Vulnerabilities > CVE-2009-4272 - Improper Locking vulnerability in multiple products

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
HIGH
network
low complexity
linux
redhat
CWE-667
nessus

Summary

A certain Red Hat patch for net/ipv4/route.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 allows remote attackers to cause a denial of service (deadlock) via crafted packets that force collisions in the IPv4 routing hash table, and trigger a routing "emergency" in which a hash chain is too long. NOTE: this is related to an issue in the Linux kernel before 2.6.31, when the kernel routing cache is disabled, involving an uninitialized pointer and a panic.

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Leveraging Race Conditions
    This attack targets a race condition occurring when multiple processes access and manipulate the same resource concurrently and the outcome of the execution depends on the particular order in which the access takes place. The attacker can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance a race condition can occur while accessing a file, the attacker can trick the system by replacing the original file with his version and cause the system to read the malicious file.
  • Leveraging Race Conditions via Symbolic Links
    This attack leverages the use of symbolic links (Symlinks) in order to write to sensitive files. An attacker can create a Symlink link to a target file not otherwise accessible to her. When the privileged program tries to create a temporary file with the same name as the Symlink link, it will actually write to the target file pointed to by the attackers' Symlink link. If the attacker can insert malicious content in the temporary file she will be writing to the sensitive file by using the Symlink. The race occurs because the system checks if the temporary file exists, then creates the file. The attacker would typically create the Symlink during the interval between the check and the creation of the temporary file.

Nessus

  • NASL familyVMware ESX Local Security Checks
    NASL idVMWARE_VMSA-2010-0009.NASL
    descriptiona. Service Console update for COS kernel Updated COS package
    last seen2020-06-01
    modified2020-06-02
    plugin id46765
    published2010-06-01
    reporterThis script is Copyright (C) 2010-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/46765
    titleVMSA-2010-0009 : ESXi ntp and ESX Service Console third-party updates
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from VMware Security Advisory 2010-0009. 
    # The text itself is copyright (C) VMware Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(46765);
      script_version("1.43");
      script_cvs_date("Date: 2018/08/06 14:03:16");
    
      script_cve_id("CVE-2006-6304", "CVE-2007-4567", "CVE-2009-0590", "CVE-2009-1377", "CVE-2009-1378", "CVE-2009-1379", "CVE-2009-1384", "CVE-2009-1386", "CVE-2009-1387", "CVE-2009-2409", "CVE-2009-2695", "CVE-2009-2908", "CVE-2009-2910", "CVE-2009-3080", "CVE-2009-3228", "CVE-2009-3286", "CVE-2009-3547", "CVE-2009-3556", "CVE-2009-3563", "CVE-2009-3612", "CVE-2009-3613", "CVE-2009-3620", "CVE-2009-3621", "CVE-2009-3726", "CVE-2009-3736", "CVE-2009-3889", "CVE-2009-3939", "CVE-2009-4020", "CVE-2009-4021", "CVE-2009-4138", "CVE-2009-4141", "CVE-2009-4212", "CVE-2009-4272", "CVE-2009-4355", "CVE-2009-4536", "CVE-2009-4537", "CVE-2009-4538", "CVE-2010-0001", "CVE-2010-0097", "CVE-2010-0290", "CVE-2010-0382", "CVE-2010-0426", "CVE-2010-0427");
      script_bugtraq_id(31692, 34256, 35001, 35112, 35138, 35174, 35417, 36304, 36472, 36576, 36639, 36706, 36723, 36824, 36827, 36901, 36936, 37019, 37068, 37069, 37118, 37128, 37255, 37339, 37519, 37521, 37523, 37749, 37806, 37865, 37876, 37886, 38432);
      script_xref(name:"VMSA", value:"2010-0009");
    
      script_name(english:"VMSA-2010-0009 : ESXi ntp and ESX Service Console third-party updates");
      script_summary(english:"Checks esxupdate output for the patches");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote VMware ESXi / ESX host is missing one or more
    security-related patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "a. Service Console update for COS kernel
    
       Updated COS package 'kernel' addresses the security issues that are
       fixed through versions 2.6.18-164.11.1.
    
       The Common Vulnerabilities and Exposures project (cve.mitre.org)
       has assigned the names CVE-2009-2695, CVE-2009-2908, CVE-2009-3228,
       CVE-2009-3286, CVE-2009-3547, CVE-2009-3613 to the security issues
       fixed in kernel 2.6.18-164.6.1
    
       The Common Vulnerabilities and Exposures project (cve.mitre.org)
       has assigned the names CVE-2009-3612, CVE-2009-3620, CVE-2009-3621,
       CVE-2009-3726 to the security issues fixed in kernel 2.6.18-164.9.1.
    
       The Common Vulnerabilities and Exposures project (cve.mitre.org)
       has assigned the names CVE-2007-4567, CVE-2009-4536, CVE-2009-4537,
       CVE-2009-4538 to the security issues fixed in kernel 2.6.18-164.10.1
    
       The Common Vulnerabilities and Exposures project (cve.mitre.org)
       has assigned the names CVE-2006-6304, CVE-2009-2910, CVE-2009-3080,
       CVE-2009-3556, CVE-2009-3889, CVE-2009-3939, CVE-2009-4020,
       CVE-2009-4021, CVE-2009-4138, CVE-2009-4141, and CVE-2009-4272 to
       the security issues fixed in kernel 2.6.18-164.11.1.
    
    b. ESXi userworld update for ntp
    
       The Network Time Protocol (NTP) is used to synchronize the time of
       a computer client or server to another server or reference time
       source.
    
       A vulnerability in ntpd could allow a remote attacker to cause a
       denial of service (CPU and bandwidth consumption) by using
       MODE_PRIVATE to send a spoofed (1) request or (2) response packet
       that triggers a continuous exchange of MODE_PRIVATE error responses
       between two NTP daemons.
    
       The Common Vulnerabilities and Exposures Project (cve.mitre.org)
       has assigned the name CVE-2009-3563 to this issue.
    
    c. Service Console package openssl updated to 0.9.8e-12.el5_4.1
    
       OpenSSL is a toolkit implementing SSL v2/v3 and TLS protocols with
       full-strength cryptography world-wide.
    
       A memory leak in the zlib could allow a remote attacker to cause a
       denial of service (memory consumption) via vectors that trigger
       incorrect calls to the CRYPTO_cleanup_all_ex_data function.
    
       The Common Vulnerabilities and Exposures Project (cve.mitre.org)
       has assigned the name CVE-2009-4355 to this issue.
    
