The dbg_lvl file for the megaraid_sas driver in the Linux kernel before 2.6.27 has world-writable permissions, which allows local users to change the (1) behavior and (2) logging level of the driver by modifying this file.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several components and third-party libraries :

  - libpng
  - VMnc Codec
  - vmrun
  - VMware Remote Console (VMrc)
  - VMware Tools
  - vmware-authd

From Red Hat Security Advisory 2010:0076 :

Updated kernel packages that fix multiple security issues and three bugs are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* an array index error was found in the gdth driver in the Linux kernel. A local user could send a specially crafted IOCTL request that would cause a denial of service or, possibly, privilege escalation.
(CVE-2009-3080, Important)

* a flaw was found in the collect_rx_frame() function in the HiSax ISDN driver (hfc_usb) in the Linux kernel. An attacker could use this flaw to send a specially crafted HDLC packet that could trigger a buffer out of bounds, possibly resulting in a denial of service.
(CVE-2009-4005, Important)

* permission issues were found in the megaraid_sas driver (for SAS based RAID controllers) in the Linux kernel. The 'dbg_lvl' and 'poll_mode_io' files on the sysfs file system ('/sys/') had world-writable permissions. This could allow local, unprivileged users to change the behavior of the driver. (CVE-2009-3889, CVE-2009-3939, Moderate)

* a buffer overflow flaw was found in the hfs_bnode_read() function in the HFS file system implementation in the Linux kernel. This could lead to a denial of service if a user browsed a specially crafted HFS file system, for example, by running 'ls'. (CVE-2009-4020, Low)

This update also fixes the following bugs :

* if a process was using ptrace() to trace a multi-threaded process, and that multi-threaded process dumped its core, the process performing the trace could hang in wait4(). This issue could be triggered by running 'strace -f' on a multi-threaded process that was dumping its core, resulting in the strace command hanging. (BZ#555869)

* a bug in the ptrace() implementation could have, in some cases, caused ptrace_detach() to create a zombie process if the process being traced was terminated with a SIGKILL signal. (BZ#555869)

* the RHSA-2010:0020 update resolved an issue (CVE-2009-4537) in the Realtek r8169 Ethernet driver. This update implements a better solution for that issue. Note: This is not a security regression. The original fix was complete. This update is adding the official upstream fix. (BZ#556406)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0046 advisory.

    - [firewire] ohci: handle receive packets with zero data (Jay Fenlason) [547241 547242] {CVE-2009-4138}
    - [fs] respect flag in do_coredump (Danny Feng) [544188 544189] {CVE-2009-4036}
    - [fs] hfs: fix a potential buffer overflow (Amerigo Wang) [540740 540741] {CVE-2009-4020}
    - [fuse] prevent fuse_put_request on invalid pointer (Danny Feng) [538736 538737] {CVE-2009-4021}
    - [scsi] gdth: prevent negative offsets in ioctl (Amerigo Wang) [539420 539421] {CVE-2009-3080}
    - [scsi] megaraid: fix sas permissions in sysfs (Casey Dahlin) [537312 537313] {CVE-2009-3889     CVE-2009-3939}
    - [net] emergency route cache flushing fixes (Thomas Graf ) [545662 545663] {CVE-2009-4272}
    - [fs] fasync: split 'fasync_helper()' into separate add/remove functions (Danny Feng ) [548656 548657]     {CVE-2009-4141}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

CVE-2009-3889 CVE-2009-3939 kernel: megaraid_sas permissions in sysfs

CVE-2009-3080 kernel: gdth: Prevent negative offsets in ioctl

CVE-2009-4005 kernel: isdn: hfc_usb: fix read buffer overflow

CVE-2009-4020 kernel: hfs buffer overflow

This update fixes the following security issues :

  - an array index error was found in the gdth driver in the     Linux kernel. A local user could send a specially     crafted IOCTL request that would cause a denial of     service or, possibly, privilege escalation.
    (CVE-2009-3080, Important)

