The IPsec implementation in Linux kernel before 2.6.25 allows remote routers to cause a denial of service (crash) via a fragmented ESP packet in which the first fragment does not contain the entire ESP header and IV.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix utrace dead_engine ops race

  - fix ptrace_attach leak

  - CVE-2007-5093: kernel PWC driver DoS

  - CVE-2007-6282: IPSec ESP kernel panics

  - CVE-2007-6712: kernel: infinite loop in highres timers     (kernel hang)

  - CVE-2008-1615: kernel: ptrace: Unprivileged crash on     x86_64 %cs corruption

  - CVE-2008-1294: kernel: setrlimit(RLIMIT_CPUINFO) with     zero value doesn't inherit properly across children

  - CVE-2008-2136: kernel: sit memory leak

  - CVE-2008-2812: kernel: NULL ptr dereference in multiple     network drivers due to missing checks in tty code

  - restore     linux-2.6-x86-clear-df-flag-for-signal-handlers.patch

  - restore linux-2.6-utrace.patch /     linux-2.6-xen-utrace.patch

  - Kernel security erratas for OVM 2.1.2 from bz#5932 :

  - CVE-2007-6063: isdn: fix possible isdn_net buffer     overflows

  - CVE-2007-3104 Null pointer to an inode in a dentry can     cause an oops in sysfs_readdir

  - CVE-2008-0598: write system call vulnerability

  - CVE-2008-1375: kernel: race condition in dnotify

  - CVE-2008-0001: kernel: filesystem corruption by     unprivileged user via directory truncation

  - CVE-2008-2358: dccp: sanity check feature length

  - CVE-2007-5938: NULL dereference in iwl driver

  - RHSA-2008:0508: kernel: [x86_64] The string instruction     version didn't zero the output on exception.

  - kernel: clear df flag for signal handlers

  - fs: missing dput in do_lookup error leaks dentries

  - sysfs: fix condition check in sysfs_drop_dentry

  - sysfs: fix race condition around sd->s_dentry

  - ieee80211: off-by-two integer underflow

From Red Hat Security Advisory 2008:0275 :

Updated kernel packages that fix various security issues and several bugs are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

These updated packages fix the following security issues :

* on AMD64 architectures, the possibility of a kernel crash was discovered by testing the Linux kernel process-trace ability. This could allow a local unprivileged user to cause a denial of service (kernel crash). (CVE-2008-1615, Important)

* on 64-bit architectures, the possibility of a timer-expiration value overflow was found in the Linux kernel high-resolution timers functionality, hrtimer. This could allow a local unprivileged user to setup a large interval value, forcing the timer expiry value to become negative, causing a denial of service (kernel hang). (CVE-2007-6712, Important)

* the possibility of a kernel crash was found in the Linux kernel IPsec protocol implementation, due to improper handling of fragmented ESP packets. When an attacker controlling an intermediate router fragmented these packets into very small pieces, it would cause a kernel crash on the receiving node during packet reassembly.
(CVE-2007-6282, Important)

* a potential denial of service attack was discovered in the Linux kernel PWC USB video driver. A local unprivileged user could use this flaw to bring the kernel USB subsystem into the busy-waiting state, causing a denial of service. (CVE-2007-5093, Low)

As well, these updated packages fix the following bugs :

* in certain situations, a kernel hang and a possible panic occurred when disabling the cpufreq daemon. This may have prevented system reboots from completing successfully.

* continual 'softlockup' messages, which occurred on the guest's console after a successful save and restore of a Red Hat Enterprise Linux 5 para-virtualized guest, have been resolved.

* in the previous kernel packages, the kernel may not have reclaimed NFS locks after a system reboot.

