Detections
Analytics
openSUSE Security Update : kernel (openSUSE-SU-2013:1042-1)
high Nessus Plugin ID 75048
Language:
Synopsis
The remote openSUSE host is missing a security update.Description
The openSUSE 12.2 kernel was updated to fix security issue and other bugs.Security issues fixed: CVE-2013-2850: Incorrect strncpy usage in the network listening part of the iscsi target driver could have been used by remote attackers to crash the kernel or execute code.
This required the iscsi target running on the machine and the attacker able to make a network connection to it (aka not filtered by firewalls).
CVE-2013-2094: The perf_swevent_init function in kernel/events/core.c in the Linux kernel used an incorrect integer data type, which allowed local users to gain privileges via a crafted perf_event_open system call.
CVE-2013-0290: The __skb_recv_datagram function in net/core/datagram.c in the Linux kernel did not properly handle the MSG_PEEK flag with zero-length data, which allowed local users to cause a denial of service (infinite loop and system hang) via a crafted application.
Bugs fixed :
- reiserfs: fix spurious multiple-fill in reiserfs_readdir_dentry (bnc#822722).
- reiserfs: fix problems with chowning setuid file w/ xattrs (bnc#790920).
- qlge: fix dma map leak when the last chunk is not allocated (bnc#819519).
- Update config files: disable UCB1400 on all but ARM Currently UCB1400 is only used on ARM OMAP systems, and part of the code is dead code that can't even be modularized.
- CONFIG_UCB1400_CORE=n
- CONFIG_TOUCHSCREEN_UCB1400=n
- CONFIG_GPIO_UCB1400=n
- mm/mmap: check for RLIMIT_AS before unmapping (bnc#818327).
- unix/stream: fix peeking with an offset larger than data in queue (bnc#803931 CVE-2013-0290).
- unix/dgram: fix peeking with an offset larger than data in queue (bnc#803931 CVE-2013-0290).
- unix/dgram: peek beyond 0-sized skbs (bnc#803931 CVE-2013-0290).
Solution
Update the affected kernel packages.See Also
https://bugzilla.novell.com/show_bug.cgi?id=790920
https://bugzilla.novell.com/show_bug.cgi?id=803931
https://bugzilla.novell.com/show_bug.cgi?id=815745
https://bugzilla.novell.com/show_bug.cgi?id=818327
https://bugzilla.novell.com/show_bug.cgi?id=819519
https://bugzilla.novell.com/show_bug.cgi?id=819789
https://bugzilla.novell.com/show_bug.cgi?id=821560
https://bugzilla.novell.com/show_bug.cgi?id=822722
https://lists.opensuse.org/opensuse-updates/2013-06/msg00166.html
Plugin Details
Severity: High
ID: 75048
File Name: openSUSE-2013-512.nasl
Version: 1.7
Type: local
Agent: unix
Family: SuSE Local Security Checks
Published: 6/13/2014
Updated: 9/16/2022
Supported Sensors: Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Critical
Score: 9.6
CVSS v2
Risk Factor: High
Base Score: 7.9
Temporal Score: 6.9
Vector: CVSS2#AV:A/AC:M/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: p-cpe:/a:novell:opensuse:kernel-pae-devel-debuginfo, p-cpe:/a:novell:opensuse:kernel-debug-debuginfo, p-cpe:/a:novell:opensuse:kernel-desktop-devel, p-cpe:/a:novell:opensuse:kernel-desktop-debuginfo, p-cpe:/a:novell:opensuse:kernel-ec2-debugsource, p-cpe:/a:novell:opensuse:kernel-ec2-devel-debuginfo, p-cpe:/a:novell:opensuse:kernel-default-base, p-cpe:/a:novell:opensuse:kernel-pae, p-cpe:/a:novell:opensuse:kernel-vanilla-debugsource, p-cpe:/a:novell:opensuse:kernel-trace-base, p-cpe:/a:novell:opensuse:kernel-xen-debugsource, p-cpe:/a:novell:opensuse:kernel-default, p-cpe:/a:novell:opensuse:kernel-default-debugsource, p-cpe:/a:novell:opensuse:kernel-ec2-extra-debuginfo, p-cpe:/a:novell:opensuse:kernel-pae-base-debuginfo, p-cpe:/a:novell:opensuse:kernel-pae-devel, p-cpe:/a:novell:opensuse:kernel-vanilla-devel, p-cpe:/a:novell:opensuse:kernel-vanilla-debuginfo, p-cpe:/a:novell:opensuse:kernel-xen-base, p-cpe:/a:novell:opensuse:kernel-debug-devel-debuginfo, p-cpe:/a:novell:opensuse:kernel-desktop-base, p-cpe:/a:novell:opensuse:kernel-devel, p-cpe:/a:novell:opensuse:kernel-xen-debuginfo, p-cpe:/a:novell:opensuse:kernel-trace-devel-debuginfo, p-cpe:/a:novell:opensuse:kernel-desktop, p-cpe:/a:novell:opensuse:kernel-debug-devel, p-cpe:/a:novell:opensuse:kernel-debug-debugsource, p-cpe:/a:novell:opensuse:kernel-ec2, p-cpe:/a:novell:opensuse:kernel-ec2-base-debuginfo, p-cpe:/a:novell:opensuse:kernel-ec2-base, p-cpe:/a:novell:opensuse:kernel-source-vanilla, p-cpe:/a:novell:opensuse:kernel-default-debuginfo, p-cpe:/a:novell:opensuse:kernel-default-devel-debuginfo, p-cpe:/a:novell:opensuse:kernel-trace-debugsource, p-cpe:/a:novell:opensuse:kernel-default-base-debuginfo, p-cpe:/a:novell:opensuse:kernel-vanilla-devel-debuginfo, p-cpe:/a:novell:opensuse:kernel-pae-debugsource, p-cpe:/a:novell:opensuse:kernel-trace-base-debuginfo, p-cpe:/a:novell:opensuse:kernel-ec2-extra, p-cpe:/a:novell:opensuse:kernel-debug, p-cpe:/a:novell:opensuse:kernel-desktop-devel-debuginfo, p-cpe:/a:novell:opensuse:kernel-trace, p-cpe:/a:novell:opensuse:kernel-xen, p-cpe:/a:novell:opensuse:kernel-xen-base-debuginfo, p-cpe:/a:novell:opensuse:kernel-xen-devel, p-cpe:/a:novell:opensuse:kernel-debug-base-debuginfo, p-cpe:/a:novell:opensuse:kernel-trace-devel, p-cpe:/a:novell:opensuse:kernel-desktop-base-debuginfo, p-cpe:/a:novell:opensuse:kernel-pae-base, p-cpe:/a:novell:opensuse:kernel-ec2-debuginfo, p-cpe:/a:novell:opensuse:kernel-vanilla, p-cpe:/a:novell:opensuse:kernel-desktop-debugsource, p-cpe:/a:novell:opensuse:kernel-pae-debuginfo, p-cpe:/a:novell:opensuse:kernel-debug-base, p-cpe:/a:novell:opensuse:kernel-source, cpe:/o:novell:opensuse:12.2, p-cpe:/a:novell:opensuse:kernel-trace-debuginfo, p-cpe:/a:novell:opensuse:kernel-ec2-devel, p-cpe:/a:novell:opensuse:kernel-xen-devel-debuginfo, p-cpe:/a:novell:opensuse:kernel-syms, p-cpe:/a:novell:opensuse:kernel-default-devel
Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list, Host/cpu
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 6/10/2013
CISA Known Exploited Vulnerability Due Dates: 10/6/2022
Exploitable With
CANVAS (CANVAS)
Core Impact