Vulnerabilities > CVE-2007-4571 - Unspecified vulnerability in Linux Kernel

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The text description of this plugin is (C) Novell, Inc.
#

if (NASL_LEVEL < 3000) exit(0);

include("compat.inc");

if (description)
{
  script_id(59124);
  script_version("1.3");
  script_cvs_date("Date: 2019/10/25 13:36:30");

  script_cve_id("CVE-2007-4571", "CVE-2007-4573");

  script_name(english:"SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 4472)");
  script_summary(english:"Checks rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote SuSE 10 host is missing a security-related patch."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This kernel update fixes the following security problems :

  - It was possible for local user to become root by
    exploiting a bug in the IA32 system call emulation. This
    affects x86_64 platforms with kernel 2.4.x and 2.6.x
    before 2.6.22.7 only. (CVE-2007-4573)

  - An information disclosure vulnerability in the ALSA
    driver can be exploited by local users to read sensitive
    data from the kernel memory. (CVE-2007-4571)

and the following non security bugs :

  - patches.xen/xen-blkback-cdrom: CDROM removable
    media-present attribute plus handling code [#159907]

  - patches.drivers/libata-add-pata_dma-kernel-parameter:
    libata: Add a drivers/ide style DMA disable [#229260]
    [#272786]

  - patches.drivers/libata-sata_via-kill-SATA_PATA_SHARING:
    sata_via: kill SATA_PATA_SHARING register handling
    [#254158] [#309069]

  - patches.drivers/libata-sata_via-add-PCI-IDs: sata_via:
    add PCI IDs [#254158] [#326647]

  - supported.conf: Marked 8250 and 8250_pci as supported
    (only Xen kernels build them as modules) [#260686]

  - patches.fixes/bridge-module-get-put.patch: Module use
    count must be updated as bridges are created/destroyed
    [#267651]

  - patches.fixes/iscsi-netware-fix: Linux Initiator hard
    hangs writing files to NetWare target [#286566]

  - patches.fixes/lockd-chroot-fix: Allow lockd to work
    reliably with applications in a chroot [#288376]
    [#305480]

  - add patches.fixes/x86_64-hangcheck_timer-fix.patch fix
    monotonic_clock() and hangcheck_timer [#291633]

  - patches.arch/sn_hwperf_cpuinfo_fix.diff: Correctly count
    CPU objects for SGI ia64/sn hwperf interface [#292240]

  - Extend reiserfs to properly support file systems up to
    16 TiB [#294754]

  - patches.fixes/reiserfs-signedness-fixes.diff: reiserfs:
    fix usage of signed ints for block numbers

  - patches.fixes/reiserfs-fix-large-fs.diff: reiserfs:
    ignore s_bmap_nr on disk for file systems >= 8 TiB

  - patches.suse/ocfs2-06-per-resource-events.diff: Deliver
    events without a specified resource unconditionally.
    [#296606]

  - patches.fixes/proc-readdir-race-fix.patch: Fix the race
    in proc_pid_readdir [#297232]

  - patches.xen/xen3-patch-2.6.16.49-50: XEN: update to
    Linux 2.6.16.50 [#298719]

  - patches.fixes/pm-ordering-fix.patch: PM: Fix ACPI
    suspend / device suspend ordering [#302207]

  - patches.drivers/ibmvscsi-slave_configure.patch add

    ->slave_configure() to allow device restart [#304138]

  - patches.arch/ppc-power6-ebus-unique_location.patch
    Prevent bus_id collisions [#306482]

  - patches.xen/30-bit-field-booleans.patch: Fix packet loss
    in DomU xen netback driver [#306896]

  - config/i386/kdump: Enable ahci module [#308556]

  - update patches.drivers/ppc-power6-ehea.patch fix link
    state detection for bonding [#309553]

  - patches.drivers/ibmveth-fixup-pool_deactivate.patch
    patches.drivers/ibmveth-large-frames.patch
    patches.drivers/ibmveth-large-mtu.patch: fix serveral
    crashes when changing ibmveth sysfs values [#326164]

  -
    patches.drivers/libata-sata_sil24-fix-IRQ-clearing-race-
    on-I RQ_WOC: sata_sil24: fix IRQ clearing race when
    PCIX_IRQ_WOC is used [#327536]