Red Hat Enterprise Linux 5 users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

From Red Hat Security Advisory 2008:0237 :

Updated kernel packages that fix various security issues and several bugs are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

These updated packages fix the following security issues :

* the absence of a protection mechanism when attempting to access a critical section of code has been found in the Linux kernel open file descriptors control mechanism, fcntl. This could allow a local unprivileged user to simultaneously execute code, which would otherwise be protected against parallel execution. As well, a race condition when handling locks in the Linux kernel fcntl functionality, may have allowed a process belonging to a local unprivileged user to gain re-ordered access to the descriptor table. (CVE-2008-1669, Important)

* on AMD64 architectures, the possibility of a kernel crash was discovered by testing the Linux kernel process-trace ability. This could allow a local unprivileged user to cause a denial of service (kernel crash). (CVE-2008-1615, Important)

* the absence of a protection mechanism when attempting to access a critical section of code, as well as a race condition, have been found in the Linux kernel file system event notifier, dnotify. This could allow a local unprivileged user to get inconsistent data, or to send arbitrary signals to arbitrary system processes. (CVE-2008-1375, Important)

Red Hat would like to thank Nick Piggin for responsibly disclosing the following issue :

* when accessing kernel memory locations, certain Linux kernel drivers registering a fault handler did not perform required range checks. A local unprivileged user could use this flaw to gain read or write access to arbitrary kernel memory, or possibly cause a kernel crash.
(CVE-2008-0007, Important)

* the possibility of a kernel crash was found in the Linux kernel IPsec protocol implementation, due to improper handling of fragmented ESP packets. When an attacker controlling an intermediate router fragmented these packets into very small pieces, it would cause a kernel crash on the receiving node during packet reassembly.
(CVE-2007-6282, Important)

* a flaw in the MOXA serial driver could allow a local unprivileged user to perform privileged operations, such as replacing firmware.
(CVE-2005-0504, Important)

As well, these updated packages fix the following bugs :

* multiple buffer overflows in the neofb driver have been resolved. It was not possible for an unprivileged user to exploit these issues, and as such, they have not been handled as security issues.

* a kernel panic, due to inconsistent detection of AGP aperture size, has been resolved.

* a race condition in UNIX domain sockets may have caused 'recv()' to return zero. In clustered configurations, this may have caused unexpected failovers.

* to prevent link storms, network link carrier events were delayed by up to one second, causing unnecessary packet loss. Now, link carrier events are scheduled immediately.

* a client-side race on blocking locks caused large time delays on NFS file systems.

* in certain situations, the libATA sata_nv driver may have sent commands with duplicate tags, which were rejected by SATA devices.
This may have caused infinite reboots.

* running the 'service network restart' command may have caused networking to fail.

* a bug in NFS caused cached information about directories to be stored for too long, causing wrong attributes to be read.

* on systems with a large highmem/lowmem ratio, NFS write performance may have been very slow when using small files.

* a bug, which caused network hangs when the system clock was wrapped around zero, has been resolved.

Red Hat Enterprise Linux 4 users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

These updated packages fix the following security issues :

  - the absence of a protection mechanism when attempting to     access a critical section of code has been found in the     Linux kernel open file descriptors control mechanism,     fcntl. This could allow a local unprivileged user to     simultaneously execute code, which would otherwise be     protected against parallel execution. As well, a race     condition when handling locks in the Linux kernel fcntl     functionality, may have allowed a process belonging to a     local unprivileged user to gain re-ordered access to the     descriptor table. (CVE-2008-1669, Important)

  - on AMD64 architectures, the possibility of a kernel     crash was discovered by testing the Linux kernel     process-trace ability. This could allow a local     unprivileged user to cause a denial of service (kernel     crash). (CVE-2008-1615, Important)

  - the absence of a protection mechanism when attempting to     access a critical section of code, as well as a race     condition, have been found in the Linux kernel file     system event notifier, dnotify. This could allow a local     unprivileged user to get inconsistent data, or to send     arbitrary signals to arbitrary system processes.
    (CVE-2008-1375, Important)

  - when accessing kernel memory locations, certain Linux     kernel drivers registering a fault handler did not     perform required range checks. A local unprivileged user     could use this flaw to gain read or write access to     arbitrary kernel memory, or possibly cause a kernel     crash. (CVE-2008-0007, Important)

