Vulnerabilities > CVE-2012-0056 - Permissions, Privileges, and Access Controls vulnerability in Linux Kernel
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
The mem_write function in the Linux kernel before 3.2.2, when ASLR is disabled, does not properly check permissions when writing to /proc/<pid>/mem, which allows local users to gain privileges by modifying process memory, as demonstrated by Mempodipper.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Accessing, Modifying or Executing Executable Files An attack of this type exploits a system's configuration that allows an attacker to either directly access an executable file, for example through shell access; or in a possible worst case allows an attacker to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
- Leverage Executable Code in Non-Executable Files An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
- Blue Boxing This type of attack against older telephone switches and trunks has been around for decades. A tone is sent by an adversary to impersonate a supervisor signal which has the effect of rerouting or usurping command of the line. While the US infrastructure proper may not contain widespread vulnerabilities to this type of attack, many companies are connected globally through call centers and business process outsourcing. These international systems may be operated in countries which have not upgraded Telco infrastructure and so are vulnerable to Blue boxing. Blue boxing is a result of failure on the part of the system to enforce strong authorization for administrative functions. While the infrastructure is different than standard current applications like web applications, there are historical lessons to be learned to upgrade the access control for administrative functions.
- Restful Privilege Elevation Rest uses standard HTTP (Get, Put, Delete) style permissions methods, but these are not necessarily correlated generally with back end programs. Strict interpretation of HTTP get methods means that these HTTP Get services should not be used to delete information on the server, but there is no access control mechanism to back up this logic. This means that unless the services are properly ACL'd and the application's service implementation are following these guidelines then an HTTP request can easily execute a delete or update on the server side. The attacker identifies a HTTP Get URL such as http://victimsite/updateOrder, which calls out to a program to update orders on a database or other resource. The URL is not idempotent so the request can be submitted multiple times by the attacker, additionally, the attacker may be able to exploit the URL published as a Get method that actually performs updates (instead of merely retrieving data). This may result in malicious or inadvertent altering of data on the server.
- Target Programs with Elevated Privileges This attack targets programs running with elevated privileges. The attacker would try to leverage a bug in the running program and get arbitrary code to execute with elevated privileges. For instance an attacker would look for programs that write to the system directories or registry keys (such as HKLM, which stores a number of critical Windows environment variables). These programs are typically running with elevated privileges and have usually not been designed with security in mind. Such programs are excellent exploit targets because they yield lots of power when they break. The malicious user try to execute its code at the same level as a privileged system call.
Exploit-Db
| description | Linux Kernel 2.6.39 <= 3.2.2 (32-bit & 64-bit) - Mempodipper Local Root (1). CVE-2012-0056. Local exploit for linux platform |
| id | EDB-ID:18411 |
| last seen | 2016-02-02 |
| modified | 2012-01-23 |
| published | 2012-01-23 |
| reporter | zx2c4 |
| source | https://www.exploit-db.com/download/18411/ |
| title | Linux Kernel 2.6.39 <= 3.2.2 32-bit & 64-bit - Mempodipper Local Root 1 |
Nessus
NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2012-0061.NASL description Updated kernel-rt packages that fix one security issue are now available for Red Hat Enterprise MRG 2.1. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The kernel-rt packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issue : * It was found that permissions were not checked properly in the Linux kernel when handling the /proc/[pid]/mem writing functionality. A local, unprivileged user could use this flaw to escalate their privileges. Refer to Red Hat Knowledgebase article DOC-69129, linked to in the References, for further information. (CVE-2012-0056, Important) Red Hat would like to thank Juri Aedla for reporting this issue. Users should upgrade to these updated packages, which correct this issue. The system must be rebooted for this update to take effect. last seen 2020-06-01 modified 2020-06-02 plugin id 76636 published 2014-07-22 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/76636 title RHEL 6 : MRG (RHSA-2012:0061) code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2012:0061. The text # itself is copyright (C) Red Hat, Inc. # include("compat.inc"); if (description) { script_id(76636); script_version("1.14"); script_cvs_date("Date: 2019/10/24 15:35:35"); script_cve_id("CVE-2012-0056"); script_bugtraq_id(51625); script_xref(name:"RHSA", value:"2012:0061"); script_name(english:"RHEL 6 : MRG (RHSA-2012:0061)"); script_summary(english:"Checks the rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote Red Hat host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "Updated kernel-rt packages that fix one security issue are now available for Red Hat Enterprise MRG 2.1. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The kernel-rt packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issue : * It was found that permissions were not checked properly in the Linux kernel when handling the /proc/[pid]/mem writing functionality. A local, unprivileged user could use this flaw to escalate their privileges. Refer to Red Hat Knowledgebase article DOC-69129, linked to in the References, for further information. (CVE-2012-0056, Important) Red Hat would like to thank Juri Aedla for reporting this issue. Users should upgrade to these updated packages, which correct this issue. The system must be rebooted for this update to take effect." ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2012-0056" ); # https://access.redhat.com/kb/docs/DOC-69129 script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/solutions/69124" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2012:0061" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"exploit_framework_canvas", value:"true"); script_set_attribute(attribute:"canvas_package", value:'CANVAS'); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-rt"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-rt-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-rt-debuginfo-common-x86_64"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-rt-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-rt-doc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-rt-firmware"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-rt-trace"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-rt-trace-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-rt-trace-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-rt-vanilla"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-rt-vanilla-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-rt-vanilla-devel"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6"); script_set_attribute(attribute:"vuln_publication_date", value:"2012/01/27"); script_set_attribute(attribute:"patch_publication_date", value:"2012/01/24"); script_set_attribute(attribute:"plugin_publication_date", value:"2014/07/22"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Red Hat Local Security Checks"); script_dependencies("ssh_get_info.nasl", "linux_alt_patch_detect.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("rpm.inc"); include("ksplice.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat"); os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat"); os_ver = os_ver[1]; if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 6.x", "Red Hat " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu); if (get_one_kb_item("Host/ksplice/kernel-cves")) { rm_kb_item(name:"Host/uptrack-uname-r"); cve_list = make_list("CVE-2012-0056"); if (ksplice_cves_check(cve_list)) { audit(AUDIT_PATCH_INSTALLED, "KSplice hotfix for RHSA-2012:0061"); } else { __rpm_report = ksplice_reporting_text(); } } yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo"); if (!empty_or_null(yum_updateinfo)) { rhsa = "RHSA-2012:0061"; yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa); if (!empty_or_null(yum_report)) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : yum_report ); exit(0); } else { audit_message = "affected by Red Hat security advisory " + rhsa; audit(AUDIT_OS_NOT, audit_message); } } else { flag = 0; if (! (rpm_exists(release:"RHEL6", rpm:"mrg-release"))) audit(AUDIT_PACKAGE_NOT_INSTALLED, "MRG"); if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"kernel-rt-3.0.9-rt26.46.el6rt")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"kernel-rt-debug-3.0.9-rt26.46.el6rt")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"kernel-rt-debug-debuginfo-3.0.9-rt26.46.el6rt")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"kernel-rt-debug-devel-3.0.9-rt26.46.el6rt")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"kernel-rt-debuginfo-3.0.9-rt26.46.el6rt")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"kernel-rt-debuginfo-common-x86_64-3.0.9-rt26.46.el6rt")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"kernel-rt-devel-3.0.9-rt26.46.el6rt")) flag++; if (rpm_check(release:"RHEL6", reference:"kernel-rt-doc-3.0.9-rt26.46.el6rt")) flag++; if (rpm_check(release:"RHEL6", reference:"kernel-rt-firmware-3.0.9-rt26.46.el6rt")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"kernel-rt-trace-3.0.9-rt26.46.el6rt")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"kernel-rt-trace-debuginfo-3.0.9-rt26.46.el6rt")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"kernel-rt-trace-devel-3.0.9-rt26.46.el6rt")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"kernel-rt-vanilla-3.0.9-rt26.46.el6rt")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"kernel-rt-vanilla-debuginfo-3.0.9-rt26.46.el6rt")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"kernel-rt-vanilla-devel-3.0.9-rt26.46.el6rt")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() + redhat_report_package_caveat() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "kernel-rt / kernel-rt-debug / kernel-rt-debug-debuginfo / etc"); } }NASL family SuSE Local Security Checks NASL id OPENSUSE-2012-65.NASL description The openSUSE 12.1 kernel was updated to 3.1.9 to fix bugs and security issues. The full list of changes in 3.1.9 is available here : http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.9 http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.8 http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.7 http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.6 http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.5 http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.4 http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.3 http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.2 http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.2 Following security issues have been fixed : CVE-2011-2203: Missing NULL pointer check in hfs filesystem code CVE-2011-4604: Fix possible kernel memory corruption if B.A.T.M.A.N. mesh protocol is being used. CVE-2012-0056: Local root vulnerability via writing to /proc/pid/mem CVE-2012-0207: Remote DoS vulnerability via crafted IGMP packages. Following non-security bug fixes have been added : - BTRFS support has been improved with many bug fixes. last seen 2020-06-05 modified 2014-06-13 plugin id 74767 published 2014-06-13 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/74767 title openSUSE Security Update : kernel (openSUSE-2012-65) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update openSUSE-2012-65. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(74767); script_version("1.4"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04"); script_cve_id("CVE-2011-2203", "CVE-2011-4604", "CVE-2012-0056", "CVE-2012-0207"); script_name(english:"openSUSE Security Update : kernel (openSUSE-2012-65)"); script_summary(english:"Check for the openSUSE-2012-65 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "The openSUSE 12.1 kernel was updated to 3.1.9 to fix bugs and security issues. The full list of changes in 3.1.9 is available here : http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.9 http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.8 http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.7 http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.6 http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.5 http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.4 http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.3 http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.2 http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.2 Following security issues have been fixed : CVE-2011-2203: Missing NULL pointer check in hfs filesystem code CVE-2011-4604: Fix possible kernel memory corruption if B.A.T.M.A.N. mesh protocol is being used. CVE-2012-0056: Local root vulnerability via writing to /proc/pid/mem CVE-2012-0207: Remote DoS vulnerability via crafted IGMP packages. Following non-security bug fixes have been added : - BTRFS support has been improved with many bug fixes." ); # http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.2 script_set_attribute( attribute:"see_also", value:"https://mirrors.edge.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.2" ); # http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.3 script_set_attribute( attribute:"see_also", value:"https://mirrors.edge.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.3" ); # http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.4 script_set_attribute( attribute:"see_also", value:"https://mirrors.edge.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.4" ); # http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.5 script_set_attribute( attribute:"see_also", value:"https://mirrors.edge.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.5" ); # http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.6 script_set_attribute( attribute:"see_also", value:"https://mirrors.edge.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.6" ); # http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.7 script_set_attribute( attribute:"see_also", value:"https://mirrors.edge.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.7" ); # http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.8 script_set_attribute( attribute:"see_also", value:"https://mirrors.edge.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.8" ); # http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.9 script_set_attribute( attribute:"see_also", value:"https://mirrors.edge.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.9" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=672923" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=679059" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=689860" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=691052" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=698540" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=699709" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=724616" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=724620" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=724734" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=726296" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=727348" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=730103" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=730731" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=731261" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=736149" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=737624" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=740118" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=742279" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=742322" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=743608" ); script_set_attribute( attribute:"solution", value:"Update the affected kernel packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"exploit_framework_canvas", value:"true"); script_set_attribute(attribute:"canvas_package", value:'CANVAS'); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-debug"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-debug-base"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-debug-base-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-debug-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-debug-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-debug-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-debug-devel-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-default"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-default-base"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-default-base-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-default-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-default-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-default-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-default-devel-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-desktop"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-desktop-base"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-desktop-base-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-desktop-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-desktop-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-desktop-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-desktop-devel-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-ec2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-ec2-base"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-ec2-base-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-ec2-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-ec2-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-ec2-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-ec2-devel-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-ec2-extra"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-ec2-extra-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-pae"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-pae-base"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-pae-base-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-pae-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-pae-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-pae-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-pae-devel-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-source"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