  - a flaw was found in the collect_rx_frame() function in     the HiSax ISDN driver (hfc_usb) in the Linux kernel. An     attacker could use this flaw to send a specially crafted     HDLC packet that could trigger a buffer out of bounds,     possibly resulting in a denial of service.
    (CVE-2009-4005, Important)

  - permission issues were found in the megaraid_sas driver     (for SAS based RAID controllers) in the Linux kernel.
    The 'dbg_lvl' and 'poll_mode_io' files on the sysfs file     system ('/sys/') had world-writable permissions. This     could allow local, unprivileged users to change the     behavior of the driver. (CVE-2009-3889, CVE-2009-3939,     Moderate)

  - a buffer overflow flaw was found in the hfs_bnode_read()     function in the HFS file system implementation in the     Linux kernel. This could lead to a denial of service if     a user browsed a specially crafted HFS file system, for     example, by running 'ls'. (CVE-2009-4020, Low)

This update also fixes the following bugs :

  - if a process was using ptrace() to trace a     multi-threaded process, and that multi-threaded process     dumped its core, the process performing the trace could     hang in wait4(). This issue could be triggered by     running 'strace -f' on a multi-threaded process that was     dumping its core, resulting in the strace command     hanging. (BZ#555869)

  - a bug in the ptrace() implementation could have, in some     cases, caused ptrace_detach() to create a zombie process     if the process being traced was terminated with a     SIGKILL signal. (BZ#555869)

  - the kernel-2.6.9-89.0.19.EL update resolved an issue     (CVE-2009-4537) in the Realtek r8169 Ethernet driver.
    This update implements a better solution for that issue.
    Note: This is not a security regression. The original     fix was complete. This update is adding the official     upstream fix. (BZ#556406)

The system must be rebooted for this update to take effect.

This update fixes a several security issues and various bugs in the SUSE Linux Enterprise 10 SP 2 kernel.

The following security issues were fixed: CVE-2009-3939: A sysctl variable of the megaraid_sas driver was worldwriteable, allowing local users to cause a denial of service or potential code execution.

  - The collect_rx_frame function in     drivers/isdn/hisax/hfc_usb.c in the Linux kernel before     2.6.32-rc7 allows attackers to have an unspecified     impact via a crafted HDLC packet that arrives over ISDN     and triggers a buffer under-read. (CVE-2009-4005)

  - A negative offset in a ioctl in the GDTH RAID driver was     fixed. (CVE-2009-3080)

  - The fuse_direct_io function in fs/fuse/file.c in the     fuse subsystem in the Linux kernel might allow attackers     to cause a denial of service (invalid pointer     dereference and OOPS) via vectors possibly related to a     memory-consumption attack. (CVE-2009-4021)

  - The dbg_lvl file for the megaraid_sas driver in the     Linux kernel before 2.6.27 has world-writable     permissions, which allows local users to change the (1)     behavior and (2) logging level of the driver by     modifying this file. (CVE-2009-3889)

  - Memory leak in the appletalk subsystem in the Linux     kernel when the appletalk and ipddp modules are loaded     but the ipddp'N' device is not found, allows remote     attackers to cause a denial of service (memory     consumption) via IP-DDP datagrams. (CVE-2009-2903)

  - net/unix/af_unix.c in the Linux kernel allows local     users to cause a denial of service (system hang) by     creating an abstract-namespace AF_UNIX listening socket,     performing a shutdown operation on this socket, and then     performing a series of connect operations to this     socket. (CVE-2009-3621)

  - The tcf_fill_node function in net/sched/cls_api.c in the     netlink subsystem in the Linux kernel 2.6.x before     2.6.32-rc5, and 2.4.37.6 and earlier, does not     initialize a certain tcm__pad2 structure member, which     might allow local users to obtain sensitive information     from kernel memory via unspecified vectors. NOTE: this     issue existed because of an incomplete fix for     CVE-2005-4881. (CVE-2009-3612 / CVE-2005-4881)

  - The ATI Rage 128 (aka r128) driver in the Linux kernel     does not properly verify Concurrent Command Engine (CCE)     state initialization, which allows local users to cause     a denial of service (NULL pointer dereference and system     crash) or possibly gain privileges via unspecified ioctl     calls. (CVE-2009-3620)

