The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0125 advisory.

  - glibc: __tzfile_read integer overflow to buffer overflow (CVE-2009-5029)

  - glibc: ldd unexpected code execution issue (CVE-2009-5064)

  - glibc: Improper encoding of names with certain special character in utilities for writing to mtab table     (CVE-2010-0296)

  - glibc: ld.so d_tag signedness error in elf_get_dynamic_info (CVE-2010-0830)

  - glibc: fnmatch() alloca()-based memory corruption flaw (CVE-2011-1071, CVE-2011-1659)

  - glibc: Suid mount helpers fail to anticipate RLIMIT_FSIZE (CVE-2011-1089)

  - glibc: insufficient quoting in the locale command output (CVE-2011-1095)

  - glibc: svc_run() produces high cpu usage when accept() fails with EMFILE error (CVE-2011-4609)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0413 advisory.

    - Avoid too much stack use in fnmatch (#681054, CVE-2011-1071)
    - Properly quote output of locale (#625893, CVE-2011-1095)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201312-01 (GNU C Library: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in GNU C Library. Please       review the CVE identifiers referenced below for details.
  Impact :

    A local attacker could trigger vulnerabilities in dynamic library       loader, making it possible to load attacker-controlled shared objects       during execution of setuid/setgid programs to escalate privileges.
    A context-dependent attacker could trigger various vulnerabilities in       GNU C Library, including a buffer overflow, leading to execution of       arbitrary code or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

a. Service Console update for DHCP

    The DHCP client daemon, dhclient, does not properly sanatize     certain options in DHCP server replies. An attacker could send a     specially crafted DHCP server reply, that is saved on     the client system and evaluated by a process that assumes the     option is trusted. This could lead to arbitrary code execution     with the privileges of the evaluating process.

    The Common Vulnerabilities and Exposures project (cve.mitre.org)     has assigned the name CVE-2011-0997 to this issue.

b. Service Console update for glibc

    This patch updates the glibc package for ESX service console to     glibc-2.5-58.7602.vmw. This fixes multiple security issues in     glibc, glibc-common and nscd including possible local privilege     escalation.
     The Common Vulnerabilities and Exposures project (cve.mitre.org)     has assigned the identifiers CVE-2010-0296, CVE-2011-0536,     CVE-2011-1095, CVE-2011-1071, CVE-2011-1658 and CVE-2011-1659 to     these issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
57928	RHEL 4 : glibc (RHSA-2012:0125)	Nessus	Red Hat Local Security Checks	2012/2/14	2024/4/27	high
68245	Oracle Linux 6 : glibc (ELSA-2011-0413)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2025/4/29	high
71167	GLSA-201312-01 : GNU C Library: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2013/12/3	2021/1/6	medium
55747	VMSA-2011-0010 : VMware ESX third-party updates for Service Console packages glibc and dhcp	Nessus	VMware ESX Local Security Checks	2011/8/1	2021/1/6	high

检测

插件搜索

high

high

medium

high