来自 Red Hat 安全公告 2009:0473：

更新后的 kernel 程序包修复了多个安全问题和多个缺陷，现在可用于 Red Hat Enterprise Linux 5。

Red Hat 安全响应团队将此更新评级为具有重要安全影响。

kernel 程序包包含 Linux 内核，后者是任何 Linux 操作系统的核心。

此更新修复了以下安全问题：

* 在 Linux 内核网络文件系统 (NFS) 实现的 do_setlk() 函数中发现一个逻辑错误。如果信号中断了锁定请求，则会错误地创建本地 POSIX 锁定。如果在文件描述符的相应锁定请求返回前将描述符关闭，这可在 NFS 服务器上造成拒绝服务。（CVE-2008-4307，重要）

* 在 64 位系统上 Linux 内核系统调用审计实现中发现一个缺陷。如果系统调用审计配置根据“syscall”数量或参数进行过滤，此缺陷可允许本地非特权用户避开该配置。（CVE-2009-0834，重要）

* 如果某个进程在退出前执行了设置用户 ID (setuid) 应用程序，则 Linux 内核中的 exit_notify() 函数不会正确重置退出信号。这可允许本地非特权用户提升其权限。（CVE-2009-1337，重要）

* 在 Linux 内核 eCryptfs 实现的 ecryptfs_write_metadata_to_contents() 函数中发现一个缺陷。在具有 4096 字节页面大小的系统上，此缺陷可能导致 4096 字节的未初始化内核内存被写入到 eCryptfs 文件标头中，从而造成信息泄漏。注意：在运行有漏洞的 eCryptfs 版本的系统上创建的加密文件可能会在 eCryptfs 文件标头中包含泄漏的数据。此更新不会删除任何泄漏的数据。请参阅“参考”部分中的知识库文章以了解更多信息。（CVE-2009-0787，中危）

* 网络文件系统的 (NFS) Linux 内核实现未正确初始化 nfs_server 数据结构中的文件名限制。此缺陷可能会在挂载 NFS 共享的客户端上导致拒绝服务。（CVE-2009-1336，中危）

此更新还修复以下缺陷：

* enic 驱动程序（Cisco 10G 以太网）未在虚拟化下运行。(BZ#472474)

* 可能无法在低内存条件下成功配置使用 IBM eHEA 以太网设备驱动程序的网络接口。
(BZ#487035)

* 通过“arp_validate=3”选项绑定可能阻止故障转移。(BZ#488064)

* 在虚拟化下运行时，acpi-cpufreq 模块将“Domain attempted WRMSR”错误写入到 dmesg 日志。(BZ#488928)

* NFS 客户端可能在卸载期间遇到死锁。
(BZ#488929)

* ixgbe 驱动程序重复计算接收到的字节和数据包数量。(BZ#489459)

* Wacom Intuos3 Lens Cursor 设备未在 Wacom Intuos3 12x12 手写板上正常工作。(BZ#489460)

* 在 Itanium® 架构上，nanosleep() 导致 sleep 和 usleep 等使用它的命令的休眠时间比预期多一秒。(BZ#490434)

* 64 位 PowerPC 系统上运行 clvmd 时会发生 slab 缓存数据结构的内核错误和损坏。(BZ#491677)

* 在 32 位模式下运行时，NONSTOP_TSC 功能未在 Intel®微架构 (Nehalem) 上正确执行。(BZ#493356)

* 在安装期间或之后的某个时间点过后，键盘可能不会对 IBM eServer System p 计算机起作用。(BZ#494293)

* 将 Device Mapper Multipathing 用于 qla2xxx 驱动程序导致频繁的路径故障。(BZ#495635)

* 如果通过设置为小于系统中 CPU 实际数量的 dom0_max_vcpus 参数引导管理程序，并且启动了 cpuspeed 服务，则管理程序可能会崩溃。(BZ#495931)

* 使用 Openswan 提供 IPsec 虚拟专用网络最终导致 CPU 软锁定和系统崩溃。
(BZ#496044)

* posix_locks_deadlock() 可能会进入无限循环（在 BKL 下），从而导致系统挂起。(BZ#496842)

用户应升级这些更新后的程序包，其中包含用于修正这些问题的向后移植的修补程序。必须重新启动系统才能使此更新生效。

来自 Red Hat 安全公告 2009:1550：

更新后的 kernel 程序包修复了多个安全问题和多种缺陷，现在可用于 Red Hat Enterprise Linux 3。

Red Hat 安全响应团队将此更新评级为具有重要安全影响。

kernel 程序包包含 Linux 内核，后者是任何 Linux 操作系统的核心。

安全补丁：

* 调用 fput() 以关闭套接字时，Linux 内核中的 __scm_destroy() 函数可能对自身进行间接递归调用。这可能会导致拒绝服务。
（CVE-2008-5029，重要）

* Linux 内核中的 sendmsg() 函数不会在 UNIX 套接字垃圾回收期间阻断。这可能造成本地拒绝服务。（CVE-2008-5300，重要）

* 如果某个进程在退出前执行了设置用户 ID (setuid) 应用程序，则 Linux 内核中的 exit_notify() 函数不会正确重置退出信号。这可允许本地非特权用户提升其权限。（CVE-2009-1337，重要）

* 在 Linux 内核中的 Intel PRO/1000 网络驱动程序中发现一个缺陷。大小与界面 MTU 相近的帧可按多个硬件接收描述符进行拆分。此类帧的接收可能通过验证检查而被泄漏，导致长度校验功能损坏。远程攻击者可利用此缺陷发送特别构建的数据包，这可引起拒绝服务或执行代码。（CVE-2009-1385，重要）

* 执行 setuid 或 setgid 程序时未清除 ADDR_COMPAT_LAYOUT 和 MMAP_PAGE_ZERO 标记。本地非特权用户可以利用此缺陷来绕过 mmap_min_addr 保护机制并执行空指针取消引用攻击，或者绕过地址空间布局随机化 (ASLR) 安全功能。
（CVE-2009-1895，重要）