  - The nfs4_proc_lock function in fs/nfs/nfs4proc.c in the     NFSv4 client in the Linux kernel allows remote NFS     servers to cause a denial of service (NULL pointer     dereference and panic) by sending a certain response     containing incorrect file attributes, which trigger     attempted use of an open file that lacks NFSv4 state.
    (CVE-2009-3726)

  - The swiotlb functionality in the r8169 driver in     drivers/net/r8169.c in the Linux kernel allows remote     attackers to cause a denial of service (IOMMU space     exhaustion and system crash) by using jumbo frames for a     large amount of network traffic, as demonstrated by a     flood ping. (CVE-2009-3613)

The rio and sx serial multiport card drivers were disabled via a modprobe blacklist due to severe bugs.

For a full list of changes, please read the RPM changelog.

a. Service Console update for COS kernel

   Updated COS package 'kernel' addresses the security issues that are    fixed through versions 2.6.18-164.11.1.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2009-2695, CVE-2009-2908, CVE-2009-3228,    CVE-2009-3286, CVE-2009-3547, CVE-2009-3613 to the security issues    fixed in kernel 2.6.18-164.6.1

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2009-3612, CVE-2009-3620, CVE-2009-3621,    CVE-2009-3726 to the security issues fixed in kernel 2.6.18-164.9.1.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2007-4567, CVE-2009-4536, CVE-2009-4537,    CVE-2009-4538 to the security issues fixed in kernel 2.6.18-164.10.1

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2006-6304, CVE-2009-2910, CVE-2009-3080,    CVE-2009-3556, CVE-2009-3889, CVE-2009-3939, CVE-2009-4020,    CVE-2009-4021, CVE-2009-4138, CVE-2009-4141, and CVE-2009-4272 to    the security issues fixed in kernel 2.6.18-164.11.1.

b. ESXi userworld update for ntp

   The Network Time Protocol (NTP) is used to synchronize the time of    a computer client or server to another server or reference time    source.

   A vulnerability in ntpd could allow a remote attacker to cause a    denial of service (CPU and bandwidth consumption) by using    MODE_PRIVATE to send a spoofed (1) request or (2) response packet    that triggers a continuous exchange of MODE_PRIVATE error responses    between two NTP daemons.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-3563 to this issue.

c. Service Console package openssl updated to 0.9.8e-12.el5_4.1

   OpenSSL is a toolkit implementing SSL v2/v3 and TLS protocols with    full-strength cryptography world-wide.

   A memory leak in the zlib could allow a remote attacker to cause a    denial of service (memory consumption) via vectors that trigger    incorrect calls to the CRYPTO_cleanup_all_ex_data function.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-4355 to this issue.

   A vulnerability was discovered which may allow remote attackers to    spoof certificates by using MD2 design flaws to generate a hash    collision in less than brute-force time. NOTE: the scope of this    issue is currently limited because the amount of computation    required is still large.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-2409 to this issue.

   This update also includes security fixes that were first addressed    in version openssl-0.9.8e-12.el5.i386.rpm.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the names CVE-2009-0590, CVE-2009-1377, CVE-2009-1378,    CVE-2009-1379, CVE-2009-1386 and CVE-2009-1387 to these issues.

d. Service Console update for krb5 to 1.6.1-36.el5_4.1 and pam_krb5 to    2.2.14-15.

   Kerberos is a network authentication protocol. It is designed to    provide strong authentication for client/server applications by    using secret-key cryptography.

   Multiple integer underflows in the AES and RC4 functionality in the    crypto library could allow remote attackers to cause a denial of    service (daemon crash) or possibly execute arbitrary code by    providing ciphertext with a length that is too short to be valid.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-4212 to this issue.

