This update fixes the following security issues :

  - A flaw was found in sctp_packet_config() in the Linux     kernel's Stream Control Transmission Protocol (SCTP)     implementation. A remote attacker could use this flaw to     cause a denial of service. (CVE-2010-3432, Important)

  - A missing integer overflow check was found in     snd_ctl_new() in the Linux kernel's sound subsystem. A     local, unprivileged user on a 32-bit system could use     this flaw to cause a denial of service or escalate their     privileges. (CVE-2010-3442, Important)

  - A heap overflow flaw in the Linux kernel's Transparent     Inter-Process Communication protocol (TIPC)     implementation could allow a local, unprivileged user to     escalate their privileges. (CVE-2010-3859, Important)

  - An integer overflow flaw was found in the Linux kernel's     Reliable Datagram Sockets (RDS) protocol implementation.
    A local, unprivileged user could use this flaw to cause     a denial of service or escalate their privileges.
    (CVE-2010-3865, Important)

  - A flaw was found in the Xenbus code for the unified     block-device I/O interface back end. A privileged guest     user could use this flaw to cause a denial of service on     the host system running the Xen hypervisor.
    (CVE-2010-3699, Moderate)

  - Missing sanity checks were found in setup_arg_pages() in     the Linux kernel. When making the size of the argument     and environment area on the stack very large, it could     trigger a BUG_ON(), resulting in a local denial of     service. (CVE-2010-3858, Moderate)

  - A flaw was found in inet_csk_diag_dump() in the Linux     kernel's module for monitoring the sockets of INET     transport protocols. By sending a netlink message with     certain bytecode, a local, unprivileged user could cause     a denial of service. (CVE-2010-3880, Moderate)

  - Missing sanity checks were found in gdth_ioctl_alloc()     in the gdth driver in the Linux kernel. A local user     with access to '/dev/gdth' on a 64-bit system could use     this flaw to cause a denial of service or escalate their     privileges. (CVE-2010-4157, Moderate)

  - The fix put into kernel-2.6.18-164.el5 introduced a     regression. A local, unprivileged user could use this     flaw to cause a denial of service. (CVE-2010-4161,     Moderate)

  - A NULL pointer dereference flaw was found in the     Bluetooth HCI UART driver in the Linux kernel. A local,     unprivileged user could use this flaw to cause a denial     of service. (CVE-2010-4242, Moderate)

  - It was found that a malicious guest running on the Xen     hypervisor could place invalid data in the memory that     the guest shared with the blkback and blktap back-end     drivers, resulting in a denial of service on the host     system. (CVE-2010-4247, Moderate)

  - A flaw was found in the Linux kernel's CPU time clocks     implementation for the POSIX clock interface. A local,     unprivileged user could use this flaw to cause a denial     of service. (CVE-2010-4248, Moderate)

  - Missing initialization flaws in the Linux kernel could     lead to information leaks. (CVE-2010-3876,     CVE-2010-4083, Low)

This update also fixes several bugs and adds an enhancement.

The system must be rebooted for this update to take effect.

From Red Hat Security Advisory 2011:0162 :

Updated kernel packages that fix multiple security issues and two bugs are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* A heap overflow flaw was found in the Linux kernel's Transparent Inter-Process Communication protocol (TIPC) implementation. A local, unprivileged user could use this flaw to escalate their privileges.
(CVE-2010-3859, Important)

* Missing sanity checks were found in gdth_ioctl_alloc() in the gdth driver in the Linux kernel. A local user with access to '/dev/gdth' on a 64-bit system could use these flaws to cause a denial of service or escalate their privileges. (CVE-2010-4157, Moderate)

* A NULL pointer dereference flaw was found in the Bluetooth HCI UART driver in the Linux kernel. A local, unprivileged user could use this flaw to cause a denial of service. (CVE-2010-4242, Moderate)

* A flaw was found in the Linux kernel's garbage collector for AF_UNIX sockets. A local, unprivileged user could use this flaw to trigger a denial of service (out-of-memory condition). (CVE-2010-4249, Moderate)

* Missing initialization flaws were found in the Linux kernel. A local, unprivileged user could use these flaws to cause information leaks. (CVE-2010-3876, CVE-2010-4072, CVE-2010-4073, CVE-2010-4075, CVE-2010-4080, CVE-2010-4083, CVE-2010-4158, Low)

Red Hat would like to thank Alan Cox for reporting CVE-2010-4242;
Vegard Nossum for reporting CVE-2010-4249; Vasiliy Kulikov for reporting CVE-2010-3876; Kees Cook for reporting CVE-2010-4072; and Dan Rosenberg for reporting CVE-2010-4073, CVE-2010-4075, CVE-2010-4080, CVE-2010-4083, and CVE-2010-4158.

This update also fixes the following bugs :

* A flaw was found in the Linux kernel where, if used in conjunction with another flaw that can result in a kernel Oops, could possibly lead to privilege escalation. It does not affect Red Hat Enterprise Linux 4 as the sysctl panic_on_oops variable is turned on by default.
However, as a preventive measure if the variable is turned off by an administrator, this update addresses the issue. Red Hat would like to thank Nelson Elhage for reporting this vulnerability. (BZ#659568)

* On Intel I/O Controller Hub 9 (ICH9) hardware, jumbo frame support is achieved by using page-based sk_buff buffers without any packet split. The entire frame data is copied to the page(s) rather than some to the skb->data area and some to the page(s) when performing a typical packet-split. This caused problems with the filtering code and frames were getting dropped before they were received by listening applications. This bug could eventually lead to the IP address being released and not being able to be re-acquired from DHCP if the MTU (Maximum Transfer Unit) was changed (for an affected interface using the e1000e driver). With this update, frames are no longer dropped and an IP address is correctly re-acquired after a previous release.
(BZ#664667)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities in several third-party components and libraries :

  - Kernel
  - krb5
  - glibc
  - mtp2sas
  - mptsas
  - mptspi

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0007 advisory.