* 发现执行新进程时未清除 Linux 内核中的 clear_child_tid 指针。如果此指针指向新程序的内存的可写入部分，内核可能损坏四个字节的内存，从而可能导致本地拒绝服务或权限升级。（CVE-2009-2848，重要）

* 在 IrDA 套接字中的 getname() 实现、AppleTalk DDP 协议、NET/ROM 协议以及 Linux 内核中的 ROSE 协议实现中发现缺少初始化缺陷。这些 getname() 实现中的某些数据结构在复制到用户用户空间之前未正确初始化。这些缺陷可导致信息泄漏。（CVE-2009-3002，重要）

* 在 Linux 内核的以下函数中发现空指针取消引用缺陷：pipe_read_open()、pipe_write_open()、和 pipe_rdwr_open()。没有保留互斥体锁定时，i_pipe 指针在被用于更新 pipe 的读写计数器之前，可由其他进程释放。这可导致本地拒绝服务或权限升级。（CVE-2009-3547，重要）

缺陷补丁：

* 此更新添加了 mmap_min_addr 可调谐的限制检查，以便帮助防止非特权用户在最小地址以下创建新的内存映射。这有助于防止利用空指针取消引用缺陷。请注意，mmap_min_addr 默认被设置为零（禁用）以便向后兼容。(BZ#512642)

* 修复了 IPv6 中的桥接引用计数问题。(BZ#457010)

* 强制用户提供的 setsockopt() 参数以 null 结尾。
(BZ#505514)

* 内核构建选项中添加了 gcc 标记“-fno-delete-null-pointer-checks”。这防止 gcc 在首次使用指针后优化了空指针检查 (NULL pointer check)。攻击者经常利用空指针缺陷。保留这些检查是一项安全措施。(BZ#511185)

* 已对 IPv4 代码添加了检查，确保 rt 不是 NULL，有助于防止调用 ip_append_data() 的函数中未来出现可利用的缺陷。(BZ#520300)

用户应升级这些更新后的程序包，其中包含用于修正这些问题的向后移植的修补程序。必须重新启动系统才能使此更新生效。

此更新修复了以下安全问题：

- 在 Linux 内核网络文件系统 (NFS) 实现的 do_setlk() 函数中发现逻辑错误。如果信号中断了锁定请求，则会错误地创建本地 POSIX 锁定。如果在文件描述符的相应锁定请求返回前将描述符关闭，这可在 NFS 服务器上造成拒绝服务。（CVE-2008-4307，重要）

- 在 64 位系统上 Linux 内核系统调用审计实现中发现一个缺陷。如果系统调用审计配置根据“syscall”数量或参数进行过滤，此缺陷可允许本地非特权用户避开该配置。
 （CVE-2009-0834，重要）

- 如果某个进程在退出前执行了设置用户 ID (setuid) 应用程序，则 Linux 内核中的 exit_notify() 函数不会正确重置退出信号。这可允许本地非特权用户提升其权限。（CVE-2009-1337，重要）

- 在 Linux 内核 eCryptfs 实现的 ecryptfs_write_metadata_to_contents() 函数中发现一个缺陷。在具有 4096 字节页面大小的系统上，此缺陷可能导致 4096 字节的未初始化内核内存被写入到 eCryptfs 文件标头中，从而造成信息泄漏。注意：在运行有漏洞的 eCryptfs 版本的系统上创建的加密文件可能会在 eCryptfs 文件标头中包含泄漏的数据。此更新不会删除任何泄漏的数据。请参阅“参考”部分中的知识库文章以了解更多信息。（CVE-2009-0787，中危）

- 网络文件系统 (NFS) 的 Linux 内核实现未正确初始化 nfs_server 数据结构中的文件名限制。此缺陷可能会在挂载 NFS 共享的客户端上导致拒绝服务。（CVE-2009-1336，中危）

此更新还修复以下缺陷：

--enic 驱动程序（Cisco 10G 以太网）未在虚拟化下运行。(BZ#472474)

- 可能无法在低内存条件下成功配置使用 IBM eHEA 以太网设备驱动程序的网络接口。(BZ#487035)

- 通过“arp_validate=3”选项绑定可能阻止故障转移。(BZ#488064)

- 在虚拟化下运行时，acpi-cpufreq 模块将“Domain attempted WRMSR”错误写入到 dmesg 日志。(BZ#488928)

- NFS 客户端可能在卸载期间遇到死锁。(BZ#488929)

- ixgbe 驱动程序重复计算接收到的字节和数据包数量。(BZ#489459)

- Wacom Intuos3 Lens Cursor 设备未在 Wacom Intuos3 12x12 手写板上正常工作。
 (BZ#489460)

- 在 Itanium® 架构上，nanosleep() 导致 sleep 和 usleep 等使用它的命令的休眠时间比预期多一秒。(BZ#490434)

- 64 位 PowerPC 系统上运行 clvmd 时会发生 slab 缓存数据结构的内核错误和损坏。(BZ#491677)

- 在 32 位模式下运行时，NONSTOP_TSC 功能未在 Intel® 微架构 (Nehalem) 上正确执行。(BZ#493356)

- 在安装期间或之后的某个时间点过后，键盘可能不会对 IBM eServer System p 计算机起作用。(BZ#494293)

- 将 Device Mapper Multipathing 用于 qla2xxx 驱动程序导致频繁的路径故障。(BZ#495635)

- 如果通过设置为小于系统中 CPU 实际数量的 dom0_max_vcpus 参数引导管理程序，并且启动了 cpuspeed 服务，则管理程序可能会崩溃。(BZ#495931)

- 使用 Openswan 提供 IPsec 虚拟专用网络最终导致 CPU 软锁定和系统崩溃。(BZ#496044)

- posix_locks_deadlock() 可能会进入无限循环（在 BKL 下），从而导致系统挂起。
 (BZ#496842)

