ID de Prueba:	1.3.6.1.4.1.25623.1.0.120248
Categoría:	Amazon Linux Local Security Checks
Título:	Amazon Linux: Security Advisory (ALAS-2014-392)
Resumen:	The remote host is missing an update for the 'kernel' package(s) announced via the ALAS-2014-392 advisory.
Descripción:	Summary: The remote host is missing an update for the 'kernel' package(s) announced via the ALAS-2014-392 advisory. Vulnerability Insight: The media_device_enum_entities function in drivers/media/media-device.c in the Linux kernel before 3.14.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory by leveraging /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call. A flaw was found in the way the Linux kernel's futex subsystem handled the requeuing of certain Priority Inheritance (PI) futexes. A local, unprivileged user could use this flaw to escalate their privileges on the system. The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the 'LECHO & !OPOST' case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings. Affected Software/OS: 'kernel' package(s) on Amazon Linux. Solution: Please install the updated package(s). CVSS Score: 7.2 CVSS Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2014-0196 106646 http://www.osvdb.org/106646 33516 http://www.exploit-db.com/exploits/33516 59218 http://secunia.com/advisories/59218 59262 http://secunia.com/advisories/59262 59599 http://secunia.com/advisories/59599 DSA-2926 http://www.debian.org/security/2014/dsa-2926 DSA-2928 http://www.debian.org/security/2014/dsa-2928 RHSA-2014:0512 http://rhn.redhat.com/errata/RHSA-2014-0512.html SUSE-SU-2014:0667 http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00007.html SUSE-SU-2014:0683 http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00012.html USN-2196-1 http://www.ubuntu.com/usn/USN-2196-1 USN-2197-1 http://www.ubuntu.com/usn/USN-2197-1 USN-2198-1 http://www.ubuntu.com/usn/USN-2198-1 USN-2199-1 http://www.ubuntu.com/usn/USN-2199-1 USN-2200-1 http://www.ubuntu.com/usn/USN-2200-1 USN-2201-1 http://www.ubuntu.com/usn/USN-2201-1 USN-2202-1 http://www.ubuntu.com/usn/USN-2202-1 USN-2203-1 http://www.ubuntu.com/usn/USN-2203-1 USN-2204-1 http://www.ubuntu.com/usn/USN-2204-1 [oss-security] 20140429 CVE-2014-0196: Linux kernel pty layer race condition memory corruption http://www.openwall.com/lists/oss-security/2014/05/05/6 http://bugzilla.novell.com/show_bug.cgi?id=875690 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=4291086b1f081b869c6d79e5b7441633dc3ace00 http://linux.oracle.com/errata/ELSA-2014-0771.html http://pastebin.com/raw.php?i=yTSFUBgZ http://source.android.com/security/bulletin/2016-07-01.html http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15319.html https://bugzilla.redhat.com/show_bug.cgi?id=1094232 https://github.com/torvalds/linux/commit/4291086b1f081b869c6d79e5b7441633dc3ace00 Common Vulnerability Exposure (CVE) ID: CVE-2014-1739 BugTraq ID: 68048 http://www.securityfocus.com/bid/68048 http://speirofr.appspot.com/cve-2014-1739-kernel-infoleak-vulnerability-in-media_enum_entities.html http://www.openwall.com/lists/oss-security/2014/06/15/1 http://www.securitytracker.com/id/1038201 http://secunia.com/advisories/59597 SuSE Security Announcement: SUSE-SU-2014:1316 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html SuSE Security Announcement: SUSE-SU-2014:1319 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html http://www.ubuntu.com/usn/USN-2259-1 http://www.ubuntu.com/usn/USN-2261-1 http://www.ubuntu.com/usn/USN-2263-1 http://www.ubuntu.com/usn/USN-2264-1 Common Vulnerability Exposure (CVE) ID: CVE-2014-3153 BugTraq ID: 67906 http://www.securityfocus.com/bid/67906 Debian Security Information: DSA-2949 (Google Search) http://www.debian.org/security/2014/dsa-2949 http://www.exploit-db.com/exploits/35370 https://elongl.github.io/exploitation/2021/01/08/cve-2014-3153.html https://github.com/elongl/CVE-2014-3153 https://www.openwall.com/lists/oss-security/2021/02/01/4 http://www.openwall.com/lists/oss-security/2014/06/05/22 http://openwall.com/lists/oss-security/2014/06/05/24 http://openwall.com/lists/oss-security/2014/06/06/20 http://www.openwall.com/lists/oss-security/2021/02/01/4 RedHat Security Advisories: RHSA-2014:0800 http://rhn.redhat.com/errata/RHSA-2014-0800.html http://www.securitytracker.com/id/1030451 http://secunia.com/advisories/58500 http://secunia.com/advisories/58990 http://secunia.com/advisories/59029 http://secunia.com/advisories/59092 http://secunia.com/advisories/59153 http://secunia.com/advisories/59309 http://secunia.com/advisories/59386 SuSE Security Announcement: SUSE-SU-2014:0775 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00014.html SuSE Security Announcement: SUSE-SU-2014:0796 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00018.html SuSE Security Announcement: SUSE-SU-2014:0837 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00025.html SuSE Security Announcement: openSUSE-SU-2014:0878 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00006.html http://www.ubuntu.com/usn/USN-2237-1 http://www.ubuntu.com/usn/USN-2240-1
Copyright	Copyright (C) 2015 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.