   The service console package for pam_krb5 is updated to version    pam_krb5-2.2.14-15. This update fixes a flaw found in pam_krb5. In    some non-default configurations (specifically, where pam_krb5 would    be the first module to prompt for a password), a remote attacker    could use this flaw to recognize valid usernames, which would aid a    dictionary-based password guess attack.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-1384 to this issue.

e. Service Console package bind updated to 9.3.6-4.P1.el5_4.2

   BIND (Berkeley Internet Name Daemon) is by far the most widely used    Domain Name System (DNS) software on the Internet.

   A vulnerability was discovered which could allow remote attacker to    add the Authenticated Data (AD) flag to a forged NXDOMAIN response    for an existing domain.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2010-0097 to this issue.

   A vulnerability was discovered which could allow remote attackers    to conduct DNS cache poisoning attacks by receiving a recursive    client query and sending a response that contains CNAME or DNAME    records, which do not have the intended validation before caching.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2010-0290 to this issue.

   A vulnerability was found in the way that bind handles out-of-    bailiwick data accompanying a secure response without re-fetching    from the original source, which could allow remote attackers to    have an unspecified impact via a crafted response.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2010-0382 to this issue.

   NOTE: ESX does not use the BIND name service daemon by default.

f. Service Console package gcc updated to 3.2.3-60

   The GNU Compiler Collection includes front ends for C, C++,    Objective-C, Fortran, Java, and Ada, as well as libraries for these    languages

   GNU Libtool's ltdl.c attempts to open .la library files in the    current working directory.  This could allow a local user to gain    privileges via a Trojan horse file.  The GNU C Compiler collection    (gcc) provided in ESX contains a statically linked version of the    vulnerable code, and is being replaced.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-3736 to this issue.

g. Service Console package gzip update to 1.3.3-15.rhel3

   gzip is a software application used for file compression

   An integer underflow in gzip's unlzw function on 64-bit platforms    may allow a remote attacker to trigger an array index error    leading to a denial of service (application crash) or possibly    execute arbitrary code via a crafted LZW compressed file.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2010-0001 to this issue.

h. Service Console package sudo updated to 1.6.9p17-6.el5_4

   Sudo (su 'do') allows a system administrator to delegate authority    to give certain users (or groups of users) the ability to run some    (or all) commands as root or another user while providing an audit    trail of the commands and their arguments.

   When a pseudo-command is enabled, sudo permits a match between the    name of the pseudo-command and the name of an executable file in an    arbitrary directory, which allows local users to gain privileges    via a crafted executable file.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2010-0426 to this issue.

   When the runas_default option is used, sudo does not properly set    group memberships, which allows local users to gain privileges via    a sudo command.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2010-0427 to this issue.

NOTE: This kernel update marks the final planned kernel security update for the 2.6.24 kernel in the Debian release 'etch'. Although security support for 'etch' officially ended on Feburary 15th, 2010, this update was already in preparation before that date.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, sensitive memory leak or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-2691     Steve Beattie and Kees Cook reported an information leak     in the maps and smaps files available under /proc. Local     users may be able to read this data for setuid processes     while the ELF binary is being loaded.

  - CVE-2009-2695     Eric Paris provided several fixes to increase the     protection provided by the mmap_min_addr tunable against     NULL pointer dereference vulnerabilities.

  - CVE-2009-3080     Dave Jones reported an issue in the gdth SCSI driver. A     missing check for negative offsets in an ioctl call     could be exploited by local users to create a denial of     service or potentially gain elevated privileges.

  - CVE-2009-3726     Trond Myklebust reported an issue where a malicious NFS     server could cause a denial of service condition on its     clients by returning incorrect attributes during an open     call.

  - CVE-2009-3889     Joe Malicki discovered an issue in the megaraid_sas     driver. Insufficient permissions on the sysfs dbg_lvl     interface allow local users to modify the debug logging     behavior.

  - CVE-2009-4005     Roel Kluin discovered an issue in the hfc_usb driver, an     ISDN driver for Colognechip HFC-S USB chip. A potential     read overflow exists which may allow remote users to     cause a denial of service condition (oops).

  - CVE-2009-4020     Amerigo Wang discovered an issue in the HFS filesystem     that would allow a denial of service by a local user who     has sufficient privileges to mount a specially crafted     filesystem.