必须重新启动系统才能使此更新生效。

更新后的 kernel 程序包修复了两个安全问题和两个缺陷，现在可用于 Red Hat Enterprise Linux 4.7 Extended Update Support。

Red Hat 安全响应团队将此更新评级为具有重要安全影响。

kernel 程序包包含 Linux 内核，后者是任何 Linux 操作系统的核心。

此更新包含用于解决两个批准的安全问题的向后移植的补丁。这些问题仅影响 Red Hat Enterprise Linux 4.7 Extended Update Support 的用户，因为已经在 4.8 更新中为 Red Hat Enterprise Linux 4 的用户解决了这些问题 (RHSA-2009:1024)。

* 如果某个进程在退出前执行了设置用户 ID (setuid) 应用程序，则 Linux 内核中的 exit_notify() 函数不会正确重置退出信号。这可允许本地非特权用户提升其权限。（CVE-2009-1337，重要）

* 网络文件系统 (NFS) 第 4 版的 Linux 内核实现未正确初始化 nfs_server 数据结构中的文件名限制。此缺陷可能会在挂载 NFSv4 共享的客户端上导致拒绝服务。（CVE-2009-1336，中危）

此更新修复了以下缺陷：

* 在 IBM System z 系统上，如果 cio 驱动程序用于 DASD 设备，但 DASD 设备的最后路径断开，它仍可能尝试对该设备执行读取和写入操作，导致错误。在此更新中，这种情况下使用路径验证，从而解决了该问题。此外，当子通道未注册时，缺陷可导致错误。(BZ#437486)

* 缺陷导致 Broadcom NetXtreme II 57710 网络设备在某些 Dell PowerEdge R805 系统上无法正确运行。此设备正确显示在“lspci”输出中，但“ifup”失败且 IP 地址未分配。在此更新中，设备在 Dell PowerEdge R805 系统上正确运行。(BZ#491752)

用户应升级这些更新后的程序包，其中包含用于修正这些问题的向后移植的修补程序。必须重新启动系统才能使此更新生效。

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel :

The selinux_ip_postroute_iptables_compat function in security/selinux/hooks.c in the SELinux subsystem in the Linux kernel before 2.6.27.22, and 2.6.28.x before 2.6.28.10, when compat_net is enabled, omits calls to avc_has_perm for the (1) node and (2) port, which allows local users to bypass intended restrictions on network traffic. NOTE: this was incorrectly reported as an issue fixed in 2.6.27.21. (CVE-2009-1184)

The exit_notify function in kernel/exit.c in the Linux kernel before 2.6.30-rc1 does not restrict exit signals when the CAP_KILL capability is held, which allows local users to send an arbitrary signal to a process by running a program that modifies the exit_signal field and then uses an exec system call to launch a setuid application.
(CVE-2009-1337)

The (1) agp_generic_alloc_page and (2) agp_generic_alloc_pages functions in drivers/char/agp/generic.c in the agp subsystem in the Linux kernel before 2.6.30-rc3 do not zero out pages that may later be available to a user-space process, which allows local users to obtain sensitive information by reading these pages. (CVE-2009-1192)

The ABI in the Linux kernel 2.6.28 and earlier on s390, powerpc, sparc64, and mips 64-bit platforms requires that a 32-bit argument in a 64-bit register was properly sign extended when sent from a user-mode application, but cannot verify this, which allows local users to cause a denial of service (crash) or possibly gain privileges via a crafted system call. (CVE-2009-0029)

The __inet6_check_established function in net/ipv6/inet6_hashtables.c in the Linux kernel before 2.6.29, when Network Namespace Support (aka NET_NS) is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via vectors involving IPv6 packets. (CVE-20090-1360)

The inode double locking code in fs/ocfs2/file.c in the Linux kernel 2.6.30 before 2.6.30-rc3, 2.6.27 before 2.6.27.24, 2.6.29 before 2.6.29.4, and possibly other versions down to 2.6.19 allows local users to cause a denial of service (prevention of file creation and removal) via a series of splice system calls that trigger a deadlock between the generic_file_splice_write, splice_from_pipe, and ocfs2_file_splice_write functions. (CVE-2009-1961)

Integer underflow in the e1000_clean_rx_irq function in drivers/net/e1000/e1000_main.c in the e1000 driver in the Linux kernel before 2.6.30-rc8, the e1000e driver in the Linux kernel, and Intel Wired Ethernet (aka e1000) before 7.5.5 allows remote attackers to cause a denial of service (panic) via a crafted frame size.
(CVE-2009-1385)

The nfs_permission function in fs/nfs/dir.c in the NFS client implementation in the Linux kernel 2.6.29.3 and earlier, when atomic_open is available, does not check execute (aka EXEC or MAY_EXEC) permission bits, which allows local users to bypass permissions and execute files, as demonstrated by files on an NFSv4 fileserver. (CVE-2009-1630)

Additionally, the kernel package was updated to the Linux upstream stable version 2.6.27.24.

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

This kernel update for openSUSE 11.0 fixes some bugs and several security problems.

The following security issues are fixed: A local denial of service problem in the splice(2) system call.

CVE-2009-1630: The nfs_permission function in fs/nfs/dir.c in the NFS client implementation in the Linux kernel when atomic_open is available, does not check execute (aka EXEC or MAY_EXEC) permission bits, which allows local users to bypass permissions and execute files, as demonstrated by files on an NFSv4 fileserver.

CVE-2009-0834: The audit_syscall_entry function in the Linux kernel on the x86_64 platform did not properly handle (1) a 32-bit process making a 64-bit syscall or (2) a 64-bit process making a 32-bit syscall, which allows local users to bypass certain syscall audit configurations via crafted syscalls.

CVE-2009-1072: nfsd in the Linux kernel did not drop the CAP_MKNOD capability before handling a user request in a thread, which allows local users to create device nodes, as demonstrated on a filesystem that has been exported with the root_squash option.

