Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.68717
Category:Red Hat Local Security Checks
Title:RedHat Security Advisory RHSA-2011:0017
Summary:NOSUMMARY
Description:Description:
The remote host is missing updates announced in
advisory RHSA-2011:0017.

The kernel packages contain the Linux kernel, the core of any Linux
operating system.

This update fixes the following security issues:

* A NULL pointer dereference flaw was found in the igb driver in the Linux
kernel. If both the Single Root I/O Virtualization (SR-IOV) feature and
promiscuous mode were enabled on an interface using igb, it could result in
a denial of service when a tagged VLAN packet is received on that
interface. (CVE-2010-4263, Important)

* A missing sanity check was found in vbd_create() in the Xen hypervisor
implementation. As CD-ROM drives are not supported by the blkback back-end
driver, attempting to use a virtual CD-ROM drive with blkback could trigger
a denial of service (crash) on the host system running the Xen hypervisor.
(CVE-2010-4238, Moderate)

* A flaw was found in the Linux kernel execve() system call implementation.
A local, unprivileged user could cause large amounts of memory to be
allocated but not visible to the OOM (Out of Memory) killer, triggering a
denial of service. (CVE-2010-4243, Moderate)

* A flaw was found in fixup_page_fault() in the Xen hypervisor
implementation. If a 64-bit para-virtualized guest accessed a certain area
of memory, it could cause a denial of service on the host system running
the Xen hypervisor. (CVE-2010-4255, Moderate)

* A missing initialization flaw was found in the bfa driver used by Brocade
Fibre Channel Host Bus Adapters. A local, unprivileged user could use this
flaw to cause a denial of service by reading a file in the
/sys/class/fc_host/host#/statistics/ directory. (CVE-2010-4343, Moderate)

* Missing initialization flaws in the Linux kernel could lead to
information leaks. (CVE-2010-3296, CVE-2010-3877, CVE-2010-4072,
CVE-2010-4073, CVE-2010-4075, CVE-2010-4080, CVE-2010-4081, CVE-2010-4158,
Low)

Red Hat would like to thank Kosuke Tatsukawa for reporting CVE-2010-4263

Vladymyr Denysov for reporting CVE-2010-4238
Brad Spengler for reporting
CVE-2010-4243
Dan Rosenberg for reporting CVE-2010-3296, CVE-2010-4073,
CVE-2010-4075, CVE-2010-4080, CVE-2010-4081, and CVE-2010-4158
Vasiliy
Kulikov for reporting CVE-2010-3877
and Kees Cook for reporting
CVE-2010-4072.

These updated packages also include several hundred bug fixes for and
enhancements to the Linux kernel. Space precludes documenting each of these
changes in this advisory and users are directed to the Red Hat Enterprise
Linux 5.6 Release Notes for information on the most significant of these
changes:

http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/5.6_Release_Notes/index.html

Refer to the kernel chapter in the Red Hat Enterprise Linux 5.6 Technical
Notes for further information:

http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/5.6_Technical_Notes/kernel.html

All Red Hat Enterprise Linux 5 users are advised to install these updated
packages, which address these vulnerabilities as well as fixing the bugs
and adding the enhancements noted in the Red Hat Enterprise Linux 5.6
Release Notes and Technical Notes. The system must be rebooted for this
update to take effect.

Solution:
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date

http://rhn.redhat.com/errata/RHSA-2011-0017.html
http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/5.6_Release_Notes/index.html
http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/5.6_Technical_Notes/kernel.html