  - the possibility of a kernel crash was found in the Linux     kernel IPsec protocol implementation, due to improper     handling of fragmented ESP packets. When an attacker     controlling an intermediate router fragmented these     packets into very small pieces, it would cause a kernel     crash on the receiving node during packet reassembly.
    (CVE-2007-6282, Important)

  - a flaw in the MOXA serial driver could allow a local     unprivileged user to perform privileged operations, such     as replacing firmware. (CVE-2005-0504, Important)

As well, these updated packages fix the following bugs :

  - multiple buffer overflows in the neofb driver have been     resolved. It was not possible for an unprivileged user     to exploit these issues, and as such, they have not been     handled as security issues.

  - a kernel panic, due to inconsistent detection of AGP     aperture size, has been resolved.

  - a race condition in UNIX domain sockets may have caused     'recv()' to return zero. In clustered configurations,     this may have caused unexpected failovers.

  - to prevent link storms, network link carrier events were     delayed by up to one second, causing unnecessary packet     loss. Now, link carrier events are scheduled     immediately.

  - a client-side race on blocking locks caused large time     delays on NFS file systems.

  - in certain situations, the libATA sata_nv driver may     have sent commands with duplicate tags, which were     rejected by SATA devices. This may have caused infinite     reboots.

  - running the 'service network restart' command may have     caused networking to fail.

  - a bug in NFS caused cached information about directories     to be stored for too long, causing wrong attributes to     be read.

  - on systems with a large highmem/lowmem ratio, NFS write     performance may have been very slow when using small     files.

  - a bug, which caused network hangs when the system clock     was wrapped around zero, has been resolved.

This kernel update fixes quite a number of security problems :

  - A remote attacker could crash the IPSec/IPv6 stack by     sending a bad ESP packet. This requires the host to be     able to receive such packets (default filtered by the     firewall). (CVE-2007-6282)

  - A problem in SIT IPv6 tunnel handling could be used by     remote attackers to immediately crash the machine.
    (CVE-2008-2136)

  - On x86_64 a denial of service attack could be used by     local attackers to immediately panic / crash the     machine. (CVE-2008-1615)

  - An information leakage during coredumping of root     processes was fixed. (CVE-2007-6206)

  - Fixed a SMP ordering problem in fcntl_setlk could     potentially allow local attackers to execute code by     timing file locking. (CVE-2008-1669)

  - Fixed a dnotify race condition, which could be used by     local attackers to potentially execute code.
    (CVE-2008-1375)

  - A ptrace bug could be used by local attackers to hang     their own processes indefinitely. (CVE-2007-5500)

  - Clear the 'direction' flag before calling signal     handlers. For specific not yet identified programs under     specific timing conditions this could potentially have     caused memory corruption or code execution.
    (CVE-2008-1367)

  - The isdn_ioctl function in isdn_common.c allowed local     users to cause a denial of service via a crafted ioctl     struct in which ioctls is not null terminated, which     triggers a buffer overflow. (CVE-2007-6151)

Non security related changes :

OCFS2 was updated to version v1.2.9-1-r3100.

Also a huge number of bugs were fixed. Please refer to the RPM changelog for a detailed list.

Updated kernel packages that fix various security issues and several bugs are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

These updated packages fix the following security issues :

* on AMD64 architectures, the possibility of a kernel crash was discovered by testing the Linux kernel process-trace ability. This could allow a local unprivileged user to cause a denial of service (kernel crash). (CVE-2008-1615, Important)

* on 64-bit architectures, the possibility of a timer-expiration value overflow was found in the Linux kernel high-resolution timers functionality, hrtimer. This could allow a local unprivileged user to setup a large interval value, forcing the timer expiry value to become negative, causing a denial of service (kernel hang). (CVE-2007-6712, Important)

* the possibility of a kernel crash was found in the Linux kernel IPsec protocol implementation, due to improper handling of fragmented ESP packets. When an attacker controlling an intermediate router fragmented these packets into very small pieces, it would cause a kernel crash on the receiving node during packet reassembly.
(CVE-2007-6282, Important)

* a potential denial of service attack was discovered in the Linux kernel PWC USB video driver. A local unprivileged user could use this flaw to bring the kernel USB subsystem into the busy-waiting state, causing a denial of service. (CVE-2007-5093, Low)

As well, these updated packages fix the following bugs :

* in certain situations, a kernel hang and a possible panic occurred when disabling the cpufreq daemon. This may have prevented system reboots from completing successfully.