-source-vanilla"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-syms"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-trace"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-trace-base"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-trace-base-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-trace-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-trace-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-trace-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-trace-devel-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-vanilla"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-vanilla-base"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-vanilla-base-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-vanilla-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-vanilla-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-vanilla-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-vanilla-devel-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-xen"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-xen-base"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-xen-base-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-xen-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-xen-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-xen-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-xen-devel-debuginfo"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:12.1"); script_set_attribute(attribute:"patch_publication_date", value:"2012/01/27"); script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE12\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "12.1", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE12.1", reference:"kernel-debug-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-debug-base-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-debug-base-debuginfo-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-debug-debuginfo-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-debug-debugsource-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-debug-devel-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-debug-devel-debuginfo-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-default-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-default-base-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-default-base-debuginfo-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-default-debuginfo-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-default-debugsource-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-default-devel-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-default-devel-debuginfo-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-desktop-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-desktop-base-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-desktop-base-debuginfo-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-desktop-debuginfo-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-desktop-debugsource-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-desktop-devel-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-desktop-devel-debuginfo-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-devel-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-ec2-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-ec2-base-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-ec2-base-debuginfo-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-ec2-debuginfo-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-ec2-debugsource-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-ec2-devel-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-ec2-devel-debuginfo-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-ec2-extra-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-ec2-extra-debuginfo-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-pae-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-pae-base-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-pae-base-debuginfo-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-pae-debuginfo-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-pae-debugsource-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-pae-devel-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-pae-devel-debuginfo-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-source-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-source-vanilla-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-syms-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-trace-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-trace-base-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-trace-base-debuginfo-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-trace-debuginfo-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-trace-debugsource-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-trace-devel-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-trace-devel-debuginfo-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-vanilla-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-vanilla-base-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-vanilla-base-debuginfo-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-vanilla-debuginfo-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-vanilla-debugsource-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-vanilla-devel-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-vanilla-devel-debuginfo-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-xen-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-xen-base-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-xen-base-debuginfo-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-xen-debuginfo-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-xen-debugsource-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-xen-devel-3.1.9-1.4.