Risk factor : High

CVSS Score:
7.1

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2010-3296
BugTraq ID: 43221
http://www.securityfocus.com/bid/43221
Bugtraq: 20111013 VMSA-2011-0012 VMware ESXi and ESX updates to third party libraries and ESX Service Console (Google Search)
http://www.securityfocus.com/archive/1/520102/100/0/threaded
Debian Security Information: DSA-2126 (Google Search)
http://www.debian.org/security/2010/dsa-2126
http://lkml.org/lkml/2010/9/11/170
http://www.openwall.com/lists/oss-security/2010/09/14/2
http://www.openwall.com/lists/oss-security/2010/09/14/7
http://www.redhat.com/support/errata/RHSA-2011-0017.html
http://secunia.com/advisories/41440
http://secunia.com/advisories/42758
http://secunia.com/advisories/42884
http://secunia.com/advisories/46397
SuSE Security Announcement: SUSE-SA:2010:050 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00003.html
SuSE Security Announcement: SUSE-SA:2010:054 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00000.html
SuSE Security Announcement: SUSE-SA:2011:007 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html
http://www.ubuntu.com/usn/USN-1041-1
http://www.vupen.com/english/advisories/2011/0070
http://www.vupen.com/english/advisories/2011/0298
Common Vulnerability Exposure (CVE) ID: CVE-2010-3877
BugTraq ID: 44630
http://www.securityfocus.com/bid/44630
http://www.mandriva.com/security/advisories?name=MDVSA-2011:029
http://marc.info/?l=linux-netdev&m=128854507420917&w=2
http://openwall.com/lists/oss-security/2010/11/02/7
http://openwall.com/lists/oss-security/2010/11/04/5
XForce ISS Database: kernel-getname-info-disc(64578)
https://exchange.xforce.ibmcloud.com/vulnerabilities/64578
Common Vulnerability Exposure (CVE) ID: CVE-2010-4072
BugTraq ID: 45054
http://www.securityfocus.com/bid/45054
http://www.mandriva.com/security/advisories?name=MDVSA-2011:051
http://lkml.org/lkml/2010/10/6/454
http://www.openwall.com/lists/oss-security/2010/10/07/1
http://www.openwall.com/lists/oss-security/2010/10/25/3
http://www.redhat.com/support/errata/RHSA-2010-0958.html
http://www.redhat.com/support/errata/RHSA-2011-0007.html
http://www.redhat.com/support/errata/RHSA-2011-0162.html
http://secunia.com/advisories/42778
http://secunia.com/advisories/42890
http://secunia.com/advisories/42932
http://secunia.com/advisories/42963
http://secunia.com/advisories/43161
http://secunia.com/advisories/43291
SuSE Security Announcement: SUSE-SA:2010:060 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00004.html
SuSE Security Announcement: SUSE-SA:2011:001 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00000.html
SuSE Security Announcement: SUSE-SA:2011:004 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00004.html
SuSE Security Announcement: SUSE-SA:2011:008 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00002.html
http://www.ubuntu.com/usn/USN-1057-1
http://www.vupen.com/english/advisories/2011/0012
http://www.vupen.com/english/advisories/2011/0124
http://www.vupen.com/english/advisories/2011/0168
http://www.vupen.com/english/advisories/2011/0280
http://www.vupen.com/english/advisories/2011/0375
Common Vulnerability Exposure (CVE) ID: CVE-2010-4073
BugTraq ID: 45073
http://www.securityfocus.com/bid/45073
http://lkml.org/lkml/2010/10/6/492
http://securityreason.com/securityalert/8366
Common Vulnerability Exposure (CVE) ID: CVE-2010-4075
BugTraq ID: 43806
http://www.securityfocus.com/bid/43806
http://lkml.indiana.edu/hypermail//linux/kernel/1009.1/03388.html
http://www.openwall.com/lists/oss-security/2010/09/25/2
http://www.openwall.com/lists/oss-security/2010/10/06/6
Common Vulnerability Exposure (CVE) ID: CVE-2010-4080