* continual 'softlockup' messages, which occurred on the guest's console after a successful save and restore of a Red Hat Enterprise Linux 5 para-virtualized guest, have been resolved.

* in the previous kernel packages, the kernel may not have reclaimed NFS locks after a system reboot.

Red Hat Enterprise Linux 5 users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

Updated kernel packages that fix various security issues and several bugs are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

These updated packages fix the following security issues :

* the absence of a protection mechanism when attempting to access a critical section of code has been found in the Linux kernel open file descriptors control mechanism, fcntl. This could allow a local unprivileged user to simultaneously execute code, which would otherwise be protected against parallel execution. As well, a race condition when handling locks in the Linux kernel fcntl functionality, may have allowed a process belonging to a local unprivileged user to gain re-ordered access to the descriptor table. (CVE-2008-1669, Important)

* on AMD64 architectures, the possibility of a kernel crash was discovered by testing the Linux kernel process-trace ability. This could allow a local unprivileged user to cause a denial of service (kernel crash). (CVE-2008-1615, Important)

* the absence of a protection mechanism when attempting to access a critical section of code, as well as a race condition, have been found in the Linux kernel file system event notifier, dnotify. This could allow a local unprivileged user to get inconsistent data, or to send arbitrary signals to arbitrary system processes. (CVE-2008-1375, Important)

Red Hat would like to thank Nick Piggin for responsibly disclosing the following issue :

* when accessing kernel memory locations, certain Linux kernel drivers registering a fault handler did not perform required range checks. A local unprivileged user could use this flaw to gain read or write access to arbitrary kernel memory, or possibly cause a kernel crash.
(CVE-2008-0007, Important)

* the possibility of a kernel crash was found in the Linux kernel IPsec protocol implementation, due to improper handling of fragmented ESP packets. When an attacker controlling an intermediate router fragmented these packets into very small pieces, it would cause a kernel crash on the receiving node during packet reassembly.
(CVE-2007-6282, Important)

* a flaw in the MOXA serial driver could allow a local unprivileged user to perform privileged operations, such as replacing firmware.
(CVE-2005-0504, Important)

As well, these updated packages fix the following bugs :

* multiple buffer overflows in the neofb driver have been resolved. It was not possible for an unprivileged user to exploit these issues, and as such, they have not been handled as security issues.

* a kernel panic, due to inconsistent detection of AGP aperture size, has been resolved.

* a race condition in UNIX domain sockets may have caused 'recv()' to return zero. In clustered configurations, this may have caused unexpected failovers.

* to prevent link storms, network link carrier events were delayed by up to one second, causing unnecessary packet loss. Now, link carrier events are scheduled immediately.

* a client-side race on blocking locks caused large time delays on NFS file systems.

* in certain situations, the libATA sata_nv driver may have sent commands with duplicate tags, which were rejected by SATA devices.
This may have caused infinite reboots.

* running the 'service network restart' command may have caused networking to fail.

* a bug in NFS caused cached information about directories to be stored for too long, causing wrong attributes to be read.

* on systems with a large highmem/lowmem ratio, NFS write performance may have been very slow when using small files.

* a bug, which caused network hangs when the system clock was wrapped around zero, has been resolved.

Red Hat Enterprise Linux 4 users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or arbitrary code execution. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-6282     Dirk Nehring discovered a vulnerability in the IPsec     code that allows remote users to cause a denial of     service by sending a specially crafted ESP packet.

  - CVE-2008-0598     Tavis Ormandy discovered a vulnerability that allows     local users to access uninitialized kernel memory,     possibly leaking sensitive data. This issue is specific     to the amd64-flavour kernel images.