       A vulnerability was discovered which may allow remote attackers to
       spoof certificates by using MD2 design flaws to generate a hash
       collision in less than brute-force time. NOTE: the scope of this
       issue is currently limited because the amount of computation
       required is still large.
    
       The Common Vulnerabilities and Exposures Project (cve.mitre.org)
       has assigned the name CVE-2009-2409 to this issue.
    
       This update also includes security fixes that were first addressed
       in version openssl-0.9.8e-12.el5.i386.rpm.
    
       The Common Vulnerabilities and Exposures Project (cve.mitre.org)
       has assigned the names CVE-2009-0590, CVE-2009-1377, CVE-2009-1378,
       CVE-2009-1379, CVE-2009-1386 and CVE-2009-1387 to these issues.
    
    d. Service Console update for krb5 to 1.6.1-36.el5_4.1 and pam_krb5 to
       2.2.14-15.
    
       Kerberos is a network authentication protocol. It is designed to
       provide strong authentication for client/server applications by
       using secret-key cryptography.
    
       Multiple integer underflows in the AES and RC4 functionality in the
       crypto library could allow remote attackers to cause a denial of
       service (daemon crash) or possibly execute arbitrary code by
       providing ciphertext with a length that is too short to be valid.
    
       The Common Vulnerabilities and Exposures Project (cve.mitre.org)
       has assigned the name CVE-2009-4212 to this issue.
    
       The service console package for pam_krb5 is updated to version
       pam_krb5-2.2.14-15. This update fixes a flaw found in pam_krb5. In
       some non-default configurations (specifically, where pam_krb5 would
       be the first module to prompt for a password), a remote attacker
       could use this flaw to recognize valid usernames, which would aid a
       dictionary-based password guess attack.
    
       The Common Vulnerabilities and Exposures Project (cve.mitre.org)
       has assigned the name CVE-2009-1384 to this issue.
    
    e. Service Console package bind updated to 9.3.6-4.P1.el5_4.2
    
       BIND (Berkeley Internet Name Daemon) is by far the most widely used
       Domain Name System (DNS) software on the Internet.
    
       A vulnerability was discovered which could allow remote attacker to
       add the Authenticated Data (AD) flag to a forged NXDOMAIN response
       for an existing domain.
    
       The Common Vulnerabilities and Exposures Project (cve.mitre.org)
       has assigned the name CVE-2010-0097 to this issue.
    
       A vulnerability was discovered which could allow remote attackers
       to conduct DNS cache poisoning attacks by receiving a recursive
       client query and sending a response that contains CNAME or DNAME
       records, which do not have the intended validation before caching.
    
       The Common Vulnerabilities and Exposures Project (cve.mitre.org)
       has assigned the name CVE-2010-0290 to this issue.
    
       A vulnerability was found in the way that bind handles out-of-
       bailiwick data accompanying a secure response without re-fetching
       from the original source, which could allow remote attackers to
       have an unspecified impact via a crafted response.
    
       The Common Vulnerabilities and Exposures Project (cve.mitre.org)
       has assigned the name CVE-2010-0382 to this issue.
    
       NOTE: ESX does not use the BIND name service daemon by default.
    
    f. Service Console package gcc updated to 3.2.3-60
    
       The GNU Compiler Collection includes front ends for C, C++,
       Objective-C, Fortran, Java, and Ada, as well as libraries for these
       languages
    
       GNU Libtool's ltdl.c attempts to open .la library files in the
       current working directory.  This could allow a local user to gain
       privileges via a Trojan horse file.  The GNU C Compiler collection
       (gcc) provided in ESX contains a statically linked version of the
       vulnerable code, and is being replaced.
    
       The Common Vulnerabilities and Exposures Project (cve.mitre.org)
       has assigned the name CVE-2009-3736 to this issue.
    
    g. Service Console package gzip update to 1.3.3-15.rhel3
    
       gzip is a software application used for file compression
    
       An integer underflow in gzip's unlzw function on 64-bit platforms
       may allow a remote attacker to trigger an array index error
       leading to a denial of service (application crash) or possibly
       execute arbitrary code via a crafted LZW compressed file.
    
       The Common Vulnerabilities and Exposures Project (cve.mitre.org)
       has assigned the name CVE-2010-0001 to this issue.
    
    h. Service Console package sudo updated to 1.6.9p17-6.el5_4
    
       Sudo (su 'do') allows a system administrator to delegate authority
       to give certain users (or groups of users) the ability to run some
       (or all) commands as root or another user while providing an audit
       trail of the commands and their arguments.
    
       When a pseudo-command is enabled, sudo permits a match between the
       name of the pseudo-command and the name of an executable file in an
       arbitrary directory, which allows local users to gain privileges
       via a crafted executable file.
    
       The Common Vulnerabilities and Exposures Project (cve.mitre.org)
       has assigned the name CVE-2010-0426 to this issue.
    
       When the runas_default option is used, sudo does not properly set
       group memberships, which allows local users to gain privileges via
       a sudo command.
    
       The Common Vulnerabilities and Exposures Project (cve.mitre.org)
       has assigned the name CVE-2010-0427 to this issue."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://lists.vmware.com/pipermail/security-announce/2010/000099.html"
      );
      script_set_attribute(attribute:"solution", value:"Apply the missing patches.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(20, 119, 189, 200, 264, 287, 310, 362, 399);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:vmware:esx:3.5");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:vmware:esx:4.0");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:vmware:esxi:4.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2010/05/27");
      script_set_attribute(attribute:"plugin_publication_date", value:"2010/06/01");
      script_set_attribute(attribute:"vuln_publication_date", value:"2006/12/18");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2010-2018 Tenable Network Security, Inc.");
      script_family(english:"VMware ESX Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/VMware/release", "Host/VMware/version");
      script_require_ports("Host/VMware/esxupdate", "Host/VMware/esxcli_software_vibs");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("vmware_esx_packages.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/VMware/release")) audit(AUDIT_OS_NOT, "VMware ESX / ESXi");
    if (
      !get_kb_item("Host/VMware/esxcli_software_vibs") &&
      !get_kb_item("Host/VMware/esxupdate")
    ) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    init_esx_check(date:"2010-05-27");
    flag = 0;
    
    
    if (esx_check(ver:"ESX 3.5.0", patch:"ESX350-201006405-SG")) flag++;
    if (esx_check(ver:"ESX 3.5.0", patch:"ESX350-201006406-SG")) flag++;
    if (
      esx_check(
        ver           : "ESX 3.5.0",
        patch         : "ESX350-201006408-SG",
        patch_updates : make_list("ESX350-201008411-SG")
      )
    ) flag++;
    