  - update patches.drivers/ibmvscsis.patch set blocksize to
    PAGE_CACHE_SIZE to fix flood of bio allocation
    warnings/failures [#328219]"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2007-4571.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2007-4573.html"
  );
  script_set_attribute(attribute:"solution", value:"Apply ZYPP patch number 4472.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_cwe_id(264);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:suse:suse_linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2007/10/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2012/05/17");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2012-2019 Tenable Network Security, Inc.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) exit(0, "Local checks are not enabled.");
if (!get_kb_item("Host/SuSE/release")) exit(0, "The host is not running SuSE.");
if (!get_kb_item("Host/SuSE/rpm-list")) exit(1, "Could not obtain the list of installed packages.");

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) exit(1, "Failed to determine the architecture type.");
if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") exit(1, "Local checks for SuSE 10 on the '"+cpu+"' architecture have not been implemented.");


flag = 0;
if (rpm_check(release:"SLED10", sp:1, cpu:"x86_64", reference:"kernel-default-2.6.16.53-0.16")) flag++;
if (rpm_check(release:"SLED10", sp:1, cpu:"x86_64", reference:"kernel-smp-2.6.16.53-0.16")) flag++;
if (rpm_check(release:"SLED10", sp:1, cpu:"x86_64", reference:"kernel-source-2.6.16.53-0.16")) flag++;
if (rpm_check(release:"SLED10", sp:1, cpu:"x86_64", reference:"kernel-syms-2.6.16.53-0.16")) flag++;
if (rpm_check(release:"SLED10", sp:1, cpu:"x86_64", reference:"kernel-xen-2.6.16.53-0.16")) flag++;
if (rpm_check(release:"SLES10", sp:1, cpu:"x86_64", reference:"kernel-debug-2.6.16.53-0.16")) flag++;
if (rpm_check(release:"SLES10", sp:1, cpu:"x86_64", reference:"kernel-default-2.6.16.53-0.16")) flag++;
if (rpm_check(release:"SLES10", sp:1, cpu:"x86_64", reference:"kernel-kdump-2.6.16.53-0.16")) flag++;
if (rpm_check(release:"SLES10", sp:1, cpu:"x86_64", reference:"kernel-smp-2.6.16.53-0.16")) flag++;
if (rpm_check(release:"SLES10", sp:1, cpu:"x86_64", reference:"kernel-source-2.6.16.53-0.16")) flag++;
if (rpm_check(release:"SLES10", sp:1, cpu:"x86_64", reference:"kernel-syms-2.6.16.53-0.16")) flag++;
if (rpm_check(release:"SLES10", sp:1, cpu:"x86_64", reference:"kernel-xen-2.6.16.53-0.16")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else exit(0, "The host is not affected.");

#%NASL_MIN_LEVEL 80502

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update kernel-4487.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(27298);
  script_version ("1.14");
  script_cvs_date("Date: 2019/10/25 13:36:30");

  script_cve_id("CVE-2007-2525", "CVE-2007-3105", "CVE-2007-3851", "CVE-2007-4571", "CVE-2007-4573");

  script_name(english:"openSUSE 10 Security Update : kernel (kernel-4487)");
  script_summary(english:"Check for the kernel-4487 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This kernel update fixes the following security problems :

  - CVE-2007-3105: Stack-based buffer overflow in the random
    number generator (RNG) implementation in the Linux
    kernel before 2.6.22 might allow local root users to
    cause a denial of service or gain privileges by setting
    the default wake-up threshold to a value greater than
    the output pool size, which triggers writing random
    numbers to the stack by the pool transfer function
    involving 'bound check ordering'. Since this value can
    only be changed by a root user, exploitability is low.

  - CVE-2007-2525: A memory leak in the PPPoE driver can be
    abused by local users to cause a denial-of-service
    condition.

  - CVE-2007-3851: On machines with a Intel i965 based
    graphics card local users with access to the direct
    rendering devicenode could overwrite memory on the
    machine and so gain root privileges.

  - CVE-2007-4573: It was possible for local user to become
    root by exploitable a bug in the IA32 system call
    emulation. This affects x86_64 platforms with kernel
    2.4.x and 2.6.x before 2.6.22.7 only.