CVE-2009-0835 The __secure_computing function in kernel/seccomp.c in the seccomp subsystem in the Linux kernel on the x86_64 platform, when CONFIG_SECCOMP is enabled, does not properly handle (1) a 32-bit process making a 64-bit syscall or (2) a 64-bit process making a 32-bit syscall, which allows local users to bypass intended access restrictions via crafted syscalls that are misinterpreted as (a) stat or (b) chmod.

CVE-2009-1439: Buffer overflow in fs/cifs/connect.c in CIFS in the Linux kernel 2.6.29 and earlier allows remote attackers to cause a denial of service (crash) or potential code execution via a long nativeFileSystem field in a Tree Connect response to an SMB mount request.

This requires that kernel can be made to mount a 'cifs' filesystem from a malicious CIFS server.

CVE-2009-1337: The exit_notify function in kernel/exit.c in the Linux kernel did not restrict exit signals when the CAP_KILL capability is held, which allows local users to send an arbitrary signal to a process by running a program that modifies the exit_signal field and then uses an exec system call to launch a setuid application.

CVE-2009-0859: The shm_get_stat function in ipc/shm.c in the shm subsystem in the Linux kernel, when CONFIG_SHMEM is disabled, misinterprets the data type of an inode, which allows local users to cause a denial of service (system hang) via an SHM_INFO shmctl call, as demonstrated by running the ipcs program. (SUSE is enabling CONFIG_SHMEM, so is by default not affected, the fix is just for completeness).

CVE-2009-1242: The vmx_set_msr function in arch/x86/kvm/vmx.c in the VMX implementation in the KVM subsystem in the Linux kernel on the i386 platform allows guest OS users to cause a denial of service (OOPS) by setting the EFER_LME (aka 'Long mode enable') bit in the Extended Feature Enable Register (EFER) model-specific register, which is specific to the x86_64 platform.

CVE-2009-1265: Integer overflow in rose_sendmsg (sys/net/af_rose.c) in the Linux kernel might allow attackers to obtain sensitive information via a large length value, which causes 'garbage' memory to be sent.

CVE-2009-0028: The clone system call in the Linux kernel allows local users to send arbitrary signals to a parent process from an unprivileged child process by launching an additional child process with the CLONE_PARENT flag, and then letting this new process exit.

CVE-2009-0675: The skfp_ioctl function in drivers/net/skfp/skfddi.c in the Linux kernel permits SKFP_CLR_STATS requests only when the CAP_NET_ADMIN capability is absent, instead of when this capability is present, which allows local users to reset the driver statistics, related to an 'inverted logic' issue.

CVE-2009-0676: The sock_getsockopt function in net/core/sock.c in the Linux kernel does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel memory via an SO_BSDCOMPAT getsockopt request.

CVE-2009-0322: drivers/firmware/dell_rbu.c in the Linux kernel allows local users to cause a denial of service (system crash) via a read system call that specifies zero bytes from the (1) image_type or (2) packet_size file in /sys/devices/platform/dell_rbu/.

CVE-2009-0269: fs/ecryptfs/inode.c in the eCryptfs subsystem in the Linux kernel allows local users to cause a denial of service (fault or memory corruption), or possibly have unspecified other impact, via a readlink call that results in an error, leading to use of a -1 return value as an array index.

CVE-2009-0065: Buffer overflow in net/sctp/sm_statefuns.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel allows remote attackers to have an unknown impact via an FWD-TSN (aka FORWARD-TSN) chunk with a large stream ID.

Some other non-security bugs were fixed, please see the RPM changelog.

a. JRE Security Update

  JRE update to version 1.5.0_20, which addresses multiple security   issues that existed in earlier releases of JRE.

  The Common Vulnerabilities and Exposures project (cve.mitre.org) has   assigned the following names to the security issues fixed in   JRE 1.5.0_18: CVE-2009-1093, CVE-2009-1094, CVE-2009-1095,   CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1099,   CVE-2009-1100, CVE-2009-1101, CVE-2009-1102, CVE-2009-1103,   CVE-2009-1104, CVE-2009-1105, CVE-2009-1106, and CVE-2009-1107.

  The Common Vulnerabilities and Exposures project (cve.mitre.org) has   assigned the following names to the security issues fixed in   JRE 1.5.0_20: CVE-2009-2625, CVE-2009-2670, CVE-2009-2671,   CVE-2009-2672, CVE-2009-2673, CVE-2009-2675, CVE-2009-2676,   CVE-2009-2716, CVE-2009-2718, CVE-2009-2719, CVE-2009-2720,   CVE-2009-2721, CVE-2009-2722, CVE-2009-2723, CVE-2009-2724.

b. Update Apache Tomcat version

  Update for VirtualCenter and ESX patch update the Tomcat package to   version 6.0.20 (vSphere 4.0) or version 5.5.28 (VirtualCenter 2.5)   which addresses multiple security issues that existed   in the previous version of Apache Tomcat.

  The Common Vulnerabilities and Exposures project (cve.mitre.org) has   assigned the following names to the security issues fixed in   Apache Tomcat 6.0.20 and Tomcat 5.5.28: CVE-2008-5515,   CVE-2009-0033, CVE-2009-0580, CVE-2009-0781, CVE-2009-0783.

  The Common Vulnerabilities and Exposures project (cve.mitre.org) has   assigned the following names to the security issues fixed in   Apache Tomcat 6.0.18:  CVE-2008-1232, CVE-2008-1947, CVE-2008-2370.

