Vulnerabilities > CVE-2009-2625

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text in this plugin was
# extracted from the Oracle SunOS Patch Updates.
#
include("compat.inc");

if (description)
{
  script_id(27008);
  script_version("$Revision: 1.32 $");
  script_cvs_date("$Date: 2015/10/20 23:02:22 $");

  script_cve_id("CVE-2009-0217", "CVE-2009-2625", "CVE-2009-2670", "CVE-2009-2671", "CVE-2009-2672", "CVE-2009-2673", "CVE-2009-2674", "CVE-2009-2675", "CVE-2009-2676", "CVE-2009-3403", "CVE-2014-0429", "CVE-2014-0446", "CVE-2014-0451", "CVE-2014-0453", "CVE-2014-0457", "CVE-2014-0460", "CVE-2014-2398", "CVE-2014-2401", "CVE-2014-2412", "CVE-2014-2421", "CVE-2014-2427");

  script_name(english:"Solaris 8 (sparc) : 125136-97");
  script_summary(english:"Check for patch 125136-97");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote host is missing Sun Security Patch number 125136-97"
  );
  script_set_attribute(
    attribute:"description", 
    value:
"JavaSE 6: update 101 patch (equivalent to.
Date this patch was last updated by Sun : Jul/13/15"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://getupdates.oracle.com/readme/125136-97"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"You should install this patch for your system to be up-to-date."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_cwe_id(264);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:sun:solaris");

  script_set_attribute(attribute:"patch_publication_date", value:"2015/07/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2007/10/12");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2007-2015 Tenable Network Security, Inc.");
  script_family(english:"Solaris Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Solaris/showrev");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("solaris.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"125136-97", obsoleted_by:"152076-05 ", package:"SUNWj6rt", version:"1.6.0,REV=2006.11.29.05.57") < 0) flag++;
if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"125136-97", obsoleted_by:"152076-05 ", package:"SUNWj6jmp", version:"1.6.0,REV=2006.12.07.19.24") < 0) flag++;
if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"125136-97", obsoleted_by:"152076-05 ", package:"SUNWj6man", version:"1.6.0,REV=2006.12.07.16.37") < 0) flag++;
if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"125136-97", obsoleted_by:"152076-05 ", package:"SUNWj6cfg", version:"1.6.0,REV=2006.11.29.05.57") < 0) flag++;
if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"125136-97", obsoleted_by:"152076-05 ", package:"SUNWj6dmo", version:"1.6.0,REV=2006.11.29.05.57") < 0) flag++;
if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"125136-97", obsoleted_by:"152076-05 ", package:"SUNWj6dev", version:"1.6.0,REV=2006.11.29.05.57") < 0) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:solaris_get_report());
  else security_hole(0);
  exit(0);
}
audit(AUDIT_HOST_NOT, "affected");

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Ubuntu Security Notice USN-890-4. The text 
# itself is copyright (C) Canonical, Inc. See 
# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
# trademark of Canonical, Inc.
#

include("compat.inc");

if (description)
{
  script_id(44323);
  script_version("1.17");
  script_cvs_date("Date: 2019/09/19 12:54:26");

  script_cve_id("CVE-2009-2625", "CVE-2009-3560", "CVE-2009-3720");
  script_bugtraq_id(36097, 37203);
  script_xref(name:"USN", value:"890-4");

  script_name(english:"Ubuntu 6.06 LTS : python-xml vulnerabilities (USN-890-4)");
  script_summary(english:"Checks dpkg output for updated packages.");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Ubuntu host is missing one or more security-related
patches."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"USN-890-1 fixed vulnerabilities in Expat. This update provides the
corresponding updates for PyXML.

Jukka Taimisto, Tero Rontti and Rauli Kaksonen discovered that Expat
did not properly process malformed XML. If a user or application
linked against Expat were tricked into opening a crafted XML file, an
attacker could cause a denial of service via application crash.
(CVE-2009-2625, CVE-2009-3720)

It was discovered that Expat did not properly process
malformed UTF-8 sequences. If a user or application linked
against Expat were tricked into opening a crafted XML file,
an attacker could cause a denial of service via application
crash. (CVE-2009-3560).

Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://usn.ubuntu.com/890-4/"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(119, 264);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:python-xml");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:python2.4-xml");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:xbel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:xbel-utils");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:6.06:-:lts");

  script_set_attribute(attribute:"vuln_publication_date", value:"2009/08/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2010/01/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2010/01/27");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"Ubuntu Security Notice (C) 2010-2019 Canonical, Inc. / NASL script (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Ubuntu Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("ubuntu.inc");
include("misc_func.inc");

if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/Ubuntu/release");
if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
release = chomp(release);
if (! preg(pattern:"^(6\.06)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 6.06", "Ubuntu " + release);
if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);

flag = 0;