    if (
      esx_check(
        ver           : "ESX 4.0.0",
        patch         : "ESX400-201005401-SG",
        patch_updates : make_list("ESX400-201009401-SG", "ESX400-201101401-SG", "ESX400-201103401-SG", "ESX400-201104401-SG", "ESX400-201110401-SG", "ESX400-201111201-SG", "ESX400-201203401-SG", "ESX400-201205401-SG", "ESX400-201206401-SG", "ESX400-201209401-SG", "ESX400-201302401-SG", "ESX400-201305401-SG", "ESX400-201310401-SG", "ESX400-201404401-SG", "ESX400-Update02", "ESX400-Update03", "ESX400-Update04")
      )
    ) flag++;
    if (
      esx_check(
        ver           : "ESX 4.0.0",
        patch         : "ESX400-201005405-SG",
        patch_updates : make_list("ESX400-Update02", "ESX400-Update03", "ESX400-Update04")
      )
    ) flag++;
    if (
      esx_check(
        ver           : "ESX 4.0.0",
        patch         : "ESX400-201005406-SG",
        patch_updates : make_list("ESX400-201009403-SG", "ESX400-201110403-SG", "ESX400-201203407-SG", "ESX400-Update02", "ESX400-Update03", "ESX400-Update04")
      )
    ) flag++;
    if (
      esx_check(
        ver           : "ESX 4.0.0",
        patch         : "ESX400-201005407-SG",
        patch_updates : make_list("ESX400-Update02", "ESX400-Update03", "ESX400-Update04")
      )
    ) flag++;
    if (
      esx_check(
        ver           : "ESX 4.0.0",
        patch         : "ESX400-201005408-SG",
        patch_updates : make_list("ESX400-201103407-SG", "ESX400-201305403-SG", "ESX400-Update02", "ESX400-Update03", "ESX400-Update04")
      )
    ) flag++;
    if (
      esx_check(
        ver           : "ESX 4.0.0",
        patch         : "ESX400-201005409-SG",
        patch_updates : make_list("ESX400-201009410-SG", "ESX400-201101404-SG", "ESX400-201305402-SG", "ESX400-Update02", "ESX400-Update03", "ESX400-Update04")
      )
    ) flag++;
    
    if (
      esx_check(
        ver           : "ESXi 4.0.0",
        patch         : "ESXi400-201005401-SG",
        patch_updates : make_list("ESXi400-201101401-SG", "ESXi400-201103401-SG", "ESXi400-201104401-SG", "ESXi400-201110401-SG", "ESXi400-201203401-SG", "ESXi400-201205401-SG", "ESXi400-201206401-SG", "ESXi400-201209401-SG", "ESXi400-201302401-SG", "ESXi400-201305401-SG", "ESXi400-201310401-SG", "ESXi400-201404401-SG", "ESXi400-Update02", "ESXi400-Update03", "ESXi400-Update04")
      )
    ) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:esx_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyVMware ESX Local Security Checks
    NASL idVMWARE_VMSA-2010-0009_REMOTE.NASL
    descriptionThe remote VMware ESX / ESXi host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several components and third-party libraries : - libpng - VMnc Codec - vmrun - VMware Remote Console (VMrc) - VMware Tools - vmware-authd
    last seen2020-06-01
    modified2020-06-02
    plugin id89740
    published2016-03-08
    reporterThis script is Copyright (C) 2016-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/89740
    titleVMware ESX / ESXi Third-Party Libraries and Components (VMSA-2010-0009) (remote check)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(89740);
      script_version("1.5");
      script_cvs_date("Date: 2018/08/06 14:03:16");
    
      script_cve_id(
        "CVE-2006-6304",
        "CVE-2007-4567",
        "CVE-2009-0590",
        "CVE-2009-1377",
        "CVE-2009-1378",
        "CVE-2009-1379",
        "CVE-2009-1384",
        "CVE-2009-1386",
        "CVE-2009-1387",
        "CVE-2009-2409",
        "CVE-2009-2695",
        "CVE-2009-2908",
        "CVE-2009-2910",
        "CVE-2009-3080",
        "CVE-2009-3228",
        "CVE-2009-3286",
        "CVE-2009-3547",
        "CVE-2009-3556",
        "CVE-2009-3563",
        "CVE-2009-3612",
        "CVE-2009-3613",
        "CVE-2009-3620",
        "CVE-2009-3621",
        "CVE-2009-3726",
        "CVE-2009-3736",
        "CVE-2009-3889",
        "CVE-2009-3939",
        "CVE-2009-4020",
        "CVE-2009-4021",
        "CVE-2009-4138",
        "CVE-2009-4141",
        "CVE-2009-4212",
        "CVE-2009-4272",
        "CVE-2009-4355",
        "CVE-2009-4536",
        "CVE-2009-4537",
        "CVE-2009-4538",
        "CVE-2010-0001",
        "CVE-2010-0097",
        "CVE-2010-0290",
        "CVE-2010-0382",
        "CVE-2010-0426",
        "CVE-2010-0427"
      );
      script_bugtraq_id(
        31692,
        34256,
        35001,
        35112,
        35138,
        35174,
        35417,
        36304,
        36472,
        36576,
        36639,
        36706,
        36723,
        36824,
        36827,
        36901,
        36936,
        37019,
        37068,
        37069,
        37118,
        37128,
        37255,
        37339,
        37519,
        37521,
        37523,
        37749,
        37806,
        37865,
        37876,
        37886,
        38432
      );
      script_xref(name:"VMSA", value:"2010-0009");
    
      script_name(english:"VMware ESX / ESXi Third-Party Libraries and Components (VMSA-2010-0009) (remote check)");
      script_summary(english:"Checks the ESX / ESXi version and build number.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote VMware ESX / ESXi host is missing a security-related patch.");
      script_set_attribute(attribute:"description", value:
    "The remote VMware ESX / ESXi host is missing a security-related patch.
    It is, therefore, affected by multiple vulnerabilities, including
    remote code execution vulnerabilities, in several components and
    third-party libraries :
    
      - libpng
      - VMnc Codec
      - vmrun
      - VMware Remote Console (VMrc)
      - VMware Tools
      - vmware-authd");
      script_set_attribute(attribute:"see_also", value:"https://www.vmware.com/security/advisories/VMSA-2010-0009");
      script_set_attribute(attribute:"see_also", value:"http://lists.vmware.com/pipermail/security-announce/2010/000099.html");
      script_set_attribute(attribute:"solution", value:
    "Apply the appropriate patch according to the vendor advisory that
    pertains to ESX version 3.5 / 4.0 or ESXi version 3.5 / 4.0.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(20, 119, 189, 200, 264, 287, 310, 362, 399);
    