  The Common Vulnerabilities and Exposures project (cve.mitre.org) has   assigned the following names to the security issues fixed in   Apache Tomcat 6.0.16:  CVE-2007-5333, CVE-2007-5342, CVE-2007-5461,   CVE-2007-6286, CVE-2008-0002.
  c. Third-party library update for ntp.
   The Network Time Protocol (NTP) is used to synchronize a computer's   time with a referenced time source.
   ESXi 3.5 and ESXi 4.0 have a ntp client that is affected by the   following security issue. Note that the same security issue is   present in the ESX Service Console as described in section d. of   this advisory.
   A buffer overflow flaw was discovered in the ntpd daemon's NTPv4   authentication code. If ntpd was configured to use public key   cryptography for NTP packet authentication, a remote attacker could   use this flaw to send a specially crafted request packet that could   crash ntpd or, potentially, execute arbitrary code with the   privileges of the 'ntp' user.
   The Common Vulnerabilities and Exposures Project (cve.mitre.org)   has assigned the name CVE-2009-1252 to this issue.
   The NTP security issue identified by CVE-2009-0159 is not relevant   for ESXi 3.5 and ESXi 4.0.
 d. Service Console update for ntp

  Service Console package ntp updated to version ntp-4.2.2pl-9el5_3.2    The Network Time Protocol (NTP) is used to synchronize a computer's   time with a referenced time source.
   The Service Console present in ESX is affected by the following   security issues.
   A buffer overflow flaw was discovered in the ntpd daemon's NTPv4   authentication code. If ntpd was configured to use public key   cryptography for NTP packet authentication, a remote attacker could   use this flaw to send a specially crafted request packet that could   crash ntpd or, potentially, execute arbitrary code with the   privileges of the 'ntp' user.
   NTP authentication is not enabled by default on the Service Console.
   The Common Vulnerabilities and Exposures Project (cve.mitre.org)   has assigned the name CVE-2009-1252 to this issue.
   A buffer overflow flaw was found in the ntpq diagnostic command. A   malicious, remote server could send a specially crafted reply to an   ntpq request that could crash ntpq or, potentially, execute   arbitrary code with the privileges of the user running the ntpq   command.
   The Common Vulnerabilities and Exposures Project (cve.mitre.org)   has assigned the name CVE-2009-0159 to this issue.
  e. Updated Service Console package kernel

  Updated Service Console package kernel addresses the security   issues listed below.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the names CVE-2008-3528, CVE-2008-5700, CVE-2009-0028,   CVE-2009-0269, CVE-2009-0322, CVE-2009-0675, CVE-2009-0676,   CVE-2009-0778 to the security issues fixed in kernel   2.6.18-128.1.6.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the names CVE-2008-4307, CVE-2009-0834, CVE-2009-1337,   CVE-2009-0787, CVE-2009-1336 to the security issues fixed in   kernel 2.6.18-128.1.10.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the names CVE-2009-1439, CVE-2009-1633, CVE-2009-1072,   CVE-2009-1630, CVE-2009-1192 to the security issues fixed in   kernel 2.6.18-128.1.14.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the names CVE-2007-5966, CVE-2009-1385, CVE-2009-1388,   CVE-2009-1389, CVE-2009-1895, CVE-2009-2406, CVE-2009-2407 to the   security issues fixed in kernel 2.6.18-128.4.1.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the names CVE-2009-2692, CVE-2009-2698 to the   security issues fixed in kernel 2.6.18-128.7.1.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the names CVE-2009-0745, CVE-2009-0746, CVE-2009-0747,   CVE-2009-0748, CVE-2009-2847, CVE-2009-2848 to the security issues   fixed in kernel 2.6.18-164.

 f. Updated Service Console package python

  Service Console package Python update to version 2.4.3-24.el5.

  When the assert() system call was disabled, an input sanitization   flaw was revealed in the Python string object implementation that   led to a buffer overflow. The missing check for negative size values   meant the Python memory allocator could allocate less memory than   expected. This could result in arbitrary code execution with the   Python interpreter's privileges.

  Multiple buffer and integer overflow flaws were found in the Python   Unicode string processing and in the Python Unicode and string   object implementations. An attacker could use these flaws to cause   a denial of service.

  Multiple integer overflow flaws were found in the Python imageop   module. If a Python application used the imageop module to   process untrusted images, it could cause the application to   disclose sensitive information, crash or, potentially, execute   arbitrary code with the Python interpreter's privileges.

  Multiple integer underflow and overflow flaws were found in the   Python snprintf() wrapper implementation. An attacker could use   these flaws to cause a denial of service (memory corruption).

  Multiple integer overflow flaws were found in various Python   modules. An attacker could use these flaws to cause a denial of   service.

  An integer signedness error, leading to a buffer overflow, was   found in the Python zlib extension module. If a Python application   requested the negative byte count be flushed for a decompression   stream, it could cause the application to crash or, potentially,   execute arbitrary code with the Python interpreter's privileges.

  A flaw was discovered in the strxfrm() function of the Python   locale module. Strings generated by this function were not properly   NULL-terminated, which could possibly cause disclosure of data   stored in the memory of a Python application using this function.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the names CVE-2007-2052 CVE-2007-4965 CVE-2008-1721   CVE-2008-1887 CVE-2008-2315 CVE-2008-3142 CVE-2008-3143   CVE-2008-3144 CVE-2008-4864 CVE-2008-5031 to these issues.

 g. Updated Service Console package bind

  Service Console package bind updated to version 9.3.6-4.P1.el5

  The Berkeley Internet Name Domain (BIND) is an implementation of the   Domain Name System (DNS) protocols. BIND includes a DNS server   (named); a resolver library (routines for applications to use when   interfacing with DNS); and tools for verifying that the DNS server   is operating correctly.

  A flaw was found in the way BIND handles dynamic update message   packets containing the 'ANY' record type. A remote attacker could   use this flaw to send a specially crafted dynamic update packet   that could cause named to exit with an assertion failure.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the name CVE-2009-0696 to this issue.

 h. Updated Service Console package libxml2

  Service Console package libxml2 updated to version 2.6.26-2.1.2.8.

  libxml is a library for parsing and manipulating XML files. A   Document Type Definition (DTD) defines the legal syntax (and also   which elements can be used) for certain types of files, such as XML   files.

  A stack overflow flaw was found in the way libxml processes the   root XML document element definition in a DTD. A remote attacker   could provide a specially crafted XML file, which once opened by a   local, unsuspecting user, would lead to denial of service.