  - CVE-2007-4571: An information disclosure vulnerability
    in the ALSA driver can be exploited by local users to
    read sensitive data from the kernel memory.

and the following non security bugs :

    - patches.arch/x86-fam10-mtrr: mtrr: fix size_or_mask
      and size_and_mask [#237736]

    - patches.fixes/usb_nokia6233_fix1.patch: usb:
      rndis_host: fix crash while probing a Nokia S60 mobile
      [#244459]

    - patches.fixes/usb_nokia6233_fix2.patch: usbnet: init
      fault (oops) cleanup, whitespace fixes [#244459]

    - patches.fixes/usb_nokia6233_fix2.patch: usb:
      unusual_devs.h entry for Nokia 6233 [#244459]

    - patches.fixes/bt_broadcom_reset.diff: quirky Broadcom
      device [#257303]

    - patches.arch/i386-compat-vdso: i386: allow debuggers
      to access the vsyscall page with compat vDSO [#258433]

  - -
    patches.fixes/anycast6-unbalanced-inet6_dev-refcnt.patch
    : Fix netdevice reference leak when reading from
    /proc/net/anycast6 [#285336]

  - -
    patches.drivers/scsi-throttle-SG_DXFER_TO_FROM_DEV-warni
    ng-b etter: SCSI: throttle SG_DXFER_TO_FROM_DEV warning
    message better [#290117]

  - -
    patches.fixes/nf_conntrack_h323-out-of-bounds-index.diff
    : nf_conntrack_h323: add checking of out-of-range on
    choices' index values [#290611]

    - patches.fixes/ppc-fpu-corruption-fix.diff: ppc: fix
      corruption of fpu [#290622]

  - -
    patches.fixes/ppp-fix-osize-too-small-errors-when-decodi
    ng-m ppe.diff: ppp: Fix osize too small errors when
    decoding mppe [#291102]

    - patches.fixes/hugetlbfs-stack-grows-fix.patch: Don't
      allow the stack to grow into hugetlb reserved regions
      [#294021]

    - patches.fixes/pwc_dos.patch: fix a disconnect method
      waiting for user space to close a file. A malicious
      user can stall khubd indefinitely long [#302063]
      [#302194]

    - patches.suse/kdb.add-unwind-info-to-kdb_call: Add
      unwind info to kdb_call() to fix build of KDB kernel
      on i386 [#305209]

    - Updated config files: enable KDB for kernel-debug on
      i386. [#305209]"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected kernel packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_cwe_id(119, 264, 399);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-bigsmp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-default");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-kdump");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-source");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-syms");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-xen");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-xenpae");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:10.2");

  script_set_attribute(attribute:"patch_publication_date", value:"2007/10/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2007/10/17");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2007-2019 Tenable Network Security, Inc.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE10\.2)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "10.2", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE10.2", reference:"kernel-bigsmp-2.6.18.8-0.7") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"kernel-default-2.6.18.8-0.7") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"kernel-kdump-2.6.18.8-0.7") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"kernel-source-2.6.18.8-0.7") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"kernel-syms-2.6.18.8-0.7") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"kernel-xen-2.6.18.8-0.7") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"kernel-xenpae-2.6.18.8-0.7") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "kernel-bigsmp / kernel-default / kernel-kdump / kernel-source / etc");
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The text description of this plugin is (C) Novell, Inc.
#

if (NASL_LEVEL < 3000) exit(0);

include("compat.inc");

if (description)
{
  script_id(29488);
  script_version ("1.17");
  script_cvs_date("Date: 2019/10/25 13:36:30");

  script_cve_id("CVE-2007-4571", "CVE-2007-4573");

  script_name(english:"SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 4471)");
  script_summary(english:"Checks rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote SuSE 10 host is missing a security-related patch."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This kernel update fixes the following security problems :

  - It was possible for local user to become root by
    exploiting a bug in the IA32 system call emulation. This
    affects x86_64 platforms with kernel 2.4.x and 2.6.x
    before 2.6.22.7 only. (CVE-2007-4573)

  - An information disclosure vulnerability in the ALSA
    driver can be exploited by local users to read sensitive
    data from the kernel memory. (CVE-2007-4571)

and the following non security bugs :

  - patches.xen/xen-blkback-cdrom: CDROM removable
    media-present attribute plus handling code [#159907]