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"kernel-xen-devel-debuginfo-3.1.9-1.4.1") ) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "kernel"); }NASL family Fedora Local Security Checks NASL id FEDORA_2012-0876.NASL description Rebase F16 to the 3.2.1 stable release. Also fixes CVEs : - CVE-2012-0056 - CVE-2011-4127 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2012-01-25 plugin id 57674 published 2012-01-25 reporter This script is Copyright (C) 2012-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/57674 title Fedora 16 : kernel-3.2.1-3.fc16 (2012-0876) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2012-2001.NASL description Description of changes: * Improved fix for CVE-2010-2962. The original upstream fix for CVE-2010-2962 had an overflow bug in its bounds checking. * CVE-2012-0056: Privilege escalation in /proc/[pid]/mem writing. It was found that permissions were not checked properly in the Linux kernel when handling the /proc/[pid]/mem writing functionality. A local, unprivileged user could use this flaw to escalate their privileges. [2.6.32-300.7.1.el6uek] - Revert last seen 2020-06-01 modified 2020-06-02 plugin id 68668 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/68668 title Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2012-2001) NASL family Scientific Linux Local Security Checks NASL id SL_20120123_KERNEL_ON_SL6_X.NASL description The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issue : - It was found that permissions were not checked properly in the Linux kernel when handling the /proc/[pid]/mem writing functionality. A local, unprivileged user could use this flaw to escalate their privileges. (CVE-2012-0056, Important) This update fixes the following bugs : - The 2.6.32-220.2.1.el6 kernel update introduced a bug in the Linux kernel scheduler, causing a last seen 2020-03-18 modified 2012-08-01 plugin id 61221 published 2012-08-01 reporter This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/61221 title Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20120123) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2012-0052.NASL description Updated kernel packages that fix one security issue and three bugs are now available for for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issue : * It was found that permissions were not checked properly in the Linux kernel when handling the /proc/[pid]/mem writing functionality. A local, unprivileged user could use this flaw to escalate their privileges. Refer to Red Hat Knowledgebase article DOC-69129, linked to in the References, for further information. (CVE-2012-0056, Important) Red Hat would like to thank Juri Aedla for reporting this issue. This update fixes the following bugs : * The RHSA-2011:1849 kernel update introduced a bug in the Linux kernel scheduler, causing a last seen 2020-06-01 modified 2020-06-02 plugin id 57669 published 2012-01-25 reporter This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/57669 title CentOS 6 : kernel (CESA-2012:0052) NASL family Fedora Local Security Checks NASL id FEDORA_2012-0861.NASL description Update to the 3.1.10 stable release (Fedora 2.6.41.10). Also fixes CVEs : - CVE-2012-0056 - CVE-2011-4127 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2012-01-25 plugin id 57673 published 2012-01-25 reporter This script is Copyright (C) 2012-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/57673 title Fedora 15 : kernel-2.6.41.10-3.fc15 (2012-0861) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2012-0052.NASL description From Red Hat Security Advisory 2012:0052 : Updated kernel packages that fix one security issue and three bugs are now available for for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issue : * It was found that permissions were not checked properly in the Linux kernel when handling the /proc/[pid]/mem writing functionality. A local, unprivileged user could use this flaw to escalate their privileges. Refer to Red Hat Knowledgebase article DOC-69129, linked to in the References, for further information. (CVE-2012-0056, Important) Red Hat would like to thank Juri Aedla for reporting this issue. This update fixes the following bugs : * The RHSA-2011:1849 kernel update introduced a bug in the Linux kernel scheduler, causing a last seen 2020-06-01 modified 2020-06-02 plugin id 68435 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/68435 title Oracle Linux 6 : kernel (ELSA-2012-0052) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-1342-1.NASL description Juri Aedla discovered that the kernel incorrectly handled /proc/<pid>/mem permissions. A local attacker could exploit this and gain root privileges. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 57697 published 2012-01-26 reporter Ubuntu Security Notice (C) 2012-2019 Canonical, Inc. / NASL script (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/57697 title Ubuntu 10.04 LTS : linux-lts-backport-oneiric vulnerability (USN-1342-1) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2012-0109.NASL description An updated rhev-hypervisor6 package that fixes multiple security issues and various bugs is now available. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The rhev-hypervisor6 package provides a Red Hat Enterprise Virtualization Hypervisor ISO disk image. The Red Hat Enterprise Virtualization Hypervisor is a dedicated Kernel-based Virtual Machine (KVM) hypervisor. It includes everything necessary to run and manage virtual machines: A subset of the Red Hat Enterprise Linux operating environment and the Red Hat Enterprise Virtualization Agent. Note: Red Hat Enterprise Virtualization Hypervisor is only available for the Intel 64 and AMD64 architectures with virtualization extensions. A heap overflow flaw was found in the way QEMU-KVM emulated the e1000 network interface card. A privileged guest user in a virtual machine whose network interface is configured to use the e1000 emulated driver could use this flaw to crash the host or, possibly, escalate their privileges on the host. (CVE-2012-0029) An information leak flaw was found in the SSL 3.0 protocol implementation in OpenSSL. Incorrect initialization of SSL record padding bytes could cause an SSL client or server to send a limited amount of possibly sensitive data to its SSL peer via the encrypted connection. (CVE-2011-4576) A denial of service flaw was found in the RFC 3779 implementation in OpenSSL. A remote attacker could use this flaw to make an application using OpenSSL exit unexpectedly by providing a specially crafted X.509 certificate that has malformed RFC 3779 extension data. (CVE-2011-4577) It was discovered that OpenSSL did not limit the number of TLS/SSL handshake restarts required to support Server Gated Cryptography. A remote attacker could use this flaw to make a TLS/SSL server using OpenSSL consume an excessive amount of CPU by continuously restarting the