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:vmware:esx");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:vmware:esxi");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2006/12/18");
      script_set_attribute(attribute:"patch_publication_date", value:"2010/05/27");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/03/08");
      
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2018 Tenable Network Security, Inc.");
      script_family(english:"VMware ESX Local Security Checks");
    
      script_dependencies("vmware_vsphere_detect.nbin");
      script_require_keys("Host/VMware/version", "Host/VMware/release");
      script_require_ports("Host/VMware/vsphere");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    
    ver = get_kb_item_or_exit("Host/VMware/version");
    rel = get_kb_item_or_exit("Host/VMware/release");
    port = get_kb_item_or_exit("Host/VMware/vsphere");
    esx = '';
    
    if ("ESX" >!< rel)
      audit(AUDIT_OS_NOT, "VMware ESX/ESXi");
    
    extract = eregmatch(pattern:"^(ESXi?) (\d\.\d).*$", string:ver);
    if (isnull(extract))
      audit(AUDIT_UNKNOWN_APP_VER, "VMware ESX/ESXi");
    else
    {
      esx = extract[1];
      ver = extract[2];
    }
    
    # fixed build numbers are the same for ESX and ESXi
    fixes = make_array(
              "4.0", "256968",
              "3.5", "259926"
            );
    
    fix = FALSE;
    fix = fixes[ver];
    
    # get the build before checking the fix for the most complete audit trail
    extract = eregmatch(pattern:'^VMware ESXi?.* build-([0-9]+)$', string:rel);
    if (isnull(extract))
      audit(AUDIT_UNKNOWN_BUILD, "VMware " + esx, ver);
    
    build = int(extract[1]);
    
    # if there is no fix in the array, fix is FALSE
    if (!fix)
      audit(AUDIT_INST_VER_NOT_VULN, "VMware " + esx, ver, build);
    
    if (build < fix)
    {
    
      report = '\n  Version         : ' + esx + " " + ver +
               '\n  Installed build : ' + build +
               '\n  Fixed build     : ' + fix +
               '\n';
      security_report_v4(port:port, extra:report, severity:SECURITY_HOLE);
      exit(0);
    }
    else
      audit(AUDIT_INST_VER_NOT_VULN, "VMware " + esx, ver, build);
    
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2010-0046.NASL
    descriptionFrom Red Hat Security Advisory 2010:0046 : Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security fixes : * an array index error was found in the gdth driver. A local user could send a specially crafted IOCTL request that would cause a denial of service or, possibly, privilege escalation. (CVE-2009-3080, Important) * a flaw was found in the FUSE implementation. When a system is low on memory, fuse_put_request() could dereference an invalid pointer, possibly leading to a local denial of service or privilege escalation. (CVE-2009-4021, Important) * Tavis Ormandy discovered a deficiency in the fasync_helper() implementation. This could allow a local, unprivileged user to leverage a use-after-free of locked, asynchronous file descriptors to cause a denial of service or privilege escalation. (CVE-2009-4141, Important) * the Parallels Virtuozzo Containers team reported the RHSA-2009:1243 update introduced two flaws in the routing implementation. If an attacker was able to cause a large enough number of collisions in the routing hash table (via specially crafted packets) for the emergency route flush to trigger, a deadlock could occur. Secondly, if the kernel routing cache was disabled, an uninitialized pointer would be left behind after a route lookup, leading to a kernel panic. (CVE-2009-4272, Important) * the RHSA-2009:0225 update introduced a rewrite attack flaw in the do_coredump() function. A local attacker able to guess the file name a process is going to dump its core to, prior to the process crashing, could use this flaw to append data to the dumped core file. This issue only affects systems that have
    last seen2020-06-01
    modified2020-06-02
    plugin id67988
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/67988
    titleOracle Linux 5 : kernel (ELSA-2010-0046)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Red Hat Security Advisory RHSA-2010:0046 and 
    # Oracle Linux Security Advisory ELSA-2010-0046 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(67988);
      script_version("1.26");
      script_cvs_date("Date: 2019/10/25 13:36:08");
    
      script_cve_id("CVE-2006-6304", "CVE-2009-2910", "CVE-2009-3080", "CVE-2009-3556", "CVE-2009-3889", "CVE-2009-3939", "CVE-2009-4020", "CVE-2009-4021", "CVE-2009-4138", "CVE-2009-4141", "CVE-2009-4272");
      script_bugtraq_id(36576, 37019, 37068, 37069, 37339, 37806);
      script_xref(name:"RHSA", value:"2010:0046");
    
      script_name(english:"Oracle Linux 5 : kernel (ELSA-2010-0046)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Oracle Linux host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "From Red Hat Security Advisory 2010:0046 :
    
    Updated kernel packages that fix multiple security issues and several
    bugs are now available for Red Hat Enterprise Linux 5.
    
    This update has been rated as having important security impact by the
    Red Hat Security Response Team.
    
    The kernel packages contain the Linux kernel, the core of any Linux
    operating system.
    
    Security fixes :
    
    * an array index error was found in the gdth driver. A local user
    could send a specially crafted IOCTL request that would cause a denial
    of service or, possibly, privilege escalation. (CVE-2009-3080,
    Important)
    
    * a flaw was found in the FUSE implementation. When a system is low on
    memory, fuse_put_request() could dereference an invalid pointer,
    possibly leading to a local denial of service or privilege escalation.
    (CVE-2009-4021, Important)
    
    * Tavis Ormandy discovered a deficiency in the fasync_helper()
    implementation. This could allow a local, unprivileged user to
    leverage a use-after-free of locked, asynchronous file descriptors to
    cause a denial of service or privilege escalation. (CVE-2009-4141,
    Important)
    
    * the Parallels Virtuozzo Containers team reported the RHSA-2009:1243
    update introduced two flaws in the routing implementation. If an
    attacker was able to cause a large enough number of collisions in the
    routing hash table (via specially crafted packets) for the emergency
    route flush to trigger, a deadlock could occur. Secondly, if the
    kernel routing cache was disabled, an uninitialized pointer would be
    left behind after a route lookup, leading to a kernel panic.
    (CVE-2009-4272, Important)
    
    * the RHSA-2009:0225 update introduced a rewrite attack flaw in the
    do_coredump() function. A local attacker able to guess the file name a
    process is going to dump its core to, prior to the process crashing,
    could use this flaw to append data to the dumped core file. This issue
    only affects systems that have '/proc/sys/fs/suid_dumpable' set to 2
    (the default value is 0). (CVE-2006-6304, Moderate)
    
    The fix for CVE-2006-6304 changes the expected behavior: With
    suid_dumpable set to 2, the core file will not be recorded if the file
    already exists. For example, core files will not be overwritten on
    subsequent crashes of processes whose core files map to the same name.
    