  - patches.drivers/libata-add-pata_dma-kernel-parameter:
    libata: Add a drivers/ide style DMA disable [#229260]
    [#272786]

  - patches.drivers/libata-sata_via-kill-SATA_PATA_SHARING:
    sata_via: kill SATA_PATA_SHARING register handling
    [#254158] [#309069]

  - patches.drivers/libata-sata_via-add-PCI-IDs: sata_via:
    add PCI IDs [#254158] [#326647]

  - supported.conf: Marked 8250 and 8250_pci as supported
    (only Xen kernels build them as modules) [#260686]

  - patches.fixes/bridge-module-get-put.patch: Module use
    count must be updated as bridges are created/destroyed
    [#267651]

  - patches.fixes/iscsi-netware-fix: Linux Initiator hard
    hangs writing files to NetWare target [#286566]

  - patches.fixes/lockd-chroot-fix: Allow lockd to work
    reliably with applications in a chroot [#288376]
    [#305480]

  - add patches.fixes/x86_64-hangcheck_timer-fix.patch fix
    monotonic_clock() and hangcheck_timer [#291633]

  - patches.arch/sn_hwperf_cpuinfo_fix.diff: Correctly count
    CPU objects for SGI ia64/sn hwperf interface [#292240]

  - Extend reiserfs to properly support file systems up to
    16 TiB [#294754]

  - patches.fixes/reiserfs-signedness-fixes.diff: reiserfs:
    fix usage of signed ints for block numbers

  - patches.fixes/reiserfs-fix-large-fs.diff: reiserfs:
    ignore s_bmap_nr on disk for file systems >= 8 TiB

  - patches.suse/ocfs2-06-per-resource-events.diff: Deliver
    events without a specified resource unconditionally.
    [#296606]

  - patches.fixes/proc-readdir-race-fix.patch: Fix the race
    in proc_pid_readdir [#297232]

  - patches.xen/xen3-patch-2.6.16.49-50: XEN: update to
    Linux 2.6.16.50 [#298719]

  - patches.fixes/pm-ordering-fix.patch: PM: Fix ACPI
    suspend / device suspend ordering [#302207]

  - patches.drivers/ibmvscsi-slave_configure.patch add

    ->slave_configure() to allow device restart [#304138]

  - patches.arch/ppc-power6-ebus-unique_location.patch
    Prevent bus_id collisions [#306482]

  - patches.xen/30-bit-field-booleans.patch: Fix packet loss
    in DomU xen netback driver [#306896]

  - config/i386/kdump: Enable ahci module [#308556]

  - update patches.drivers/ppc-power6-ehea.patch fix link
    state detection for bonding [#309553]

  - patches.drivers/ibmveth-fixup-pool_deactivate.patch
    patches.drivers/ibmveth-large-frames.patch
    patches.drivers/ibmveth-large-mtu.patch: fix serveral
    crashes when changing ibmveth sysfs values [#326164]

  -
    patches.drivers/libata-sata_sil24-fix-IRQ-clearing-race-
    on-I RQ_WOC: sata_sil24: fix IRQ clearing race when
    PCIX_IRQ_WOC is used [#327536]

  - update patches.drivers/ibmvscsis.patch set blocksize to
    PAGE_CACHE_SIZE to fix flood of bio allocation
    warnings/failures [#328219]

Fixes for S/390 :

  - IBM Patchcluster 17 [#330036]

  - Problem-ID: 38085 - zfcp: zfcp_scsi_eh_abort_handler or
    zfcp_scsi_eh_device_reset_handler hanging after CHPID
    off/on

  - Problem-ID: 38491 - zfcp: Error messages when LUN 0 is
    present

  - Problem-ID: 37390 - zcrypt: fix PCIXCC/CEX2C error
    recovery [#306056]

  - Problem-ID: 38500 - kernel: too few page cache pages in
    state volatile

  - Problem-ID: 38634 - qeth: crash during reboot after
    failing online setting

  - Problem-ID: 38927 - kernel: shared memory may not be
    volatile

  - Problem-ID: 39069 - cio: Disable channel path
    measurements on shutdown/reboot

