriva Linux Security Advisory : kernel (MDVSA-2010:188)	Nessus	Mandriva Local Security Checks	2010/9/24	2021/1/6	critical
49635	Fedora 14 : kernel-2.6.35.4-28.fc14 (2010-14832)	Nessus	Fedora Local Security Checks	2010/9/22	2021/1/11	high
49744	RHEL 4 : kernel (RHSA-2010:0718)	Nessus	Red Hat Local Security Checks	2010/10/6	2024/4/21	high
68103	Oracle Linux 5 : kernel (ELSA-2010-0704)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2026/2/9	high
51971	VMSA-2011-0003 : Third-party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX	Nessus	VMware ESX Local Security Checks	2011/2/14	2022/5/25	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

critical

high

high

high

high