  - CVE-2009-4021     Anana V. Avati discovered an issue in the fuse     subsystem. If the system is sufficiently low on memory,     a local user can cause the kernel to dereference an     invalid pointer resulting in a denial of service (oops)     and potentially an escalation of privileges.

  - CVE-2009-4138     Jay Fenlason discovered an issue in the firewire stack     that allows local users to cause a denial of service     (oops or crash) by making a specially crafted ioctl     call.

  - CVE-2009-4308     Ted Ts'o discovered an issue in the ext4 filesystem that     allows local users to cause a denial of service (NULL     pointer dereference). For this to be exploitable, the     local user must have sufficient privileges to mount a     filesystem.

  - CVE-2009-4536 CVE-2009-4538     Fabian Yamaguchi reported issues in the e1000 and e1000e     drivers for Intel gigabit network adapters which allow     remote users to bypass packet filters using specially     crafted Ethernet frames.

  - CVE-2010-0003     Andi Kleen reported a defect which allows local users to     gain read access to memory reachable by the kernel when     the print-fatal-signals option is enabled. This option     is disabled by default.

  - CVE-2010-0007     Florian Westphal reported a lack of capability checking     in the ebtables netfilter subsystem. If the ebtables     module is loaded, local users can add and modify     ebtables rules.

  - CVE-2010-0291     Al Viro reported several issues with the mmap/mremap     system calls that allow local users to cause a denial of     service (system panic) or obtain elevated privileges.

  - CVE-2010-0410     Sebastian Krahmer discovered an issue in the netlink     connector subsystem that permits local users to allocate     large amounts of system memory resulting in a denial of     service (out of memory).

  - CVE-2010-0415     Ramon de Carvalho Valle discovered an issue in the     sys_move_pages interface, limited to amd64, ia64 and     powerpc64 flavors in Debian. Local users can exploit     this issue to cause a denial of service (system crash)     or gain access to sensitive kernel memory.

  - CVE-2010-0622     Jerome Marchand reported an issue in the futex subsystem     that allows a local user to force an invalid futex state     which results in a denial of service (oops).

This update fixes various security issues and some bugs in the SUSE Linux Enterprise 9 kernel.

  - The collect_rx_frame function in     drivers/isdn/hisax/hfc_usb.c in the Linux kernel allows     attackers to have an unspecified impact via a crafted     HDLC packet that arrives over ISDN and triggers a buffer     under-read. (CVE-2009-4005)

  - Array index error in the gdth_read_event function in     drivers/scsi/gdth.c in the Linux kernel allows local     users to cause a denial of service or possibly gain     privileges via a negative event index in an IOCTL     request. (CVE-2009-3080)

  - Missing CAP_NET_ADMIN checks in the ebtables netfilter     code might have allowed local attackers to modify bridge     firewall settings. (CVE-2010-0007)

  - drivers/net/e1000/e1000_main.c in the e1000 driver in     the Linux kernel handles Ethernet frames that exceed the     MTU by processing certain trailing payload data as if it     were a complete frame, which allows remote attackers to     bypass packet filters via a large packet with a crafted     payload. (CVE-2009-4536)

  - The dbg_lvl file for the megaraid_sas driver in the     Linux kernel has world-writable permissions, which     allows local users to change the (1) behavior and (2)     logging level of the driver by modifying this file.
    (CVE-2009-3889)

  - The z90crypt_unlocked_ioctl function in the z90crypt     driver in the Linux kernel does not perform a capability     check for the Z90QUIESCE operation, which allows local     users to leverage euid 0 privileges to force a driver     outage. (CVE-2009-1883)

  - Memory leak in the appletalk subsystem in the Linux     kernel, when the appletalk and ipddp modules are loaded     but the ipddp'N' device is not found, allows remote     attackers to cause a denial of service (memory     consumption) via IP-DDP datagrams. (CVE-2009-2903)

  - net/1/af_unix.c in the Linux kernel allows local users     to cause a denial of service (system hang) by creating     an abstract-namespace AF_UNIX listening socket,     performing a shutdown operation on this socket, and then     performing a series of connect operations to this     socket. (CVE-2009-3621)