    * Buffer overflow in eCryptfs. When /dev/ecryptfs has world writable     permissions (which it does not, by default, on Red Hat Enterprise Linux 6),     a local, unprivileged user could use this flaw to cause a denial of service     or possibly escalate their privileges. (CVE-2010-2492, Important)

    * Integer overflow in the RDS protocol implementation could allow a local,     unprivileged user to cause a denial of service or escalate their     privileges. (CVE-2010-3865, Important)

    * Missing boundary checks in the PPP over L2TP sockets implementation could     allow a local, unprivileged user to cause a denial of service or escalate     their privileges. (CVE-2010-4160, Important)

    * NULL pointer dereference in the igb driver. If both Single Root I/O     Virtualization (SR-IOV) and promiscuous mode were enabled on an interface     using igb, it could result in a denial of service when a tagged VLAN packet     is received on that interface. (CVE-2010-4263, Important)

    * Missing initialization flaw in the XFS file system implementation, and in     the network traffic policing implementation, could allow a local,     unprivileged user to cause an information leak. (CVE-2010-3078,     CVE-2010-3477, Moderate)

    * NULL pointer dereference in the Open Sound System compatible sequencer     driver could allow a local, unprivileged user with access to /dev/sequencer     to cause a denial of service. /dev/sequencer is only accessible to root and     users in the audio group by default. (CVE-2010-3080, Moderate)

    * Flaw in the ethtool IOCTL handler could allow a local user to cause an     information leak. (CVE-2010-3861, Moderate)

    * Flaw in bcm_connect() in the Controller Area Network (CAN) Broadcast     Manager. On 64-bit systems, writing the socket address may overflow the     procname character array. (CVE-2010-3874, Moderate)

    * Flaw in the module for monitoring the sockets of INET transport     protocols could allow a local, unprivileged user to cause a denial of     service. (CVE-2010-3880, Moderate)

    * Missing boundary checks in the block layer implementation could allow a     local, unprivileged user to cause a denial of service. (CVE-2010-4162,     CVE-2010-4163, CVE-2010-4668, Moderate)

    * NULL pointer dereference in the Bluetooth HCI UART driver could allow a     local, unprivileged user to cause a denial of service. (CVE-2010-4242,     Moderate)

    * Flaw in the Linux kernel CPU time clocks implementation for the POSIX     clock interface could allow a local, unprivileged user to cause a denial of     service. (CVE-2010-4248, Moderate)

    * Flaw in the garbage collector for AF_UNIX sockets could allow a local,     unprivileged user to trigger a denial of service. (CVE-2010-4249, Moderate)

    * Missing upper bound integer check in the AIO implementation could allow a     local, unprivileged user to cause an information leak. (CVE-2010-3067, Low)

    * Missing initialization flaws could lead to information leaks.
    (CVE-2010-3298, CVE-2010-3876, CVE-2010-4072, CVE-2010-4073, CVE-2010-4074,     CVE-2010-4075, CVE-2010-4077, CVE-2010-4079, CVE-2010-4080, CVE-2010-4081,     CVE-2010-4082, CVE-2010-4083, CVE-2010-4158, Low)

    * Missing initialization flaw in KVM could allow a privileged host user     with access to /dev/kvm to cause an information leak. (CVE-2010-4525, Low)

    Red Hat would like to thank Andre Osterhues for reporting CVE-2010-2492;
    Thomas Pollet for reporting CVE-2010-3865; Dan Rosenberg for reporting     CVE-2010-4160, CVE-2010-3078, CVE-2010-3874, CVE-2010-4162, CVE-2010-4163,     CVE-2010-3298, CVE-2010-4073, CVE-2010-4074, CVE-2010-4075, CVE-2010-4077,     CVE-2010-4079, CVE-2010-4080, CVE-2010-4081, CVE-2010-4082, CVE-2010-4083,     and CVE-2010-4158; Kosuke Tatsukawa for reporting CVE-2010-4263; Tavis     Ormandy for reporting CVE-2010-3080 and CVE-2010-3067; Kees Cook for     reporting CVE-2010-3861 and CVE-2010-4072; Nelson Elhage for reporting     CVE-2010-3880; Alan Cox for reporting CVE-2010-4242; Vegard Nossum for     reporting CVE-2010-4249; Vasiliy Kulikov for reporting CVE-2010-3876; and     Stephan Mueller of atsec information security for reporting CVE-2010-4525.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
60929	Scientific Linux Security Update : kernel on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
68182	Oracle Linux 4 : kernel (ELSA-2011-0162)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/8/24	medium
89680	VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0012) (remote check)	Nessus	Misc.	2016/3/4	2023/5/14	high
51500	RHEL 6 : kernel (RHSA-2011:0007)	Nessus	Red Hat Local Security Checks	2011/1/12	2025/4/14	high

检测

插件搜索

high

medium

high

high