  Multiple use-after-free flaws were found in the way libxml parses   the Notation and Enumeration attribute types. A remote attacker   could provide a specially crafted XML file, which once opened by a   local, unsuspecting user, would lead to denial of service.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the names CVE-2009-2414 and CVE-2009-2416 to these   issues.

 i. Updated Service Console package curl

  Service Console package curl updated to version 7.15.5-2.1.el5_3.5

  A cURL is affected by the previously published 'null prefix attack',   caused by incorrect handling of NULL characters in X.509   certificates. If an attacker is able to get a carefully-crafted   certificate signed by a trusted Certificate Authority, the attacker   could use the certificate during a man-in-the-middle attack and   potentially confuse cURL into accepting it by mistake.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the name CVE-2009-2417 to this issue

 j. Updated Service Console package gnutls

  Service Console package gnutil updated to version 1.4.1-3.el5_3.5

  A flaw was discovered in the way GnuTLS handles NULL characters in   certain fields of X.509 certificates. If an attacker is able to get   a carefully-crafted certificate signed by a Certificate Authority   trusted by an application using GnuTLS, the attacker could use the   certificate during a man-in-the-middle attack and potentially   confuse the application into accepting it by mistake.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the name CVE-2009-2730 to this issue

The Linux kernel on SUSE Linux Enterprise 11 was updated to 2.6.27.23 and received lots of bugs and security fixes.

The following security issues have been fixed :

  - Buffer overflow in fs/cifs/connect.c in CIFS in the     Linux kernel 2.6.29 and earlier allows remote attackers     to cause a denial of service (crash) or potential code     execution via a long nativeFileSystem field in a Tree     Connect response to an SMB mount request.
    (CVE-2009-1439)

This requires that kernel can be made to mount a 'cifs' filesystem from a malicious CIFS server.

  - The exit_notify function in kernel/exit.c in the Linux     kernel did not restrict exit signals when the CAP_KILL     capability is held, which allows local users to send an     arbitrary signal to a process by running a program that     modifies the exit_signal field and then uses an exec     system call to launch a setuid application.
    (CVE-2009-1337)

The GCC option -fwrapv has been added to compilation to work around potentially removing integer overflow checks.

  - Integer overflow in rose_sendmsg (sys/net/af_rose.c) in     the Linux kernel might allow attackers to obtain     sensitive information via a large length value, which     causes 'garbage' memory to be sent. (CVE-2009-1265)

  - The vmx_set_msr function in arch/x86/kvm/vmx.c in the     VMX implementation in the KVM subsystem in the Linux     kernel on the i386 platform allows guest OS users to     cause a denial of service (OOPS) by setting the EFER_LME     (aka 'Long mode enable') bit in the Extended Feature     Enable Register (EFER) model-specific register, which is     specific to the x86_64 platform. (CVE-2009-1242)

  - The __inet6_check_established function in     net/ipv6/inet6_hashtables.c in the Linux kernel, when     Network Namespace Support (aka NET_NS) is enabled,     allows remote attackers to cause a denial of service     (NULL pointer dereference and system crash) via vectors     involving IPv6 packets. (CVE-2009-1360)

  - drivers/char/agp/generic.c in the agp subsystem in the     Linux kernel does not zero out pages that may later be     available to a user-space process, which allows local     users to obtain sensitive information by reading these     pages. (CVE-2009-1192)

Additionaly a lot of bugs have been fixed and are listed in the RPM changelog.

The Linux kernel on SUSE Linux Enterprise 10 Service Pack 2 was updated to fix various security issues and several bugs.

The following security issues were fixed: CVE-2009-0834: The audit_syscall_entry function in the Linux kernel on the x86_64 platform did not properly handle (1) a 32-bit process making a 64-bit syscall or (2) a 64-bit process making a 32-bit syscall, which allows local users to bypass certain syscall audit configurations via crafted syscalls.

  - nfsd in the Linux kernel did not drop the CAP_MKNOD     capability before handling a user request in a thread,     which allows local users to create device nodes, as     demonstrated on a filesystem that has been exported with     the root_squash option. (CVE-2009-1072)

  - The __secure_computing function in kernel/seccomp.c in     the seccomp subsystem in the Linux kernel on the x86_64     platform, when CONFIG_SECCOMP is enabled, does not     properly handle (1) a 32-bit process making a 64-bit     syscall or (2) a 64-bit process making a 32-bit syscall,     which allows local users to bypass intended access     restrictions via crafted syscalls that are     misinterpreted as (a) stat or (b) chmod. (CVE-2009-0835)

  - Buffer overflow in fs/cifs/connect.c in CIFS in the     Linux kernel 2.6.29 and earlier allows remote attackers     to cause a denial of service (crash) or potential code     execution via a long nativeFileSystem field in a Tree     Connect response to an SMB mount request.
    (CVE-2009-1439)

This requires that kernel can be made to mount a 'cifs' filesystem from a malicious CIFS server.

  - The exit_notify function in kernel/exit.c in the Linux     kernel did not restrict exit signals when the CAP_KILL     capability is held, which allows local users to send an     arbitrary signal to a process by running a program that     modifies the exit_signal field and then uses an exec     system call to launch a setuid application.
    (CVE-2009-1337)

  - The shm_get_stat function in ipc/shm.c in the shm     subsystem in the Linux kernel, when CONFIG_SHMEM is     disabled, misinterprets the data type of an inode, which     allows local users to cause a denial of service (system     hang) via an SHM_INFO shmctl call, as demonstrated by     running the ipcs program. (SUSE is enabling     CONFIG_SHMEM, so is by default not affected, the fix is     just for completeness). (CVE-2009-0859)

The GCC option -fwrapv has been added to compilation to work around potentially removing integer overflow checks.

  - Integer overflow in rose_sendmsg (sys/net/af_rose.c) in     the Linux kernel might allow attackers to obtain     sensitive information via a large length value, which     causes 'garbage' memory to be sent. (CVE-2009-1265)

Also a number of bugs were fixed, for details please see the RPM changelog.