  - The ATI Rage 128 (aka r128) driver in the Linux kernel     does not properly verify Concurrent Command Engine (CCE)     state initialization, which allows local users to cause     a denial of service (NULL pointer dereference and system     crash) or possibly gain privileges via unspecified ioctl     calls. (CVE-2009-3620)

Updated kernel packages that fix multiple security issues and three bugs are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* an array index error was found in the gdth driver in the Linux kernel. A local user could send a specially crafted IOCTL request that would cause a denial of service or, possibly, privilege escalation.
(CVE-2009-3080, Important)

* a flaw was found in the collect_rx_frame() function in the HiSax ISDN driver (hfc_usb) in the Linux kernel. An attacker could use this flaw to send a specially crafted HDLC packet that could trigger a buffer out of bounds, possibly resulting in a denial of service.
(CVE-2009-4005, Important)

* permission issues were found in the megaraid_sas driver (for SAS based RAID controllers) in the Linux kernel. The 'dbg_lvl' and 'poll_mode_io' files on the sysfs file system ('/sys/') had world-writable permissions. This could allow local, unprivileged users to change the behavior of the driver. (CVE-2009-3889, CVE-2009-3939, Moderate)

* a buffer overflow flaw was found in the hfs_bnode_read() function in the HFS file system implementation in the Linux kernel. This could lead to a denial of service if a user browsed a specially crafted HFS file system, for example, by running 'ls'. (CVE-2009-4020, Low)

This update also fixes the following bugs :

* if a process was using ptrace() to trace a multi-threaded process, and that multi-threaded process dumped its core, the process performing the trace could hang in wait4(). This issue could be triggered by running 'strace -f' on a multi-threaded process that was dumping its core, resulting in the strace command hanging. (BZ#555869)

* a bug in the ptrace() implementation could have, in some cases, caused ptrace_detach() to create a zombie process if the process being traced was terminated with a SIGKILL signal. (BZ#555869)

* the RHSA-2010:0020 update resolved an issue (CVE-2009-4537) in the Realtek r8169 Ethernet driver. This update implements a better solution for that issue. Note: This is not a security regression. The original fix was complete. This update is adding the official upstream fix. (BZ#556406)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security fixes :

* an array index error was found in the gdth driver. A local user could send a specially crafted IOCTL request that would cause a denial of service or, possibly, privilege escalation. (CVE-2009-3080, Important)

* a flaw was found in the FUSE implementation. When a system is low on memory, fuse_put_request() could dereference an invalid pointer, possibly leading to a local denial of service or privilege escalation.
(CVE-2009-4021, Important)

* Tavis Ormandy discovered a deficiency in the fasync_helper() implementation. This could allow a local, unprivileged user to leverage a use-after-free of locked, asynchronous file descriptors to cause a denial of service or privilege escalation. (CVE-2009-4141, Important)

* the Parallels Virtuozzo Containers team reported the RHSA-2009:1243 update introduced two flaws in the routing implementation. If an attacker was able to cause a large enough number of collisions in the routing hash table (via specially crafted packets) for the emergency route flush to trigger, a deadlock could occur. Secondly, if the kernel routing cache was disabled, an uninitialized pointer would be left behind after a route lookup, leading to a kernel panic.
(CVE-2009-4272, Important)

* the RHSA-2009:0225 update introduced a rewrite attack flaw in the do_coredump() function. A local attacker able to guess the file name a process is going to dump its core to, prior to the process crashing, could use this flaw to append data to the dumped core file. This issue only affects systems that have '/proc/sys/fs/suid_dumpable' set to 2 (the default value is 0). (CVE-2006-6304, Moderate)

The fix for CVE-2006-6304 changes the expected behavior: With suid_dumpable set to 2, the core file will not be recorded if the file already exists. For example, core files will not be overwritten on subsequent crashes of processes whose core files map to the same name.