if (ubuntu_check(osver:"6.06", pkgname:"python-xml", pkgver:"0.8.4-1ubuntu3.1")) flag++;
if (ubuntu_check(osver:"6.06", pkgname:"python2.4-xml", pkgver:"0.8.4-1ubuntu3.1")) flag++;
if (ubuntu_check(osver:"6.06", pkgname:"xbel", pkgver:"0.8.4-1ubuntu3.1")) flag++;
if (ubuntu_check(osver:"6.06", pkgname:"xbel-utils", pkgver:"0.8.4-1ubuntu3.1")) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : ubuntu_report_get()
  );
  exit(0);
}
else
{
  tested = ubuntu_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python-xml / python2.4-xml / xbel / xbel-utils");
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text in this plugin was
# extracted from the Oracle SunOS Patch Updates.
#
include("compat.inc");

if (description)
{
  script_id(23413);
  script_version("1.34");
  script_cvs_date("Date: 2019/10/25 13:36:27");

  script_cve_id("CVE-2009-0278", "CVE-2009-2625", "CVE-2011-3559");
  script_xref(name:"IAVT", value:"2009-T-0009");

  script_name(english:"Solaris 8 (sparc) : 119166-43");
  script_summary(english:"Check for patch 119166-43");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote host is missing Sun Security Patch number 119166-43"
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Sun Java System App Server Enterprise Ed 8.1 2005Q1, Solaris Patch.
Date this patch was last updated by Sun : Oct/18/11"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://getupdates.oracle.com/readme/119166-43"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"You should install this patch for your system to be up-to-date."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_cwe_id(200, 264);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:sun:solaris");

  script_set_attribute(attribute:"patch_publication_date", value:"2011/10/18");
  script_set_attribute(attribute:"plugin_publication_date", value:"2006/11/06");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2006-2019 Tenable Network Security, Inc.");
  script_family(english:"Solaris Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Solaris/showrev");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("solaris.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"119166-43", obsoleted_by:"", package:"SUNWasut", version:"8.1,REV=2004.12.04.01.18") < 0) flag++;
if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"119166-43", obsoleted_by:"", package:"SUNWasuee", version:"8.1,REV=2004.12.04.01.52") < 0) flag++;
if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"119166-43", obsoleted_by:"", package:"SUNWasman", version:"8.1,REV=2004.12.04.01.18") < 0) flag++;
if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"119166-43", obsoleted_by:"", package:"SUNWascmnse", version:"8.1,REV=2004.12.04.01.52") < 0) flag++;
if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"119166-43", obsoleted_by:"", package:"SUNWasjdoc", version:"8.1,REV=2004.12.04.01.18") < 0) flag++;
if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"119166-43", obsoleted_by:"", package:"SUNWasacee", version:"8.1,REV=2004.12.04.01.52") < 0) flag++;
if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"119166-43", obsoleted_by:"", package:"SUNWaslb", version:"8.1,REV=2004.12.04.01.52") < 0) flag++;
if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"119166-43", obsoleted_by:"", package:"SUNWascml", version:"8.1,REV=2004.12.04.01.52") < 0) flag++;
if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"119166-43", obsoleted_by:"", package:"SUNWasu", version:"8.1,REV=2004.12.04.01.18") < 0) flag++;
if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"119166-43", obsoleted_by:"", package:"SUNWasdem", version:"8.1,REV=2004.12.04.01.18") < 0) flag++;
if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"119166-43", obsoleted_by:"", package:"SUNWascmn", version:"8.1,REV=2004.12.04.01.18") < 0) flag++;
if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"119166-43", obsoleted_by:"", package:"SUNWashdm", version:"8.1,REV=2004.12.04.01.52") < 0) flag++;
if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"119166-43", obsoleted_by:"", package:"SUNWaswbcr", version:"8.1,REV=2004.12.04.01.52") < 0) flag++;
if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"119166-43", obsoleted_by:"", package:"SUNWasac", version:"8.1,REV=2004.12.04.01.18") < 0) flag++;
if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"119166-43", obsoleted_by:"", package:"SUNWasmanee", version:"8.1,REV=2004.12.04.01.52") < 0) flag++;
if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"119166-43", obsoleted_by:"", package:"SUNWasdemdb", version:"8.1,REV=2004.12.04.01.18") < 0) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:solaris_get_report());
  else security_hole(0);
  exit(0);
}
audit(AUDIT_HOST_NOT, "affected");

• name	Pai Peng
  organization	Hewlett-Packard

• name	Sushant Kumar Singh
  organization	Hewlett-Packard

• name	Sushant Kumar Singh
  organization	Hewlett-Packard

• name	Prashant Kumar
  organization	Hewlett-Packard

• name	Mike Cokus
  organization	The MITRE Corporation

• name	Aharon Chernin
  organization	SCAP.com, LLC

• name	Dragos Prisaca
  organization	G2, Inc.

• comment	The operating system installed on the system is Red Hat Enterprise Linux 5
  oval	oval:org.mitre.oval:def:11414

• comment	The operating system installed on the system is CentOS Linux 5.x
  oval	oval:org.mitre.oval:def:15802

• comment	Oracle Linux 5.x
  oval	oval:org.mitre.oval:def:15459