Updated kernel packages that fix several security issues and several bugs are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* a logic error was found in the do_setlk() function of the Linux kernel Network File System (NFS) implementation. If a signal interrupted a lock request, the local POSIX lock was incorrectly created. This could cause a denial of service on the NFS server if a file descriptor was closed before its corresponding lock request returned. (CVE-2008-4307, Important)

* a deficiency was found in the Linux kernel system call auditing implementation on 64-bit systems. This could allow a local, unprivileged user to circumvent a system call audit configuration, if that configuration filtered based on the 'syscall' number or arguments. (CVE-2009-0834, Important)

* the exit_notify() function in the Linux kernel did not properly reset the exit signal if a process executed a set user ID (setuid) application before exiting. This could allow a local, unprivileged user to elevate their privileges. (CVE-2009-1337, Important)

* a flaw was found in the ecryptfs_write_metadata_to_contents() function of the Linux kernel eCryptfs implementation. On systems with a 4096 byte page-size, this flaw may have caused 4096 bytes of uninitialized kernel memory to be written into the eCryptfs file headers, leading to an information leak. Note: Encrypted files created on systems running the vulnerable version of eCryptfs may contain leaked data in the eCryptfs file headers. This update does not remove any leaked data. Refer to the Knowledgebase article in the References section for further information. (CVE-2009-0787, Moderate)

* the Linux kernel implementation of the Network File System (NFS) did not properly initialize the file name limit in the nfs_server data structure. This flaw could possibly lead to a denial of service on a client mounting an NFS share. (CVE-2009-1336, Moderate)

This update also fixes the following bugs :

* the enic driver (Cisco 10G Ethernet) did not operate under virtualization. (BZ#472474)

* network interfaces using the IBM eHEA Ethernet device driver could not be successfully configured under low-memory conditions.
(BZ#487035)

* bonding with the 'arp_validate=3' option may have prevented fail overs. (BZ#488064)

* when running under virtualization, the acpi-cpufreq module wrote 'Domain attempted WRMSR' errors to the dmesg log. (BZ#488928)

* NFS clients may have experienced deadlocks during unmount.
(BZ#488929)

* the ixgbe driver double counted the number of received bytes and packets. (BZ#489459)

* the Wacom Intuos3 Lens Cursor device did not work correctly with the Wacom Intuos3 12x12 tablet. (BZ#489460)

* on the Itanium(r) architecture, nanosleep() caused commands which used it, such as sleep and usleep, to sleep for one second more than expected. (BZ#490434)

* a panic and corruption of slab cache data structures occurred on 64-bit PowerPC systems when clvmd was running. (BZ#491677)

* the NONSTOP_TSC feature did not perform correctly on the Intel(r) microarchitecture (Nehalem) when running in 32-bit mode. (BZ#493356)

* keyboards may not have functioned on IBM eServer System p machines after a certain point during installation or afterward. (BZ#494293)

* using Device Mapper Multipathing with the qla2xxx driver resulted in frequent path failures. (BZ#495635)

* if the hypervisor was booted with the dom0_max_vcpus parameter set to less than the actual number of CPUs in the system, and the cpuspeed service was started, the hypervisor could crash. (BZ#495931)

* using Openswan to provide an IPsec virtual private network eventually resulted in a CPU soft lockup and a system crash.
(BZ#496044)

* it was possible for posix_locks_deadlock() to enter an infinite loop (under the BKL), causing a system hang. (BZ#496842)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

CVE-2008-5029 kernel: Unix sockets kernel panic

CVE-2008-5300 kernel: fix soft lockups/OOM issues with unix socket garbage collector

CVE-2009-1337 kernel: exit_notify: kill the wrong capable(CAP_KILL) check

CVE-2009-1385 kernel: e1000_clean_rx_irq() denial of service

CVE-2009-1895 kernel: personality: fix PER_CLEAR_ON_SETID

CVE-2009-2848 kernel: execve: must clear current->clear_child_tid

CVE-2009-3001, CVE-2009-3002 kernel: numerous getname() infoleaks 520300 - kernel: ipv4: make ip_append_data() handle NULL routing table [rhel-3]

CVE-2009-3547 kernel: fs: pipe.c NULL pointer dereference

Security fixes :

  - when fput() was called to close a socket, the
    __scm_destroy() function in the Linux kernel could make     indirect recursive calls to itself. This     could,potentially, lead to a denial of service issue.
    (CVE-2008-5029, Important)

  - the sendmsg() function in the Linux kernel did not block     during UNIX socket garbage collection. This could,     potentially, lead to a local denial of service.
    (CVE-2008-5300, Important)

  - the exit_notify() function in the Linux kernel did not     properly reset the exit signal if a process executed a     set user ID (setuid) application before exiting. This     could allow a local, unprivileged user to elevate their     privileges. (CVE-2009-1337, Important)

  - a flaw was found in the Intel PRO/1000 network driver in     the Linux kernel. Frames with sizes near the MTU of an     interface may be split across multiple hardware receive     descriptors. Receipt of such a frame could leak through     a validation check, leading to a corruption of the     length check. A remote attacker could use this flaw to     send a specially crafted packet that would cause a     denial of service or code execution. (CVE-2009-1385,     Important)

  - the ADDR_COMPAT_LAYOUT and MMAP_PAGE_ZERO flags were not     cleared when a setuid or setgid program was executed. A     local, unprivileged user could use this flaw to bypass     the mmap_min_addr protection mechanism and perform a     NULL pointer dereference attack, or bypass the Address     Space Layout Randomization (ASLR) security feature.
    (CVE-2009-1895, Important)

  - it was discovered that, when executing a new process,     the clear_child_tid pointer in the Linux kernel is not     cleared. If this pointer points to a writable portion of     the memory of the new program, the kernel could corrupt     four bytes of memory, possibly leading to a local denial     of service or privilege escalation. (CVE-2009-2848,     Important)