handshake. (CVE-2011-4619) Red Hat would like to thank Nicolae Mogoreanu for reporting CVE-2012-0029. This updated package provides updated components that include fixes for various security issues. These issues have no security impact on Red Hat Enterprise Virtualization Hypervisor itself, however. The security fixes included in this update address the following CVE numbers : CVE-2009-5029 and CVE-2011-4609 (glibc issues) CVE-2012-0056 (kernel issue) CVE-2011-4108 and CVE-2012-0050 (openssl issues) This update also fixes the following bugs : * Previously, it was possible to begin a Hypervisor installation without any valid disks to install to. Now, if no valid disks are found for Hypervisor installation, a message is displayed informing the user that there are no valid disks for installation. (BZ#781471) * Previously, the user interface for the Hypervisor did not indicate whether the system was registered with Red Hat Network (RHN) Classic or RHN Satellite. As a result, customers could not easily determine the registration status of their Hypervisor installations. The TUI has been updated to display the registration status of the Hypervisor. (BZ#788223) * Previously, autoinstall would fail if the firstboot or reinstall options were passed but local_boot or upgrade were not passed. Now, neither the local_boot or upgrade parameters are required for autoinstall. (BZ#788225) Users of the Red Hat Enterprise Virtualization Hypervisor are advised to upgrade to this updated package, which fixes these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 79282 published 2014-11-17 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/79282 title RHEL 6 : rhev-hypervisor6 (RHSA-2012:0109) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-1364-1.NASL description A flaw was discovered in the XFS filesystem. If a local user mounts a specially crafted XFS image it could potential execute arbitrary code on the system. (CVE-2012-0038) Andy Whitcroft discovered a that the Overlayfs filesystem was not doing the extended permission checks needed by cgroups and Linux Security Modules (LSMs). A local user could exploit this to by-pass security policy and access files that should not be accessible. (CVE-2012-0055) Juri Aedla discovered that the kernel incorrectly handled /proc/<pid>/mem permissions. A local attacker could exploit this and gain root privileges. (CVE-2012-0056) A flaw was found in the linux kernels IPv4 IGMP query processing. A remote attacker could exploit this to cause a denial of service. (CVE-2012-0207) last seen 2020-06-01 modified 2020-06-02 plugin id 57938 published 2012-02-14 reporter Ubuntu Security Notice (C) 2012 Canonical, Inc. / NASL script (C) 2012-2016 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/57938 title USN-1364-1 : linux-ti-omap4 vulnerabilities NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2012-0052.NASL description Updated kernel packages that fix one security issue and three bugs are now available for for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issue : * It was found that permissions were not checked properly in the Linux kernel when handling the /proc/[pid]/mem writing functionality. A local, unprivileged user could use this flaw to escalate their privileges. Refer to Red Hat Knowledgebase article DOC-69129, linked to in the References, for further information. (CVE-2012-0056, Important) Red Hat would like to thank Juri Aedla for reporting this issue. This update fixes the following bugs : * The RHSA-2011:1849 kernel update introduced a bug in the Linux kernel scheduler, causing a last seen 2020-04-16 modified 2012-01-24 plugin id 57657 published 2012-01-24 reporter This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/57657 title RHEL 6 : kernel (RHSA-2012:0052) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-1336-1.NASL description Clement Lecigne discovered a bug in the HFS filesystem. A local attacker could exploit this to cause a kernel oops. (CVE-2011-2203) A bug was discovered in the XFS filesystem last seen 2020-06-01 modified 2020-06-02 plugin id 57660 published 2012-01-24 reporter Ubuntu Security Notice (C) 2012-2019 Canonical, Inc. / NASL script (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/57660 title Ubuntu 11.10 : linux vulnerability (USN-1336-1)
Redhat
| advisories |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| rpms |
|
Seebug
bulletinFamily exploit description No description provided by source. id SSV:30042 last seen 2017-11-19 modified 2012-01-23 published 2012-01-23 reporter Root source https://www.seebug.org/vuldb/ssvid-30042 title Mempodipper - Linux Local Root for >=2.6.39, 32-bit and 64-bit bulletinFamily exploit description BUGTRAQ ID: 51625 CVE ID: CVE-2012-0056 Linux是自由电脑操作系统内核。 Linux Kernel在SUID /proc/pid/mem write的实现上存在本地权限提升漏洞，攻击者可利用此漏洞获取提升的权限，以内核级别执行任意代码 0 Linux kernel 2.6.x http://www.kb.cert.org/vuls/id/470151 http://blog.zx2c4.com/749 id SSV:30070 last seen 2017-11-19 modified 2012-02-03 published 2012-02-03 reporter Root source https://www.seebug.org/vuldb/ssvid-30070 title Linux kernel 2.6.x write本地权限提升漏洞(CVE-2012-0056) bulletinFamily exploit description No description provided by source. id SSV:87351 last seen 2017-11-19 modified 2014-11-13 published 2014-11-13 reporter Root source https://www.seebug.org/vuldb/ssvid-87351 title Linux Local Root => 2.6.39 (32-bit & 64-bit) - Mempodipper #2 bulletinFamily exploit description No description provided by source. id SSV:72522 last seen 2017-11-19 modified 2014-07-01 published 2014-07-01 reporter Root source https://www.seebug.org/vuldb/ssvid-72522 title Linux Local Root => 2.6.39 (32-bit & 64-bit) - Mempodipper
References
- http://secunia.com/advisories/47708
- http://ubuntu.com/usn/usn-1336-1
- http://www.redhat.com/support/errata/RHSA-2012-0052.html
- http://www.openwall.com/lists/oss-security/2012/01/22/4
- https://bugzilla.redhat.com/show_bug.cgi?id=782642
- http://www.openwall.com/lists/oss-security/2012/01/18/1
- http://www.openwall.com/lists/oss-security/2012/01/19/4
- http://www.redhat.com/support/errata/RHSA-2012-0061.html
- http://www.securityfocus.com/bid/51625
- http://blog.zx2c4.com/749
- http://www.openwall.com/lists/oss-security/2012/01/18/2
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.2
- http://www.kb.cert.org/vuls/id/470151
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=e268337dfe26dfc7efd422a804dbb27977a3cccc