    * an information leak was found in the Linux kernel. On AMD64 systems,
    32-bit processes could access and read certain 64-bit registers by
    temporarily switching themselves to 64-bit mode. (CVE-2009-2910,
    Moderate)
    
    * the RHBA-2008:0314 update introduced N_Port ID Virtualization (NPIV)
    support in the qla2xxx driver, resulting in two new sysfs pseudo
    files, '/sys/class/scsi_host/[a qla2xxx host]/vport_create' and
    'vport_delete'. These two files were world-writable by default,
    allowing a local user to change SCSI host attributes. This flaw only
    affects systems using the qla2xxx driver and NPIV capable hardware.
    (CVE-2009-3556, Moderate)
    
    * permission issues were found in the megaraid_sas driver. The
    'dbg_lvl' and 'poll_mode_io' files on the sysfs file system ('/sys/')
    had world-writable permissions. This could allow local, unprivileged
    users to change the behavior of the driver. (CVE-2009-3889,
    CVE-2009-3939, Moderate)
    
    * a NULL pointer dereference flaw was found in the firewire-ohci
    driver used for OHCI compliant IEEE 1394 controllers. A local,
    unprivileged user with access to /dev/fw* files could issue certain
    IOCTL calls, causing a denial of service or privilege escalation. The
    FireWire modules are blacklisted by default, and if enabled, only root
    has access to the files noted above by default. (CVE-2009-4138,
    Moderate)
    
    * a buffer overflow flaw was found in the hfs_bnode_read() function in
    the HFS file system implementation. This could lead to a denial of
    service if a user browsed a specially crafted HFS file system, for
    example, by running 'ls'. (CVE-2009-4020, Low)
    
    Bug fix documentation for this update will be available shortly from
    www.redhat.com/docs/en-US/errata/RHSA-2010-0046/Kernel_Security_Update
    / index.html
    
    Users should upgrade to these updated packages, which contain
    backported patches to correct these issues. The system must be
    rebooted for this update to take effect."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://oss.oracle.com/pipermail/el-errata/2010-January/001335.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected kernel packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_cwe_id(20, 119, 200, 264, 399);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-PAE");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-PAE-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-debug");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-debug-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-doc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-headers");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-xen");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-xen-devel");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:5");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2006/12/14");
      script_set_attribute(attribute:"patch_publication_date", value:"2010/01/21");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/07/12");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Oracle Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl", "linux_alt_patch_detect.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    include("ksplice.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/OracleLinux")) audit(AUDIT_OS_NOT, "Oracle Linux");
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:release)) audit(AUDIT_OS_NOT, "Oracle Linux");
    os_ver = pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Oracle Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^5([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Oracle Linux 5", "Oracle Linux " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && "ia64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Oracle Linux", cpu);
    
    if (get_one_kb_item("Host/ksplice/kernel-cves"))
    {
      rm_kb_item(name:"Host/uptrack-uname-r");
      cve_list = make_list("CVE-2006-6304", "CVE-2009-2910", "CVE-2009-3080", "CVE-2009-3556", "CVE-2009-3889", "CVE-2009-3939", "CVE-2009-4020", "CVE-2009-4021", "CVE-2009-4138", "CVE-2009-4141", "CVE-2009-4272");  
      if (ksplice_cves_check(cve_list))
      {
        audit(AUDIT_PATCH_INSTALLED, "KSplice hotfix for ELSA-2010-0046");
      }
      else
      {
        __rpm_report = ksplice_reporting_text();
      }
    }
    
    kernel_major_minor = get_kb_item("Host/uname/major_minor");
    if (empty_or_null(kernel_major_minor)) exit(1, "Unable to determine kernel major-minor level.");
    expected_kernel_major_minor = "2.6";
    if (kernel_major_minor != expected_kernel_major_minor)
      audit(AUDIT_OS_NOT, "running kernel level " + expected_kernel_major_minor + ", it is running kernel level " + kernel_major_minor);
    
    flag = 0;
    if (rpm_exists(release:"EL5", rpm:"kernel-2.6.18") && rpm_check(release:"EL5", reference:"kernel-2.6.18-164.11.1.0.1.el5")) flag++;
    if (rpm_exists(release:"EL5", rpm:"kernel-PAE-2.6.18") && rpm_check(release:"EL5", cpu:"i386", reference:"kernel-PAE-2.6.18-164.11.1.0.1.el5")) flag++;
    if (rpm_exists(release:"EL5", rpm:"kernel-PAE-devel-2.6.18") && rpm_check(release:"EL5", cpu:"i386", reference:"kernel-PAE-devel-2.6.18-164.11.1.0.1.el5")) flag++;
    if (rpm_exists(release:"EL5", rpm:"kernel-debug-2.6.18") && rpm_check(release:"EL5", reference:"kernel-debug-2.6.18-164.11.1.0.1.el5")) flag++;
    if (rpm_exists(release:"EL5", rpm:"kernel-debug-devel-2.6.18") && rpm_check(release:"EL5", reference:"kernel-debug-devel-2.6.18-164.11.1.0.1.el5")) flag++;
    if (rpm_exists(release:"EL5", rpm:"kernel-devel-2.6.18") && rpm_check(release:"EL5", reference:"kernel-devel-2.6.18-164.11.1.0.1.el5")) flag++;
    if (rpm_exists(release:"EL5", rpm:"kernel-doc-2.6.18") && rpm_check(release:"EL5", reference:"kernel-doc-2.6.18-164.11.1.0.1.el5")) flag++;
    if (rpm_exists(release:"EL5", rpm:"kernel-headers-2.6.18") && rpm_check(release:"EL5", reference:"kernel-headers-2.6.18-164.11.1.0.1.el5")) flag++;
    if (rpm_exists(release:"EL5", rpm:"kernel-xen-2.6.18") && rpm_check(release:"EL5", reference:"kernel-xen-2.6.18-164.11.1.0.1.el5")) flag++;
    if (rpm_exists(release:"EL5", rpm:"kernel-xen-devel-2.6.18") && rpm_check(release:"EL5", reference:"kernel-xen-devel-2.6.18-164.11.1.0.1.el5")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "affected kernel");
    }
    