  - Problem-ID: 27787 - qeth: recognize 'exclusively
    used'-RC from Hydra3

  - Problem-ID: 38330 - qeth: make qeth driver loadable
    without ipv6 module

    For further description of the named Problem-IDs, please
    look to
    http://www-128.ibm.com/developerworks/linux/linux390/oct
    ober 2005_recommended.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2007-4571.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2007-4573.html"
  );
  script_set_attribute(attribute:"solution", value:"Apply ZYPP patch number 4471.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_cwe_id(264);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:suse:suse_linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2007/10/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2007/12/13");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2007-2019 Tenable Network Security, Inc.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) exit(0, "Local checks are not enabled.");
if (!get_kb_item("Host/SuSE/release")) exit(0, "The host is not running SuSE.");
if (!get_kb_item("Host/SuSE/rpm-list")) exit(1, "Could not obtain the list of installed packages.");

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) exit(1, "Failed to determine the architecture type.");
if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") exit(1, "Local checks for SuSE 10 on the '"+cpu+"' architecture have not been implemented.");


flag = 0;
if (rpm_check(release:"SLED10", sp:1, cpu:"i586", reference:"kernel-bigsmp-2.6.16.53-0.16")) flag++;
if (rpm_check(release:"SLED10", sp:1, cpu:"i586", reference:"kernel-default-2.6.16.53-0.16")) flag++;
if (rpm_check(release:"SLED10", sp:1, cpu:"i586", reference:"kernel-smp-2.6.16.53-0.16")) flag++;
if (rpm_check(release:"SLED10", sp:1, cpu:"i586", reference:"kernel-source-2.6.16.53-0.16")) flag++;
if (rpm_check(release:"SLED10", sp:1, cpu:"i586", reference:"kernel-syms-2.6.16.53-0.16")) flag++;
if (rpm_check(release:"SLED10", sp:1, cpu:"i586", reference:"kernel-xen-2.6.16.53-0.16")) flag++;
if (rpm_check(release:"SLED10", sp:1, cpu:"i586", reference:"kernel-xenpae-2.6.16.53-0.16")) flag++;
if (rpm_check(release:"SLES10", sp:1, cpu:"i586", reference:"kernel-bigsmp-2.6.16.53-0.16")) flag++;
if (rpm_check(release:"SLES10", sp:1, cpu:"i586", reference:"kernel-debug-2.6.16.53-0.16")) flag++;
if (rpm_check(release:"SLES10", sp:1, cpu:"i586", reference:"kernel-default-2.6.16.53-0.16")) flag++;
if (rpm_check(release:"SLES10", sp:1, cpu:"i586", reference:"kernel-kdump-2.6.16.53-0.16")) flag++;
if (rpm_check(release:"SLES10", sp:1, cpu:"i586", reference:"kernel-smp-2.6.16.53-0.16")) flag++;
if (rpm_check(release:"SLES10", sp:1, cpu:"i586", reference:"kernel-source-2.6.16.53-0.16")) flag++;
if (rpm_check(release:"SLES10", sp:1, cpu:"i586", reference:"kernel-syms-2.6.16.53-0.16")) flag++;
if (rpm_check(release:"SLES10", sp:1, cpu:"i586", reference:"kernel-xen-2.6.16.53-0.16")) flag++;
if (rpm_check(release:"SLES10", sp:1, cpu:"i586", reference:"kernel-xenpae-2.6.16.53-0.16")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else exit(0, "The host is not affected.");

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Red Hat Security Advisory RHSA-2007:0993. The text 
# itself is copyright (C) Red Hat, Inc.
#

include("compat.inc");

if (description)
{
  script_id(28363);
  script_version ("1.25");
  script_cvs_date("Date: 2019/10/25 13:36:12");

  script_cve_id("CVE-2007-4571", "CVE-2007-4997", "CVE-2007-5494");
  script_bugtraq_id(25807, 26337);
  script_xref(name:"RHSA", value:"2007:0993");

  script_name(english:"RHEL 5 : kernel (RHSA-2007:0993)");
  script_summary(english:"Checks the rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Red Hat host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Updated kernel packages that fix various security issues in the Red
Hat Enterprise Linux 5 kernel are now available.