BugTraq ID: 45058
http://www.securityfocus.com/bid/45058
BugTraq ID: 45063
http://www.securityfocus.com/bid/45063
http://lkml.org/lkml/2010/9/25/41
http://secunia.com/advisories/42801
SuSE Security Announcement: SUSE-SA:2011:002 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00001.html
Common Vulnerability Exposure (CVE) ID: CVE-2010-4081
Common Vulnerability Exposure (CVE) ID: CVE-2010-4158
BugTraq ID: 44758
http://www.securityfocus.com/bid/44758
Bugtraq: 20101109 Kernel 0-day (Google Search)
http://www.securityfocus.com/archive/1/514705
Bugtraq: 20101118 Re: Kernel 0-day (Google Search)
http://www.securityfocus.com/archive/1/514845
http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052513.html
http://lists.grok.org.uk/pipermail/full-disclosure/2010-November/077321.html
http://www.spinics.net/lists/netdev/msg146361.html
http://secunia.com/advisories/42745
http://www.vupen.com/english/advisories/2010/3321
Common Vulnerability Exposure (CVE) ID: CVE-2010-4238
BugTraq ID: 45795
http://www.securityfocus.com/bid/45795
http://bugs.centos.org/bug_view_advanced_page.php?bug_id=4517
XForce ISS Database: xen-vdbcreate-dos(64698)
https://exchange.xforce.ibmcloud.com/vulnerabilities/64698
Common Vulnerability Exposure (CVE) ID: CVE-2010-4243
BugTraq ID: 45004
http://www.securityfocus.com/bid/45004
http://www.exploit-db.com/exploits/15619
http://grsecurity.net/~spender/64bit_dos.c
http://lkml.org/lkml/2010/8/27/429
http://lkml.org/lkml/2010/8/29/206
http://lkml.org/lkml/2010/8/30/138
http://lkml.org/lkml/2010/8/30/378
http://linux.derkeiler.com/Mailing-Lists/Kernel/2010-11/msg13278.html
http://openwall.com/lists/oss-security/2010/11/22/6
http://openwall.com/lists/oss-security/2010/11/22/15
XForce ISS Database: linux-kernel-execve-dos(64700)
https://exchange.xforce.ibmcloud.com/vulnerabilities/64700
Common Vulnerability Exposure (CVE) ID: CVE-2010-4255
http://openwall.com/lists/oss-security/2010/11/30/5
http://openwall.com/lists/oss-security/2010/11/30/8
http://lists.xensource.com/archives/html/xen-devel/2010-11/msg01650.html
Common Vulnerability Exposure (CVE) ID: CVE-2010-4263
BugTraq ID: 45208
http://www.securityfocus.com/bid/45208
http://openwall.com/lists/oss-security/2010/12/06/3
http://openwall.com/lists/oss-security/2010/12/06/9
Common Vulnerability Exposure (CVE) ID: CVE-2010-4343
BugTraq ID: 45262
http://www.securityfocus.com/bid/45262
http://www.spinics.net/lists/linux-scsi/msg43772.html
http://www.openwall.com/lists/oss-security/2010/12/08/3
http://www.openwall.com/lists/oss-security/2010/12/09/15
Common Vulnerability Exposure (CVE) ID: CVE-2010-4258
http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0086.html
http://blog.nelhage.com/2010/12/cve-2010-4258-from-dos-to-privesc/
https://lkml.org/lkml/2010/12/1/543
http://marc.info/?l=linux-kernel&m=129117048916957&w=2
http://openwall.com/lists/oss-security/2010/12/02/2
http://openwall.com/lists/oss-security/2010/12/02/7
http://openwall.com/lists/oss-security/2010/12/02/4
http://openwall.com/lists/oss-security/2010/12/02/3
http://openwall.com/lists/oss-security/2010/12/08/4
http://openwall.com/lists/oss-security/2010/12/08/5
http://openwall.com/lists/oss-security/2010/12/08/9
http://openwall.com/lists/oss-security/2010/12/09/14
http://openwall.com/lists/oss-security/2010/12/09/4
http://secunia.com/advisories/43056
SuSE Security Announcement: SUSE-SA:2011:005 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00007.html
http://www.vupen.com/english/advisories/2011/0213
CopyrightCopyright (c) 2011 E-Soft Inc. http://www.securityspace.com

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2022 E-Soft Inc. All rights reserved.