Double free vulnerability in the xfrm6_tunnel_rcv function in net/ipv6/xfrm6_tunnel.c in the Linux kernel before 2.6.22, when the xfrm6_tunnel module is enabled, allows remote attackers to cause a denial of service (panic) via crafted IPv6 packets.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - kernel: net: improve sequence number generation (CVE-2011-3188)

  - kernel: cifs: signedness issue in CIFSFindNext() (CVE-2011-3191)

  - Buffer overflow in the auerswald_probe function in the Auerswald Linux USB driver for the Linux kernel     before 2.6.27 allows physically proximate attackers to execute arbitrary code, cause a denial of service     via a crafted USB device, or take full control of the system. (CVE-2009-4067)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2012-04801 advisory.

  - Double free vulnerability in the xfrm6_tunnel_rcv function in net/ipv6/xfrm6_tunnel.c in the Linux kernel     before 2.6.22, when the xfrm6_tunnel module is enabled, allows remote attackers to cause a denial of     service (panic) via crafted IPv6 packets. (CVE-2012-1583)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This plugin has been deprecated as it is a duplicate of oraclelinux_ELSA-2012-0480-1.nasl (plugin ID 68513).

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party libraries :

  - Apache Struts
  - glibc
  - GnuTLS
  - JRE
  - kernel
  - libxml2
  - OpenSSL
  - Perl
  - popt and rpm

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2013-0039 for details.

An updated rhev-hypervisor5 package that fixes three security issues and one bug is now available.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The rhev-hypervisor5 package provides a Red Hat Enterprise Virtualization Hypervisor ISO disk image. The Red Hat Enterprise Virtualization Hypervisor is a dedicated Kernel-based Virtual Machine (KVM) hypervisor. It includes everything necessary to run and manage virtual machines: A subset of the Red Hat Enterprise Linux operating environment and the Red Hat Enterprise Virtualization Agent.

Note: Red Hat Enterprise Virtualization Hypervisor is only available for the Intel 64 and AMD64 architectures with virtualization extensions.

A flaw was found in the way libtasn1 decoded DER data. An attacker could create a carefully-crafted X.509 certificate that, when parsed by an application that uses GnuTLS, could cause the application to crash. (CVE-2012-1569)

A flaw was found in the way GnuTLS decrypted malformed TLS records.
This could cause a TLS/SSL client or server to crash when processing a specially crafted TLS record from a remote TLS/SSL connection peer.
(CVE-2012-1573)

An integer overflow flaw was found in the implementation of the printf functions family. This could allow an attacker to bypass FORTIFY_SOURCE protections and execute arbitrary code using a format string flaw in an application, even though these protections are expected to limit the impact of such flaws to an application abort.
(CVE-2012-0864)

Red Hat would like to thank Matthew Hall of Mu Dynamics for reporting CVE-2012-1569 and CVE-2012-1573.

This updated package provides updated components that include fixes for various security issues. These issues have no security impact on Red Hat Enterprise Virtualization Hypervisor itself, however. The security fixes included in this update address the following CVE numbers :

CVE-2011-4128 (gnutls issue)

CVE-2012-1583 (kernel issue)

CVE-2011-3045 (libpng issue)

CVE-2012-0884 and CVE-2012-1165 (openssl issues)

Further information on the changes made to the package is available on the relevant errata :

https://rhn.redhat.com/errata/RHBA-2012-0398.html

Users of Red Hat Enterprise Virtualization Hypervisor are advised to upgrade to this updated package, which fixes these issues.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2012-0480 advisory.

    - [net] ipv6: fix skb double free in xfrm6_tunnel (Jiri Benc) [752305 743375] {CVE-2012-1583}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2012:0480 :

Updated kernel packages that fix one security issue, various bugs, and add one enhancement are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issue :

* A flaw in the xfrm6_tunnel_rcv() function in the Linux kernel's IPv6 implementation could lead to a use-after-free or double free flaw in tunnel6_rcv(). A remote attacker could use this flaw to send specially crafted packets to a target system that is using IPv6 and also has the xfrm6_tunnel kernel module loaded, causing it to crash.
(CVE-2012-1583, Important)

If you do not run applications that use xfrm6_tunnel, you can prevent the xfrm6_tunnel module from being loaded by creating (as the root user) a '/etc/modprobe.d/xfrm6_tunnel.conf' file, and adding the following line to it :

blacklist xfrm6_tunnel

This way, the xfrm6_tunnel module cannot be loaded accidentally. A reboot is not necessary for this change to take effect.