  - CVE-2008-2729     Andi Kleen discovered an issue where uninitialized     kernel memory was being leaked to userspace during an     exception. This issue may allow local users to gain     access to sensitive data. Only the amd64-flavour Debian     kernel images are affected.

  - CVE-2008-2812     Alan Cox discovered an issue in multiple tty drivers     that allows local users to trigger a denial of service     (NULL pointer dereference) and possibly obtain elevated     privileges.

  - CVE-2008-2826     Gabriel Campana discovered an integer overflow in the     sctp code that can be exploited by local users to cause     a denial of service.

  - CVE-2008-2931     Miklos Szeredi reported a missing privilege check in the     do_change_type() function. This allows local,     unprivileged users to change the properties of mount     points.

  - CVE-2008-3272     Tobias Klein reported a locally exploitable data leak in     the snd_seq_oss_synth_make_info() function. This may     allow local users to gain access to sensitive     information.

  - CVE-2008-3275     Zoltan Sogor discovered a coding error in the VFS that     allows local users to exploit a kernel memory leak     resulting in a denial of service.

Dirk Nehring discovered that the IPsec protocol stack did not correctly handle fragmented ESP packets. A remote attacker could exploit this to crash the system, leading to a denial of service.
(CVE-2007-6282)

Johannes Bauer discovered that the 64bit kernel did not correctly handle hrtimer updates. A local attacker could request a large expiration value and cause the system to hang, leading to a denial of service. (CVE-2007-6712)

Tavis Ormandy discovered that the ia32 emulation under 64bit kernels did not fully clear uninitialized data. A local attacker could read private kernel memory, leading to a loss of privacy. (CVE-2008-0598)

Jan Kratochvil discovered that PTRACE did not correctly handle certain calls when running under 64bit kernels. A local attacker could exploit this to crash the system, leading to a denial of service.
(CVE-2008-1615)

Wei Wang discovered that the ASN.1 decoding routines in CIFS and SNMP NAT did not correctly handle certain length values. Remote attackers could exploit this to execute arbitrary code or crash the system.
(CVE-2008-1673)

Paul Marks discovered that the SIT interfaces did not correctly manage allocated memory. A remote attacker could exploit this to fill all available memory, leading to a denial of service. (CVE-2008-2136)

David Miller and Jan Lieskovsky discovered that the Sparc kernel did not correctly range-check memory regions allocated with mmap. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2008-2137)

The sys_utimensat system call did not correctly check file permissions in certain situations. A local attacker could exploit this to modify the file times of arbitrary files which could lead to a denial of service. (CVE-2008-2148)

Brandon Edwards discovered that the DCCP system in the kernel did not correctly check feature lengths. A remote attacker could exploit this to execute arbitrary code. (CVE-2008-2358)

A race condition was discovered between ptrace and utrace in the kernel. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2008-2365)

The copy_to_user routine in the kernel did not correctly clear memory destination addresses when running on 64bit kernels. A local attacker could exploit this to gain access to sensitive kernel memory, leading to a loss of privacy. (CVE-2008-2729)

The PPP over L2TP routines in the kernel did not correctly handle certain messages. A remote attacker could send a specially crafted packet that could crash the system or execute arbitrary code.
(CVE-2008-2750)

Gabriel Campana discovered that SCTP routines did not correctly check for large addresses. A local user could exploit this to allocate all available memory, leading to a denial of service. (CVE-2008-2826).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This kernel update fixes the following security problems:
CVE-2008-2136: A problem in SIT IPv6 tunnel handling could be used by remote attackers to immediately crash the machine.

CVE-2008-1615: On x86_64 a denial of service attack could be used by local attackers to immediately panic / crash the machine.

CVE-2008-2148: The permission checking in sys_utimensat was incorrect and local attackers could change the filetimes of files they do not own to the current time.

CVE-2008-1669: Fixed a SMP ordering problem in fcntl_setlk could potentially allow local attackers to execute code by timing file locking.

CVE-2008-1375: Fixed a dnotify race condition, which could be used by local attackers to potentially execute code.