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2010-0046.NASL
    descriptionUpdated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security fixes : * an array index error was found in the gdth driver. A local user could send a specially crafted IOCTL request that would cause a denial of service or, possibly, privilege escalation. (CVE-2009-3080, Important) * a flaw was found in the FUSE implementation. When a system is low on memory, fuse_put_request() could dereference an invalid pointer, possibly leading to a local denial of service or privilege escalation. (CVE-2009-4021, Important) * Tavis Ormandy discovered a deficiency in the fasync_helper() implementation. This could allow a local, unprivileged user to leverage a use-after-free of locked, asynchronous file descriptors to cause a denial of service or privilege escalation. (CVE-2009-4141, Important) * the Parallels Virtuozzo Containers team reported the RHSA-2009:1243 update introduced two flaws in the routing implementation. If an attacker was able to cause a large enough number of collisions in the routing hash table (via specially crafted packets) for the emergency route flush to trigger, a deadlock could occur. Secondly, if the kernel routing cache was disabled, an uninitialized pointer would be left behind after a route lookup, leading to a kernel panic. (CVE-2009-4272, Important) * the RHSA-2009:0225 update introduced a rewrite attack flaw in the do_coredump() function. A local attacker able to guess the file name a process is going to dump its core to, prior to the process crashing, could use this flaw to append data to the dumped core file. This issue only affects systems that have
    last seen2020-06-01
    modified2020-06-02
    plugin id44096
    published2010-01-21
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/44096
    titleCentOS 5 : kernel (CESA-2010:0046)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2010:0046 and 
    # CentOS Errata and Security Advisory 2010:0046 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(44096);
      script_version("1.30");
      script_cvs_date("Date: 2019/10/25 13:36:05");
    
      script_cve_id("CVE-2006-6304", "CVE-2009-2910", "CVE-2009-3080", "CVE-2009-3556", "CVE-2009-3889", "CVE-2009-3939", "CVE-2009-4020", "CVE-2009-4021", "CVE-2009-4138", "CVE-2009-4141", "CVE-2009-4272");
      script_bugtraq_id(36576, 37019, 37068, 37069, 37339, 37806);
      script_xref(name:"RHSA", value:"2010:0046");
    
      script_name(english:"CentOS 5 : kernel (CESA-2010:0046)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote CentOS host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Updated kernel packages that fix multiple security issues and several
    bugs are now available for Red Hat Enterprise Linux 5.
    
    This update has been rated as having important security impact by the
    Red Hat Security Response Team.
    
    The kernel packages contain the Linux kernel, the core of any Linux
    operating system.
    
    Security fixes :
    
    * an array index error was found in the gdth driver. A local user
    could send a specially crafted IOCTL request that would cause a denial
    of service or, possibly, privilege escalation. (CVE-2009-3080,
    Important)
    
    * a flaw was found in the FUSE implementation. When a system is low on
    memory, fuse_put_request() could dereference an invalid pointer,
    possibly leading to a local denial of service or privilege escalation.
    (CVE-2009-4021, Important)
    
    * Tavis Ormandy discovered a deficiency in the fasync_helper()
    implementation. This could allow a local, unprivileged user to
    leverage a use-after-free of locked, asynchronous file descriptors to
    cause a denial of service or privilege escalation. (CVE-2009-4141,
    Important)
    
    * the Parallels Virtuozzo Containers team reported the RHSA-2009:1243
    update introduced two flaws in the routing implementation. If an
    attacker was able to cause a large enough number of collisions in the
    routing hash table (via specially crafted packets) for the emergency
    route flush to trigger, a deadlock could occur. Secondly, if the
    kernel routing cache was disabled, an uninitialized pointer would be
    left behind after a route lookup, leading to a kernel panic.
    (CVE-2009-4272, Important)
    
    * the RHSA-2009:0225 update introduced a rewrite attack flaw in the
    do_coredump() function. A local attacker able to guess the file name a
    process is going to dump its core to, prior to the process crashing,
    could use this flaw to append data to the dumped core file. This issue
    only affects systems that have '/proc/sys/fs/suid_dumpable' set to 2
    (the default value is 0). (CVE-2006-6304, Moderate)
    
    The fix for CVE-2006-6304 changes the expected behavior: With
    suid_dumpable set to 2, the core file will not be recorded if the file
    already exists. For example, core files will not be overwritten on
    subsequent crashes of processes whose core files map to the same name.
    
    * an information leak was found in the Linux kernel. On AMD64 systems,
    32-bit processes could access and read certain 64-bit registers by
    temporarily switching themselves to 64-bit mode. (CVE-2009-2910,
    Moderate)
    
    * the RHBA-2008:0314 update introduced N_Port ID Virtualization (NPIV)
    support in the qla2xxx driver, resulting in two new sysfs pseudo
    files, '/sys/class/scsi_host/[a qla2xxx host]/vport_create' and
    'vport_delete'. These two files were world-writable by default,
    allowing a local user to change SCSI host attributes. This flaw only
    affects systems using the qla2xxx driver and NPIV capable hardware.
    (CVE-2009-3556, Moderate)
    
    * permission issues were found in the megaraid_sas driver. The
    'dbg_lvl' and 'poll_mode_io' files on the sysfs file system ('/sys/')
    had world-writable permissions. This could allow local, unprivileged
    users to change the behavior of the driver. (CVE-2009-3889,
    CVE-2009-3939, Moderate)
    
    * a NULL pointer dereference flaw was found in the firewire-ohci
    driver used for OHCI compliant IEEE 1394 controllers. A local,
    unprivileged user with access to /dev/fw* files could issue certain
    IOCTL calls, causing a denial of service or privilege escalation. The
    FireWire modules are blacklisted by default, and if enabled, only root
    has access to the files noted above by default. (CVE-2009-4138,
    Moderate)
    
    * a buffer overflow flaw was found in the hfs_bnode_read() function in
    the HFS file system implementation. This could lead to a denial of
    service if a user browsed a specially crafted HFS file system, for
    example, by running 'ls'. (CVE-2009-4020, Low)
    
    Bug fix documentation for this update will be available shortly from
    www.redhat.com/docs/en-US/errata/RHSA-2010-0046/Kernel_Security_Update
    / index.html
    