This update also fixes various bugs and adds an enhancement.
Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.

Users should upgrade to these updated packages, which contain backported patches to correct this issue, and fix the bugs and add the enhancement noted in the Technical Notes. The system must be rebooted for this update to take effect.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0720 advisory.

  - kernel: x86-64: avoid sysret to non-canonical address (CVE-2012-0217)

  - kernel: ipv6: panic using raw sockets (CVE-2012-1583)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

a. vCenter and ESX update to JRE 1.6.0 Update 31

   The Oracle (Sun) JRE is updated to version 1.6.0_31, which    addresses multiple security issues. Oracle has documented the    CVE identifiers that are addressed by this update in the Oracle    Java SE Critical Patch Update Advisory of February 2012.

b. vCenter Update Manager update to JRE 1.5.0 Update 36

   The Oracle (Sun) JRE is updated to 1.5.0_36 to address multiple    security issues.  Oracle has documented the CVE identifiers that    are addressed in JRE 1.5.0_36 in the Oracle Java SE Critical    Patch Update Advisory for June 2012.

c. Update to ESX/ESXi userworld OpenSSL library

   The ESX/ESXi userworld OpenSSL library is updated from version    0.9.8p to version 0.9.8t to resolve multiple security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-4180, CVE-2010-4252,    CVE-2011-0014, CVE-2011-4108, CVE-2011-4109, CVE-2011-4576,    CVE-2011-4577, CVE-2011-4619, and CVE-2012-0050 to these issues.

d. Update to ESX service console OpenSSL RPM

   The service console OpenSSL RPM is updated to version    0.9.8e-22.el5_8.3 to resolve a security issue.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2012-2110 to this issue.

e. Update to ESX service console kernel

   The ESX service console kernel is updated to resolve multiple    security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2011-1833, CVE-2011-2484,    CVE-2011-2496, CVE-2011-3188, CVE-2011-3209, CVE-2011-3363,    CVE-2011-4110, CVE-2011-1020, CVE-2011-4132, CVE-2011-4324,    CVE-2011-4325, CVE-2012-0207, CVE-2011-2699, and CVE-2012-1583    to these issues.

f. Update to ESX service console Perl RPM

   The ESX service console Perl RPM is updated to    perl-5.8.8.32.1.8999.vmw to resolve multiple security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-2761, CVE-2010-4410, and    CVE-2011-3597 to these issues.

g. Update to ESX service console libxml2 RPMs

   The ESX service console libmxl2 RPMs are updated to    libxml2-2.6.26-2.1.15.el5_8.2 and    libxml2-python-2.6.26-2.1.15.el5_8.2 to resolve a security    issue.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2012-0841 to this issue.

h. Update to ESX service console glibc RPM

   The ESX service console glibc RPM is updated to version    glibc-2.5-81.el5_8.1 to resolve multiple security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the names CVE-2009-5029, CVE-2009-5064,    CVE-2010-0830, CVE-2011-1089, CVE-2011-4609, and CVE-2012-0864    to these issue.

i. Update to ESX service console GnuTLS RPM

   The ESX service console GnuTLS RPM is updated to version    1.4.1-7.el5_8.2 to resolve multiple security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2011-4128, CVE-2012-1569, and    CVE-2012-1573 to these issues.

j. Update to ESX service console popt, rpm, rpm-libs,    and rpm-python RPMS

   The ESX service console popt, rpm, rpm-libs, and rpm-python RPMS    are updated to the following versions to resolve multiple    security issues :
      - popt-1.10.2.3-28.el5_8
      - rpm-4.4.2.3-28.el5_8
      - rpm-libs-4.4.2.3-28.el5_8
      - rpm-python-4.4.2.3-28.el5_8

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2012-0060, CVE-2012-0061, and    CVE-2012-0815 to these issues.

k. Vulnerability in third-party Apache Struts component

   The version of Apache Struts in vCenter Operations has been    updated to 2.3.4 which addresses an arbitrary file overwrite    vulnerability. This vulnerability allows an attacker to create    a denial of service by overwriting arbitrary files without    authentication. The attacker would need to be on the same network    as the system where vCOps is installed.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the name CVE-2012-0393 to this issue.