CVE-2007-6282: A remote attacker could crash the IPSec/IPv6 stack by sending a bad ESP packet. This requires the host to be able to receive such packets (default filtered by the firewall).

CVE-2008-1367: Clear the 'direction' flag before calling signal handlers. For specific not yet identified programs under specific timing conditions this could potentially have caused memory corruption or code execution.

And the following bugs (numbers are https://bugzilla.novell.com/ references) :

  - patches.fixes/input-add-amilo-pro-v-to-nomux.patch:
    Update the patch to include also 2030 model to nomux     list (bnc#389169).

  - patches.apparmor/fix-net.diff: AppArmor: fix Oops in     apparmor_socket_getpeersec_dgram() (bnc#378608).

  - patches.fixes/input-alps-update.patch: Input: fix the     AlpsPS2 driver (bnc#357881).

- patches.arch/cpufreq_fix_acpi_driver_on_BIOS_changes.patch: CPUFREQ:
Check against freq changes from the BIOS (334378).

- patches.fixes/ieee1394-limit-early-node-speed-to-host-interf ace-speed: ieee1394: limit early node speed to host interface speed (381304).

  - patches.fixes/forcedeth_realtec_phy_fix: Fix a     regression to the GA kernel for some forcedeth cards     (bnc#379478)

  - pci-revert-SMBus-unhide-on-nx6110.patch: Do not unhide     the SMBus on the HP Compaq nx6110, it's unsafe.

  - patches.drivers/e1000-disable-l1aspm.patch: Disable L1     ASPM power savings for 82573 mobile variants, it's     broken (bnc#254713, LTC34077).

  - patches.drivers/libata-improve-hpa-error-handling:
    libata: improve HPA error handling (365534).

  - rpm/kernel-binary.spec.in: Added Conflicts:
    libc.so.6()(64bit) to i386 arch (364433).

- patches.drivers/libata-disallow-sysfs-read-access-to-force-p aram:
libata: don't allow sysfs read access to force param (362599).

  - patches.suse/bonding-workqueue: Update to fix a hang     when closing a bonding device (342994).

  - patches.fixes/mptspi-dv-renegotiate-oops: mptlinux     crashes on kernel 2.6.22 (bnc#271749).

- patches.drivers/usb-update-sierra-and-option-device-ids-from

  -2.6.25-rc3.patch: USB: update sierra and option device   ids from 2.6.25-rc3 (343167).

  - patches.arch/x86-nvidia-timer-quirk: Disable again     (#302327) The PCI ID lists are not complete enough and     let's have the same crap as mainline for this for now.

  - patches.fixes/input-add-lenovo-3000-n100-to-nomux.patch:
    Input: add Lenovo 3000 N100 to nomux blacklist     (bnc#284013).

  - patches.suse/bonding-bh-locking: Add missing chunks. The     SLES10 SP1 version of the patch was updated in May 2007     but the openSuse 10.3 version was forgotten (260069).

- patches.fixes/knfsd-Allow-NFSv2-3-WRITE-calls-to-succeed-whe n-krb.patch: knfsd: Allow NFSv2/3 WRITE calls to succeed when krb5i etc is used. (348737).

- patches.fixes/md-fix-an-occasional-deadlock-in-raid5.patch: md: fix an occasional deadlock in raid5 (357088).

  - patches.drivers/libata-quirk_amd_ide_mode: PCI: modify     SATA IDE mode quirk (345124).

  - Fix section mismatch build failure w/ gcc 4.1.2. bug     #361086.

  - patches.drivers/libata-implement-force-parameter:
    libata: implement libata.force module parameter     (337610).

Lots of XEN Fixes (not detailed listed). Lots of RT Fixes (not detailed listed).

  - Update to 2.6.22.18

  - removes upstreamed patch :

  - patches.fixes/vmsplice-pipe-exploit (CVE-2008-0600)

This kernel update fixes the following security problems :

CVE-2008-1615: On x86_64 a denial of service attack could be used by local attackers to immediately panic / crash the machine.