* an information leak was found in the Linux kernel. On AMD64 systems, 32-bit processes could access and read certain 64-bit registers by temporarily switching themselves to 64-bit mode. (CVE-2009-2910, Moderate)

* the RHBA-2008:0314 update introduced N_Port ID Virtualization (NPIV) support in the qla2xxx driver, resulting in two new sysfs pseudo files, '/sys/class/scsi_host/[a qla2xxx host]/vport_create' and 'vport_delete'. These two files were world-writable by default, allowing a local user to change SCSI host attributes. This flaw only affects systems using the qla2xxx driver and NPIV capable hardware.
(CVE-2009-3556, Moderate)

* permission issues were found in the megaraid_sas driver. The 'dbg_lvl' and 'poll_mode_io' files on the sysfs file system ('/sys/') had world-writable permissions. This could allow local, unprivileged users to change the behavior of the driver. (CVE-2009-3889, CVE-2009-3939, Moderate)

* a NULL pointer dereference flaw was found in the firewire-ohci driver used for OHCI compliant IEEE 1394 controllers. A local, unprivileged user with access to /dev/fw* files could issue certain IOCTL calls, causing a denial of service or privilege escalation. The FireWire modules are blacklisted by default, and if enabled, only root has access to the files noted above by default. (CVE-2009-4138, Moderate)

* a buffer overflow flaw was found in the hfs_bnode_read() function in the HFS file system implementation. This could lead to a denial of service if a user browsed a specially crafted HFS file system, for example, by running 'ls'. (CVE-2009-4020, Low)

Bug fix documentation for this update will be available shortly from www.redhat.com/docs/en-US/errata/RHSA-2010-0046/Kernel_Security_Update / index.html

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

It was discovered that the AX.25 network subsystem did not correctly check integer signedness in certain setsockopt calls. A local attacker could exploit this to crash the system, leading to a denial of service. Ubuntu 9.10 was not affected. (CVE-2009-2909)

Jan Beulich discovered that the kernel could leak register contents to 32-bit processes that were switched to 64-bit mode. A local attacker could run a specially crafted binary to read register values from an earlier process, leading to a loss of privacy. (CVE-2009-2910)

Dave Jones discovered that the gdth SCSI driver did not correctly validate array indexes in certain ioctl calls. A local attacker could exploit this to crash the system or gain elevated privileges.
(CVE-2009-3080)

Eric Dumazet and Jiri Pirko discovered that the TC and CLS subsystems would leak kernel memory via uninitialized structure members. A local attacker could exploit this to read several bytes of kernel memory, leading to a loss of privacy. (CVE-2009-3228, CVE-2009-3612)

Earl Chew discovered race conditions in pipe handling. A local attacker could exploit anonymous pipes via /proc/*/fd/ and crash the system or gain root privileges. (CVE-2009-3547)

Dave Jones and Francois Romieu discovered that the r8169 network driver could be made to leak kernel memory. A remote attacker could send a large number of jumbo frames until the system memory was exhausted, leading to a denial of service. Ubuntu 9.10 was not affected. (CVE-2009-3613).

Ben Hutchings discovered that the ATI Rage 128 video driver did not correctly validate initialization states. A local attacker could make specially crafted ioctl calls to crash the system or gain root privileges. (CVE-2009-3620)

Tomoki Sekiyama discovered that Unix sockets did not correctly verify namespaces. A local attacker could exploit this to cause a system hang, leading to a denial of service. (CVE-2009-3621)

J. Bruce Fields discovered that NFSv4 did not correctly use the credential cache. A local attacker using a mount with AUTH_NULL authentication could exploit this to crash the system or gain root privileges. Only Ubuntu 9.10 was affected. (CVE-2009-3623)

Alexander Zangerl discovered that the kernel keyring did not correctly reference count. A local attacker could issue a series of specially crafted keyring calls to crash the system or gain root privileges.
Only Ubuntu 9.10 was affected. (CVE-2009-3624)

David Wagner discovered that KVM did not correctly bounds-check CPUID entries. A local attacker could exploit this to crash the system or possibly gain elevated privileges. Ubuntu 6.06 and 9.10 were not affected. (CVE-2009-3638)