   Note: Apache struts 2.3.4 addresses the following issues as well :
   CVE-2011-5057, CVE-2012-0391, CVE-2012-0392, CVE-2012-0394. It    was found that these do not affect vCOps.

   VMware would like to thank Alexander Minozhenko from ERPScan for    reporting this issue to us.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issue :

  - A flaw in the xfrm6_tunnel_rcv() function in the Linux     kernel's IPv6 implementation could lead to a     use-after-free or double free flaw in tunnel6_rcv(). A     remote attacker could use this flaw to send specially     crafted packets to a target system that is using IPv6     and also has the xfrm6_tunnel kernel module loaded,     causing it to crash. (CVE-2012-1583, Important)

If you do not run applications that use xfrm6_tunnel, you can prevent the xfrm6_tunnel module from being loaded by creating (as the root user) a '/etc/modprobe.d/xfrm6_tunnel.conf' file, and adding the following line to it :

blacklist xfrm6_tunnel

This way, the xfrm6_tunnel module cannot be loaded accidentally. A reboot is not necessary for this change to take effect.

This update also fixes various bugs and adds an enhancement. The system must be rebooted for this update to take effect.

The corresponding kernel-module-<module>-<kernel-version> modules have also been updated to match the kernel version.

Updated kernel packages that fix one security issue, various bugs, and add one enhancement are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issue :

* A flaw in the xfrm6_tunnel_rcv() function in the Linux kernel's IPv6 implementation could lead to a use-after-free or double free flaw in tunnel6_rcv(). A remote attacker could use this flaw to send specially crafted packets to a target system that is using IPv6 and also has the xfrm6_tunnel kernel module loaded, causing it to crash.
(CVE-2012-1583, Important)

If you do not run applications that use xfrm6_tunnel, you can prevent the xfrm6_tunnel module from being loaded by creating (as the root user) a '/etc/modprobe.d/xfrm6_tunnel.conf' file, and adding the following line to it :

blacklist xfrm6_tunnel

This way, the xfrm6_tunnel module cannot be loaded accidentally. A reboot is not necessary for this change to take effect.

This update also fixes various bugs and adds an enhancement.
Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.

Users should upgrade to these updated packages, which contain backported patches to correct this issue, and fix the bugs and add the enhancement noted in the Technical Notes. The system must be rebooted for this update to take effect.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2012-0480.

ID	Name	Product	Family	Severity
199256	RHEL 4 : kernel (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
181058	Oracle Linux 5 : ELSA-2012-0480-1: / kernel (ELSA-2012-04801) (deprecated)	Nessus	Oracle Linux Local Security Checks	high
89038	VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2012-0013) (remote check)	Nessus	Misc.	high
79507	OracleVM 2.2 : kernel (OVMSA-2013-0039)	Nessus	OracleVM Local Security Checks	high
79286	RHEL 5 : rhev-hypervisor5 (RHSA-2012:0488)	Nessus	Red Hat Local Security Checks	medium
68514	Oracle Linux 5 : kernel (ELSA-2012-0480)	Nessus	Oracle Linux Local Security Checks	high
68513	Oracle Linux 5 : kernel (ELSA-2012-0480-1)	Nessus	Oracle Linux Local Security Checks	medium
64039	RHEL 5 : kernel (RHSA-2012:0720)	Nessus	Red Hat Local Security Checks	high
61747	VMSA-2012-0013 : VMware vSphere and vCOps updates to third-party libraries	Nessus	VMware ESX Local Security Checks	critical
61301	Scientific Linux Security Update : kernel on SL5.x i386/x86_64 (20120417)	Nessus	Scientific Linux Local Security Checks	medium
58778	CentOS 5 : kernel (CESA-2012:0480)	Nessus	CentOS Local Security Checks	medium
58772	RHEL 5 : kernel (RHSA-2012:0480)	Nessus	Red Hat Local Security Checks	medium
801514	CentOS RHSA-2012-0480 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2012-1583

high

Tenable Plugins

critical

high

high

high

medium

high

medium

high

critical

medium

medium

medium

high