    Users should upgrade to these updated packages, which contain
    backported patches to correct these issues. The system must be
    rebooted for this update to take effect."
      );
      # https://lists.centos.org/pipermail/centos-announce/2010-January/016479.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?ec445ac4"
      );
      # https://lists.centos.org/pipermail/centos-announce/2010-January/016480.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?60fd6b72"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected kernel packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_cwe_id(20, 119, 200, 264, 399);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:kernel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:kernel-PAE");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:kernel-PAE-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:kernel-debug");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:kernel-debug-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:kernel-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:kernel-doc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:kernel-headers");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:kernel-xen");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:kernel-xen-devel");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:5");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2006/12/14");
      script_set_attribute(attribute:"patch_publication_date", value:"2010/01/20");
      script_set_attribute(attribute:"plugin_publication_date", value:"2010/01/21");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"CentOS Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/CentOS/release");
    if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS");
    os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS");
    os_ver = os_ver[1];
    if (! preg(pattern:"^5([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 5.x", "CentOS " + os_ver);
    
    if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"CentOS-5", reference:"kernel-2.6.18-164.11.1.el5")) flag++;
    if (rpm_check(release:"CentOS-5", cpu:"i386", reference:"kernel-PAE-2.6.18-164.11.1.el5")) flag++;
    if (rpm_check(release:"CentOS-5", cpu:"i386", reference:"kernel-PAE-devel-2.6.18-164.11.1.el5")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"kernel-debug-2.6.18-164.11.1.el5")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"kernel-debug-devel-2.6.18-164.11.1.el5")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"kernel-devel-2.6.18-164.11.1.el5")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"kernel-doc-2.6.18-164.11.1.el5")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"kernel-headers-2.6.18-164.11.1.el5")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"kernel-xen-2.6.18-164.11.1.el5")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"kernel-xen-devel-2.6.18-164.11.1.el5")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "kernel / kernel-PAE / kernel-PAE-devel / kernel-debug / etc");
    }
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2010-0046.NASL
    descriptionUpdated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security fixes : * an array index error was found in the gdth driver. A local user could send a specially crafted IOCTL request that would cause a denial of service or, possibly, privilege escalation. (CVE-2009-3080, Important) * a flaw was found in the FUSE implementation. When a system is low on memory, fuse_put_request() could dereference an invalid pointer, possibly leading to a local denial of service or privilege escalation. (CVE-2009-4021, Important) * Tavis Ormandy discovered a deficiency in the fasync_helper() implementation. This could allow a local, unprivileged user to leverage a use-after-free of locked, asynchronous file descriptors to cause a denial of service or privilege escalation. (CVE-2009-4141, Important) * the Parallels Virtuozzo Containers team reported the RHSA-2009:1243 update introduced two flaws in the routing implementation. If an attacker was able to cause a large enough number of collisions in the routing hash table (via specially crafted packets) for the emergency route flush to trigger, a deadlock could occur. Secondly, if the kernel routing cache was disabled, an uninitialized pointer would be left behind after a route lookup, leading to a kernel panic. (CVE-2009-4272, Important) * the RHSA-2009:0225 update introduced a rewrite attack flaw in the do_coredump() function. A local attacker able to guess the file name a process is going to dump its core to, prior to the process crashing, could use this flaw to append data to the dumped core file. This issue only affects systems that have
    last seen2020-06-01
    modified2020-06-02
    plugin id44062
    published2010-01-20
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/44062
    titleRHEL 5 : kernel (RHSA-2010:0046)

Oval

  • accepted2013-04-29T04:12:01.355-04:00
    classvulnerability
    contributors
    • nameAharon Chernin
      organizationSCAP.com, LLC
    • nameDragos Prisaca
      organizationG2, Inc.
    definition_extensions
    • commentThe operating system installed on the system is Red Hat Enterprise Linux 5
      ovaloval:org.mitre.oval:def:11414
    • commentThe operating system installed on the system is CentOS Linux 5.x
      ovaloval:org.mitre.oval:def:15802
    • commentOracle Linux 5.x
      ovaloval:org.mitre.oval:def:15459
    descriptionA certain Red Hat patch for net/ipv4/route.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 allows remote attackers to cause a denial of service (deadlock) via crafted packets that force collisions in the IPv4 routing hash table, and trigger a routing "emergency" in which a hash chain is too long. NOTE: this is related to an issue in the Linux kernel before 2.6.31, when the kernel routing cache is disabled, involving an uninitialized pointer and a panic.
    familyunix
    idoval:org.mitre.oval:def:11167
    statusaccepted
    submitted2010-07-09T03:56:16-04:00
    titleA certain Red Hat patch for net/ipv4/route.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 allows remote attackers to cause a denial of service (deadlock) via crafted packets that force collisions in the IPv4 routing hash table, and trigger a routing "emergency" in which a hash chain is too long. NOTE: this is related to an issue in the Linux kernel before 2.6.31, when the kernel routing cache is disabled, involving an uninitialized pointer and a panic.
    version18
  • accepted2014-01-20T04:01:31.410-05:00
    classvulnerability
    contributors
    • nameJ. Daniel Brown
      organizationDTCC
    • nameChris Coffin
      organizationThe MITRE Corporation
    definition_extensions
    commentVMware ESX Server 4.0 is installed
    ovaloval:org.mitre.oval:def:6293
    descriptionA certain Red Hat patch for net/ipv4/route.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 allows remote attackers to cause a denial of service (deadlock) via crafted packets that force collisions in the IPv4 routing hash table, and trigger a routing "emergency" in which a hash chain is too long. NOTE: this is related to an issue in the Linux kernel before 2.6.31, when the kernel routing cache is disabled, involving an uninitialized pointer and a panic.
    familyunix
    idoval:org.mitre.oval:def:7026
    statusaccepted
    submitted2010-06-01T17:30:00.000-05:00
    titleRed Hat Linux Kernel Routing Implementation Multiple Remote Denial of Service Vulnerabilities
    version8