This update has been rated as having important security impact by the
Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the following security
issues :

A memory leak was found in the Red Hat Content Accelerator kernel
patch. A local user could use this flaw to cause a denial of service
(memory exhaustion). (CVE-2007-5494, Important)

A flaw was found in the handling of IEEE 802.11 frames affecting
several wireless LAN modules. In certain circumstances, a remote
attacker could trigger this flaw by sending a malicious packet over a
wireless network and cause a denial of service (kernel crash).
(CVE-2007-4997, Important).

A flaw was found in the Advanced Linux Sound Architecture (ALSA). A
local user who had the ability to read the /proc/driver/snd-page-alloc
file could see portions of kernel memory. (CVE-2007-4571, Moderate).

In addition to the security issues described above, several bug fixes
preventing possible memory corruption, system crashes, SCSI I/O fails,
networking drivers performance regression and journaling block device
layer issue were also included.

Red Hat Enterprise Linux 5 users are advised to upgrade to these
packages, which contain backported patches to resolve these issues.

Red Hat would like to credit Vasily Averin, Chris Evans, and Neil
Kettle for reporting the security issues corrected by this update."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2007-4571"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2007-4997"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2007-5494"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/errata/RHSA-2007:0993"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(189, 399);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-PAE");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-PAE-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-debug");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-debug-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-doc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-headers");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-xen");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-xen-devel");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:5.1");

  script_set_attribute(attribute:"vuln_publication_date", value:"2007/09/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2007/11/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2007/11/30");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Red Hat Local Security Checks");

  script_dependencies("ssh_get_info.nasl", "linux_alt_patch_detect.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("rpm.inc");
include("ksplice.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
os_ver = os_ver[1];
if (! preg(pattern:"^5([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 5.x", "Red Hat " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);

if (get_one_kb_item("Host/ksplice/kernel-cves"))
{
  rm_kb_item(name:"Host/uptrack-uname-r");
  cve_list = make_list("CVE-2007-4571", "CVE-2007-4997", "CVE-2007-5494");
  if (ksplice_cves_check(cve_list))
  {
    audit(AUDIT_PATCH_INSTALLED, "KSplice hotfix for RHSA-2007:0993");
  }
  else
  {
    __rpm_report = ksplice_reporting_text();
  }
}

yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
if (!empty_or_null(yum_updateinfo)) 
{
  rhsa = "RHSA-2007:0993";
  yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
  if (!empty_or_null(yum_report))
  {
    security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : yum_report 
    );
    exit(0);
  }
  else
  {
    audit_message = "affected by Red Hat security advisory " + rhsa;
    audit(AUDIT_OS_NOT, audit_message);
  }
}
else
{
  flag = 0;
  if (rpm_check(release:"RHEL5", cpu:"i686", reference:"kernel-2.6.18-53.1.4.el5")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"kernel-2.6.18-53.1.4.el5")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"kernel-2.6.18-53.1.4.el5")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"i686", reference:"kernel-PAE-2.6.18-53.1.4.el5")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"i686", reference:"kernel-PAE-devel-2.6.18-53.1.4.el5")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"i686", reference:"kernel-debug-2.6.18-53.1.4.el5")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"kernel-debug-2.6.18-53.1.4.el5")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"kernel-debug-2.6.18-53.1.4.el5")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"i686", reference:"kernel-debug-devel-2.6.18-53.1.4.el5")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"kernel-debug-devel-2.6.18-53.1.4.el5")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"kernel-debug-devel-2.6.18-53.1.4.el5")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"i686", reference:"kernel-devel-2.6.18-53.1.4.el5")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"kernel-devel-2.6.18-53.1.4.el5")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"kernel-devel-2.6.18-53.1.4.el5")) flag++;

  if (rpm_check(release:"RHEL5", reference:"kernel-doc-2.6.18-53.1.4.el5")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"i386", reference:"kernel-headers-2.6.18-53.1.4.el5")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"kernel-headers-2.6.18-53.1.4.el5")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"kernel-headers-2.6.18-53.1.4.el5")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"i686", reference:"kernel-xen-2.6.18-53.1.4.el5")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"kernel-xen-2.6.18-53.1.4.el5")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"i686", reference:"kernel-xen-devel-2.6.18-53.1.4.el5")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"kernel-xen-devel-2.6.18-53.1.4.el5")) flag++;