Avi Kivity discovered that KVM did not correctly check privileges when accessing debug registers. A local attacker could exploit this to crash a host system from within a guest system, leading to a denial of service. Ubuntu 6.06 and 9.10 were not affected. (CVE-2009-3722)

Philip Reisner discovered that the connector layer for uvesafb, pohmelfs, dst, and dm did not correctly check capabilties. A local attacker could exploit this to crash the system or gain elevated privileges. Ubuntu 6.06 was not affected. (CVE-2009-3725)

Trond Myklebust discovered that NFSv4 clients did not robustly verify attributes. A malicious remote NFSv4 server could exploit this to crash a client or gain root privileges. Ubuntu 9.10 was not affected.
(CVE-2009-3726)

Robin Getz discovered that NOMMU systems did not correctly validate NULL pointers in do_mmap_pgoff calls. A local attacker could attempt to allocate large amounts of memory to crash the system, leading to a denial of service. Only Ubuntu 6.06 and 9.10 were affected.
(CVE-2009-3888)

Joseph Malicki discovered that the MegaRAID SAS driver had world-writable option files. A local attacker could exploit these to disrupt the behavior of the controller, leading to a denial of service. (CVE-2009-3889, CVE-2009-3939)

Roel Kluin discovered that the Hisax ISDN driver did not correctly check the size of packets. A remote attacker could send specially crafted packets to cause a system crash, leading to a denial of service. (CVE-2009-4005)

Lennert Buytenhek discovered that certain 802.11 states were not handled correctly. A physically-proximate remote attacker could send specially crafted wireless traffic that would crash the system, leading to a denial of service. Only Ubuntu 9.10 was affected.
(CVE-2009-4026, CVE-2009-4027).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2010-0076.
IAVA Reference : 2010-A-0001
IAVA Reference : 2010-A-0015

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2010-0046.
IAVA Reference : 2010-A-0001
IAVA Reference : 2010-A-0015

ID	Name	Product	Family	Severity
89740	VMware ESX / ESXi Third-Party Libraries and Components (VMSA-2010-0009) (remote check)	Nessus	VMware ESX Local Security Checks	critical
67992	Oracle Linux 4 : kernel (ELSA-2010-0076)	Nessus	Oracle Linux Local Security Checks	high
67988	Oracle Linux 5 : kernel (ELSA-2010-0046)	Nessus	Oracle Linux Local Security Checks	high
60728	Scientific Linux Security Update : kernel on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
59143	SuSE 10 Security Update : the Linux Kernel (x86_64) (ZYPP Patch Number 6730)	Nessus	SuSE Local Security Checks	high
46765	VMSA-2010-0009 : ESXi ntp and ESX Service Console third-party updates	Nessus	VMware ESX Local Security Checks	high
44951	Debian DSA-2005-1 : linux-2.6.24 - privilege escalation/denial of service/sensitive memory leak	Nessus	Debian Local Security Checks	critical
44654	SuSE9 Security Update : the Linux kernel (YOU Patch Number 12578)	Nessus	SuSE Local Security Checks	high
44395	CentOS 4 : kernel (CESA-2010:0076)	Nessus	CentOS Local Security Checks	high
44386	RHEL 4 : kernel (RHSA-2010:0076)	Nessus	Red Hat Local Security Checks	high
44096	CentOS 5 : kernel (CESA-2010:0046)	Nessus	CentOS Local Security Checks	high
44062	RHEL 5 : kernel (RHSA-2010:0046)	Nessus	Red Hat Local Security Checks	high
43398	SuSE 10 Security Update : the Linux Kernel (i386) (ZYPP Patch Number 6726)	Nessus	SuSE Local Security Checks	high
43026	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : linux, linux-source-2.6.15 vulnerabilities (USN-864-1)	Nessus	Ubuntu Local Security Checks	high
801486	CentOS RHSA-2010-0076 Security Check	Log Correlation Engine	Generic	high
801485	CentOS RHSA-2010-0046 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2009-3889

high

Tenable Plugins

critical

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

high