Redhat

advisories
  • bugzilla
    id550968
    titleRHEL5.4 guest with PV clock: inconsistent times returned by clock_gettime(CLOCK_REALTIME) and gettimeofday() [rhel-5.4.z]
    oval
    OR
    • commentRed Hat Enterprise Linux must be installed
      ovaloval:com.redhat.rhba:tst:20070304026
    • AND
      • commentRed Hat Enterprise Linux 5 is installed
        ovaloval:com.redhat.rhba:tst:20070331005
      • OR
        • commentkernel earlier than 0:2.6.18-164.11.1.el5 is currently running
          ovaloval:com.redhat.rhsa:tst:20100046025
        • commentkernel earlier than 0:2.6.18-164.11.1.el5 is set to boot up on next boot
          ovaloval:com.redhat.rhsa:tst:20100046026
      • OR
        • AND
          • commentkernel-doc is earlier than 0:2.6.18-164.11.1.el5
            ovaloval:com.redhat.rhsa:tst:20100046001
          • commentkernel-doc is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhba:tst:20080314002
        • AND
          • commentkernel-debug is earlier than 0:2.6.18-164.11.1.el5
            ovaloval:com.redhat.rhsa:tst:20100046003
          • commentkernel-debug is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhba:tst:20080314014
        • AND
          • commentkernel-headers is earlier than 0:2.6.18-164.11.1.el5
            ovaloval:com.redhat.rhsa:tst:20100046005
          • commentkernel-headers is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhba:tst:20080314006
        • AND
          • commentkernel-xen-devel is earlier than 0:2.6.18-164.11.1.el5
            ovaloval:com.redhat.rhsa:tst:20100046007
          • commentkernel-xen-devel is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhba:tst:20080314020
        • AND
          • commentkernel is earlier than 0:2.6.18-164.11.1.el5
            ovaloval:com.redhat.rhsa:tst:20100046009
          • commentkernel is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhba:tst:20080314008
        • AND
          • commentkernel-debug-devel is earlier than 0:2.6.18-164.11.1.el5
            ovaloval:com.redhat.rhsa:tst:20100046011
          • commentkernel-debug-devel is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhba:tst:20080314004
        • AND
          • commentkernel-xen is earlier than 0:2.6.18-164.11.1.el5
            ovaloval:com.redhat.rhsa:tst:20100046013
          • commentkernel-xen is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhba:tst:20080314018
        • AND
          • commentkernel-devel is earlier than 0:2.6.18-164.11.1.el5
            ovaloval:com.redhat.rhsa:tst:20100046015
          • commentkernel-devel is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhba:tst:20080314016
        • AND
          • commentkernel-kdump-devel is earlier than 0:2.6.18-164.11.1.el5
            ovaloval:com.redhat.rhsa:tst:20100046017
          • commentkernel-kdump-devel is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhba:tst:20080314012
        • AND
          • commentkernel-kdump is earlier than 0:2.6.18-164.11.1.el5
            ovaloval:com.redhat.rhsa:tst:20100046019
          • commentkernel-kdump is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhba:tst:20080314010
        • AND
          • commentkernel-PAE-devel is earlier than 0:2.6.18-164.11.1.el5
            ovaloval:com.redhat.rhsa:tst:20100046021
          • commentkernel-PAE-devel is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhba:tst:20080314022
        • AND
          • commentkernel-PAE is earlier than 0:2.6.18-164.11.1.el5
            ovaloval:com.redhat.rhsa:tst:20100046023
          • commentkernel-PAE is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhba:tst:20080314024
    rhsa
    idRHSA-2010:0046
    released2010-01-19
    severityImportant
    titleRHSA-2010:0046: kernel security and bug fix update (Important)
  • rhsa
    idRHSA-2010:0095
rpms
  • kernel-0:2.6.18-164.11.1.el5
  • kernel-PAE-0:2.6.18-164.11.1.el5
  • kernel-PAE-debuginfo-0:2.6.18-164.11.1.el5
  • kernel-PAE-devel-0:2.6.18-164.11.1.el5
  • kernel-debug-0:2.6.18-164.11.1.el5
  • kernel-debug-debuginfo-0:2.6.18-164.11.1.el5
  • kernel-debug-devel-0:2.6.18-164.11.1.el5
  • kernel-debuginfo-0:2.6.18-164.11.1.el5
  • kernel-debuginfo-common-0:2.6.18-164.11.1.el5
  • kernel-devel-0:2.6.18-164.11.1.el5
  • kernel-doc-0:2.6.18-164.11.1.el5
  • kernel-headers-0:2.6.18-164.11.1.el5
  • kernel-kdump-0:2.6.18-164.11.1.el5
  • kernel-kdump-debuginfo-0:2.6.18-164.11.1.el5
  • kernel-kdump-devel-0:2.6.18-164.11.1.el5
  • kernel-xen-0:2.6.18-164.11.1.el5
  • kernel-xen-debuginfo-0:2.6.18-164.11.1.el5
  • kernel-xen-devel-0:2.6.18-164.11.1.el5
  • rhev-hypervisor-0:5.4-2.1.8.el5_4rhev2_1
  • rhev-hypervisor-pxe-0:5.4-2.1.8.el5_4rhev2_1

Seebug

  • bulletinFamilyexploit
    descriptionBugraq ID: 37875 CVE ID:CVE-2009-4272 Red Hat是一款流行的linux发行版本。 如果攻击者能够在路由哈希表中引起足够数量的碰撞(如通过特殊构建的报文),以触发紧急路由刷新,可发生死锁现象,或者如果在内核路由缓存禁用的情况下,在路由查询后会遗留未初始化指针,触发空指针应用而发生上述现象。 RedHat Enterprise Linux EUS 5.4.z server RedHat Enterprise Linux Desktop 5 client RedHat Enterprise Linux 5 server 厂商解决方案 用户可参考如下供应商提供的安全补丁: https://bugzilla.redhat.com/show_bug.cgi?id=545411#c6 https://bugzilla.redhat.com/show_bug.cgi?id=545411#c15
    idSSV:18988
    last seen2017-11-19
    modified2010-01-23
    published2010-01-23
    reporterRoot
    titleRed Hat Linux内核路由实现多个远程拒绝服务漏洞
  • bulletinFamilyexploit
    descriptionBUGTRAQ ID: 37875 CVE ID: CVE-2009-4272 Linux Kernel是开放源码操作系统Linux所使用的内核。 Red Hat版本的Linux Kernel的路由实现中存在两个拒绝服务漏洞。如果攻击者能够通过特制报文导致在路由哈希表中出现大量冲突以触发紧急路由flush,就会触发死锁;其次,如果禁用了内核路由缓存,在路由查询后会留下未初始化的指针,导致内核忙碌。 RedHat Linux 5.x 厂商补丁: RedHat ------ RedHat已经为此发布了一个安全公告(RHSA-2010:0046-01)以及相应补丁: RHSA-2010:0046-01:Important: kernel security and bug fix update 链接:https://www.redhat.com/support/errata/RHSA-2010-0046.html
    idSSV:18999
    last seen2017-11-19
    modified2010-01-26
    published2010-01-26
    reporterRoot
    titleRed Hat Linux Kernel路由实现多个远程拒绝服务漏洞

Statements

contributorTomas Hoger
lastmodified2010-01-28
organizationRed Hat
statementThis issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 3, 4 and Red Hat Enterprise MRG. Shipped kernels do not include upstream commits c6153b5b and 1080d709 that introduced the problem. It was addressed in Red Hat Enterprise Linux 5 via https://rhn.redhat.com/errata/RHSA-2010-0046.html

References