  if (flag)
  {
    security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get() + redhat_report_package_caveat()
    );
    exit(0);
  }
  else
  {
    tested = pkg_tests_get();
    if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
    else audit(AUDIT_PACKAGE_NOT_INSTALLED, "kernel / kernel-PAE / kernel-PAE-devel / kernel-debug / etc");
  }
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update kernel-4503.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(27299);
  script_version ("1.11");
  script_cvs_date("Date: 2019/10/25 13:36:30");

  script_cve_id("CVE-2007-4571", "CVE-2007-4573");

  script_name(english:"openSUSE 10 Security Update : kernel (kernel-4503)");
  script_summary(english:"Check for the kernel-4503 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This kernel update fixes the following security problems :

  - CVE-2007-4571: An information disclosure vulnerability
    in the ALSA driver can be exploited by local users to
    read sensitive data from the kernel memory.

  - CVE-2007-4573: It was possible for local user to become
    root by exploitable a bug in the IA32 system call
    emulation. This affects x86_64 platforms with kernel
    2.4.x and 2.6.x before 2.6.22.7 only.

and the following non security bugs :

  - supported.conf: Mark 8250 and 8250_pci as supported
    (only Xen kernels build them as modules) [#260686]

  - patches.fixes/bridge-module-get-put.patch: Module use
    count must be updated as bridges are created/destroyed
    [#267651]

  - patches.fixes/nfsv4-MAXNAME-fix.diff: knfsd: query
    filesystem for NFSv4 getattr of FATTR4_MAXNAME [#271803]

  - patches.fixes/sky2-tx-sum-resume.patch: sky2: fix
    transmit state on resume [#297132] [#326376]

  - patches.suse/reiserfs-add-reiserfs_error.diff:
    patches.suse/reiserfs-use-reiserfs_error.diff:
    patches.suse/reiserfs-buffer-info-for-balance.diff: Fix
    reiserfs_error() with NULL superblock calls [#299604]

  - patches.fixes/acpi_disable_C_states_in_suspend.patch:
    ACPI: disable lower idle C-states across suspend/resume
    [#302482]

  - kernel-syms.rpm: move the copies of the Modules.alias
    files from /lib/modules/... to /usr/src/linux-obj/... to
    avoid a file conflict between kernel-syms and other
    kernel-$flavor packages. The Modules.alias files in
    kernel-syms.rpm are intended for future use - [#307291]

  - patches.fixes/jffs2-fix-ACL-vs-mode-handling: Fix ACL
    vs. mode handling. [#310520]

- patches.drivers/libata-sata_sil24-fix-IRQ-clearing-race-on-I RQ_WOC:
sata_sil24: fix IRQ clearing race when PCIX_IRQ_WOC is used [#327536]

  - Update config files: Enabled CONFIG_DVB_PLUTO2 for i386
    since it's enabled everywhere else. [#327790]

- patches.drivers/libata-pata_ali-fix-garbage-PCI-rev-value: p
ata_ali: fix garbage PCI rev value in ali_init_chipset() [#328422]

  - patches.apparmor/apparmor-lsm-fix.diff:
    apparmor_file_mmap function parameters mismatch
    [#328423]

  - patches.drivers/libata-HPA-off-by-one-horkage: Fix HPA
    handling regression [#329584]"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected kernel packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_cwe_id(264);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-bigsmp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-default");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-source");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-syms");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-xen");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-xenpae");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:10.3");

  script_set_attribute(attribute:"patch_publication_date", value:"2007/10/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2007/10/17");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2007-2019 Tenable Network Security, Inc.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE10\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "10.3", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE10.3", reference:"kernel-bigsmp-2.6.22.9-0.4") ) flag++;
if ( rpm_check(release:"SUSE10.3", reference:"kernel-default-2.6.22.9-0.4") ) flag++;
if ( rpm_check(release:"SUSE10.3", reference:"kernel-source-2.6.22.9-0.4") ) flag++;
if ( rpm_check(release:"SUSE10.3", reference:"kernel-syms-2.6.22.9-0.4") ) flag++;
if ( rpm_check(release:"SUSE10.3", reference:"kernel-xen-2.6.22.9-0.4") ) flag++;
if ( rpm_check(release:"SUSE10.3", reference:"kernel-xenpae-2.6.22.9-0.4") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "kernel-bigsmp / kernel-default / kernel-source / kernel-syms / etc");
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory 2007-714.
#