CVE-2008-2358: A security problem in DCCP was fixed, which could be used by remote attackers to crash the machine.

CVE-2007-6206: An information leakage during coredumping of root processes was fixed.

CVE-2007-6712: A integer overflow in the hrtimer_forward function (hrtimer.c) in Linux kernel, when running on 64-bit systems, allows local users to cause a denial of service (infinite loop) via a timer with a large expiry value, which causes the timer to always be expired.

CVE-2008-2136: A problem in SIT IPv6 tunnel handling could be used by remote attackers to immediately crash the machine.

CVE-2008-1669: Fixed a SMP ordering problem in fcntl_setlk could potentially allow local attackers to execute code by timing file locking.

CVE-2008-1367: Clear the 'direction' flag before calling signal handlers. For specific not yet identified programs under specific timing conditions this could potentially have caused memory corruption or code execution.

CVE-2008-1375: Fixed a dnotify race condition, which could be used by local attackers to potentially execute code.

CVE-2007-6282: A remote attacker could crash the IPSec/IPv6 stack by sending a bad ESP packet. This requires the host to be able to receive such packets (default filtered by the firewall).

CVE-2007-5500: A ptrace bug could be used by local attackers to hang their own processes indefinitely.

CVE-2007-5904: A remote buffer overflow in CIFS was fixed which could be used by remote attackers to crash the machine or potentially execute code.

And the following bugs (numbers are https://bugzilla.novell.com/ references) :

  - patches.arch/x86-nosmp-implies-noapic.patch: When     booting with nosmp or maxcpus=0 on i386 or x86-64, we     must disable the I/O APIC, otherwise the system won't     boot in most cases (bnc#308540).

  - patches.arch/i386-at-sysinfo-ehdr: i386: make     AT_SYSINFO_EHDR consistent with AT_SYSINFO (bnc#289641).

  - patches.suse/bonding-workqueue: Update to fix a hang     when closing a bonding device (342994).

  - patches.fixes/mptspi-dv-renegotiate-oops: mptlinux     crashes on kernel 2.6.22 (bnc#271749).

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2008-0275.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2008-0237.

ID	Name	Product	Family	Severity
79447	OracleVM 2.1 : kernel (OVMSA-2008-2005)	Nessus	OracleVM Local Security Checks	high
67691	Oracle Linux 5 : kernel (ELSA-2008-0275)	Nessus	Oracle Linux Local Security Checks	high
67685	Oracle Linux 4 : kernel (ELSA-2008-0237)	Nessus	Oracle Linux Local Security Checks	high
60394	Scientific Linux Security Update : kernel on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
59128	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 5370)	Nessus	SuSE Local Security Checks	high
43685	CentOS 5 : kernel (CESA-2008:0275)	Nessus	CentOS Local Security Checks	high
43682	CentOS 4 : kernel (CESA-2008:0237)	Nessus	CentOS Local Security Checks	high
34032	Debian DSA-1630-1 : linux-2.6 - denial of service/information leak	Nessus	Debian Local Security Checks	high
33531	Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : linux, linux-source-2.6.15/20/22 vulnerabilities (USN-625-1)	Nessus	Ubuntu Local Security Checks	critical
33432	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 5375)	Nessus	SuSE Local Security Checks	high
33253	openSUSE 10 Security Update : kernel (kernel-5339)	Nessus	SuSE Local Security Checks	high
33252	openSUSE 10 Security Update : kernel (kernel-5336)	Nessus	SuSE Local Security Checks	high
32391	RHEL 5 : kernel (RHSA-2008:0275)	Nessus	Red Hat Local Security Checks	high
32162	RHEL 4 : kernel (RHSA-2008:0237)	Nessus	Red Hat Local Security Checks	high
801452	CentOS RHSA-2008-0275 Security Check	Log Correlation Engine	Generic	high
801451	CentOS RHSA-2008-0237 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2007-6282

high

Tenable Plugins

high

high

high

high

high

high

high

high

critical

high

high

high

high

high

high

high