include("compat.inc");

if (description)
{
  script_id(26934);
  script_version ("1.14");
  script_cvs_date("Date: 2019/08/02 13:32:26");

  script_cve_id("CVE-2007-4571");
  script_xref(name:"FEDORA", value:"2007-714");

  script_name(english:"Fedora Core 6 : kernel-2.6.22.9-61.fc6 (2007-714)");
  script_summary(english:"Checks rpm output for the updated packages.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora Core host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Update to Linux 2.6.22.8 and 2.6.22.9:
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22.8
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22.9

CVE-2007-4571 The snd_mem_proc_read function in sound/core/memalloc.c
in the Advanced Linux Sound Architecture (ALSA) in the Linux kernel
before 2.6.22.8 does not return the correct write size, which allows
local users to obtain sensitive information (kernel memory contents)
via a small count argument, as demonstrated by multiple reads of
/proc/driver/snd-page-alloc.

Additional fixes: Revert to the old RTC driver (#265721, #284191)
Disable NCQ for additional SATA drives. libata pata_sis: DMA fixes
(#202291) libata sata_sil24: IRQ clearing race fixes net driver r8169:
fix hanging (#252955, #292161) qdisc sfq: fix oops with 2 packet queue
(#219895) ACPI: disable processor C-states suring suspend ACPI:
silence noisy message

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  # http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22.8
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?e313ee37"
  );
  # http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22.9
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?9f7a5610"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2007-October/004053.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?60d2b4d9"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:kernel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:kernel-PAE");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:kernel-PAE-debug");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:kernel-PAE-debug-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:kernel-PAE-debug-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:kernel-PAE-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:kernel-PAE-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:kernel-debug");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:kernel-debug-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:kernel-debug-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:kernel-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:kernel-debuginfo-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:kernel-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:kernel-doc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:kernel-headers");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora_core:6");

  script_set_attribute(attribute:"patch_publication_date", value:"2007/10/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2007/10/09");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 6.x", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);

flag = 0;
if (rpm_check(release:"FC6", reference:"kernel-2.6.22.9-61.fc6")) flag++;
if (rpm_check(release:"FC6", cpu:"i386", reference:"kernel-PAE-2.6.22.9-61.fc6")) flag++;
if (rpm_check(release:"FC6", cpu:"i386", reference:"kernel-PAE-debug-2.6.22.9-61.fc6")) flag++;
if (rpm_check(release:"FC6", cpu:"i386", reference:"kernel-PAE-debug-debuginfo-2.6.22.9-61.fc6")) flag++;
if (rpm_check(release:"FC6", cpu:"i386", reference:"kernel-PAE-debug-devel-2.6.22.9-61.fc6")) flag++;
if (rpm_check(release:"FC6", cpu:"i386", reference:"kernel-PAE-debuginfo-2.6.22.9-61.fc6")) flag++;
if (rpm_check(release:"FC6", cpu:"i386", reference:"kernel-PAE-devel-2.6.22.9-61.fc6")) flag++;
if (rpm_check(release:"FC6", reference:"kernel-debug-2.6.22.9-61.fc6")) flag++;
if (rpm_check(release:"FC6", reference:"kernel-debug-debuginfo-2.6.22.9-61.fc6")) flag++;
if (rpm_check(release:"FC6", reference:"kernel-debug-devel-2.6.22.9-61.fc6")) flag++;
if (rpm_check(release:"FC6", reference:"kernel-debuginfo-2.6.22.9-61.fc6")) flag++;
if (rpm_check(release:"FC6", reference:"kernel-debuginfo-common-2.6.22.9-61.fc6")) flag++;
if (rpm_check(release:"FC6", reference:"kernel-devel-2.6.22.9-61.fc6")) flag++;
if (rpm_check(release:"FC6", reference:"kernel-doc-2.6.22.9-61.fc6")) flag++;
if (rpm_check(release:"FC6", reference:"kernel-headers-2.6.22.9-61.fc6")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_note(port:0, extra:rpm_report_get());
  else security_note(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "kernel / kernel-PAE / kernel-PAE-debug / kernel-PAE-debug-debuginfo / etc");
}