  - missing initialization flaws were found in getname()     implementations in the IrDA sockets, AppleTalk DDP     protocol, NET/ROM protocol, and ROSE protocol     implementations in the Linux kernel. Certain data     structures in these getname() implementations were not     initialized properly before being copied to user-space.
    These flaws could lead to an information leak.
    (CVE-2009-3002, Important)

  - a NULL pointer dereference flaw was found in each of the     following functions in the Linux kernel:
    pipe_read_open(), pipe_write_open(), and     pipe_rdwr_open(). When the mutex lock is not held, the     i_pipe pointer could be released by other processes     before it is used to update the pipe's reader and writer     counters. This could lead to a local denial of service     or privilege escalation. (CVE-2009-3547, Important)

Bug fixes :

  - this update adds the mmap_min_addr tunable and     restriction checks to help prevent unprivileged users     from creating new memory mappings below the minimum     address. This can help prevent the exploitation of NULL     pointer dereference bugs. Note that mmap_min_addr is set     to zero (disabled) by default for backwards     compatibility. (BZ#512642)

  - a bridge reference count problem in IPv6 has been fixed.
    (BZ#457010)

  - enforce null-termination of user-supplied arguments to     setsockopt(). (BZ#505514)

  - the gcc flag '-fno-delete-null-pointer-checks' was added     to the kernel build options. This prevents gcc from     optimizing out NULL pointer checks after the first use     of a pointer. NULL pointer bugs are often exploited by     attackers. Keeping these checks is a safety measure.
    (BZ#511185)

  - a check has been added to the IPv4 code to make sure     that rt is not NULL, to help prevent future bugs in     functions that call ip_append_data() from being     exploitable. (BZ#520300)

The system must be rebooted for this update to take effect.

Updated kernel packages that fix several security issues and multiple bugs are now available for Red Hat Enterprise Linux 3.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security fixes :

* when fput() was called to close a socket, the __scm_destroy() function in the Linux kernel could make indirect recursive calls to itself. This could, potentially, lead to a denial of service issue.
(CVE-2008-5029, Important)

* the sendmsg() function in the Linux kernel did not block during UNIX socket garbage collection. This could, potentially, lead to a local denial of service. (CVE-2008-5300, Important)

* the exit_notify() function in the Linux kernel did not properly reset the exit signal if a process executed a set user ID (setuid) application before exiting. This could allow a local, unprivileged user to elevate their privileges. (CVE-2009-1337, Important)

* a flaw was found in the Intel PRO/1000 network driver in the Linux kernel. Frames with sizes near the MTU of an interface may be split across multiple hardware receive descriptors. Receipt of such a frame could leak through a validation check, leading to a corruption of the length check. A remote attacker could use this flaw to send a specially crafted packet that would cause a denial of service or code execution. (CVE-2009-1385, Important)

* the ADDR_COMPAT_LAYOUT and MMAP_PAGE_ZERO flags were not cleared when a setuid or setgid program was executed. A local, unprivileged user could use this flaw to bypass the mmap_min_addr protection mechanism and perform a NULL pointer dereference attack, or bypass the Address Space Layout Randomization (ASLR) security feature.
(CVE-2009-1895, Important)

* it was discovered that, when executing a new process, the clear_child_tid pointer in the Linux kernel is not cleared. If this pointer points to a writable portion of the memory of the new program, the kernel could corrupt four bytes of memory, possibly leading to a local denial of service or privilege escalation. (CVE-2009-2848, Important)

* missing initialization flaws were found in getname() implementations in the IrDA sockets, AppleTalk DDP protocol, NET/ROM protocol, and ROSE protocol implementations in the Linux kernel. Certain data structures in these getname() implementations were not initialized properly before being copied to user-space. These flaws could lead to an information leak. (CVE-2009-3002, Important)

* a NULL pointer dereference flaw was found in each of the following functions in the Linux kernel: pipe_read_open(), pipe_write_open(), and pipe_rdwr_open(). When the mutex lock is not held, the i_pipe pointer could be released by other processes before it is used to update the pipe's reader and writer counters. This could lead to a local denial of service or privilege escalation. (CVE-2009-3547, Important)

Bug fixes :

* this update adds the mmap_min_addr tunable and restriction checks to help prevent unprivileged users from creating new memory mappings below the minimum address. This can help prevent the exploitation of NULL pointer dereference bugs. Note that mmap_min_addr is set to zero (disabled) by default for backwards compatibility. (BZ#512642)

* a bridge reference count problem in IPv6 has been fixed. (BZ#457010)

* enforce null-termination of user-supplied arguments to setsockopt().
(BZ#505514)

* the gcc flag '-fno-delete-null-pointer-checks' was added to the kernel build options. This prevents gcc from optimizing out NULL pointer checks after the first use of a pointer. NULL pointer bugs are often exploited by attackers. Keeping these checks is a safety measure. (BZ#511185)

* a check has been added to the IPv4 code to make sure that rt is not NULL, to help prevent future bugs in functions that call ip_append_data() from being exploitable. (BZ#520300)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2009-0473.

ID	名稱	產品	系列	已發布	已更新	嚴重性
67854	Oracle Linux 5：kernel (ELSA-2009-0473)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/8/24	medium
67955	Oracle Linux 3：kernel (ELSA-2009-1550)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/8/24	high
60581	Scientific Linux 安全更新：SL5.x i386/x86_64 中的 kernel	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
63880	RHEL 4：kernel (RHSA-2009:1077)	Nessus	Red Hat Local Security Checks	2013/1/24	2021/1/14	medium
39444	Mandriva Linux Security Advisory : kernel (MDVSA-2009:135)	Nessus	Mandriva Local Security Checks	2009/6/18	2021/1/6	high
40012	openSUSE Security Update : kernel (kernel-951)	Nessus	SuSE Local Security Checks	2009/7/21	2021/1/14	critical
42870	VMSA-2009-0016 : VMware vCenter and ESX update release and vMA patch release address multiple security issues in third party components.	Nessus	VMware ESX Local Security Checks	2009/11/23	2021/1/6	medium
41411	SuSE 11 Security Update : Linux kernel (SAT Patch Numbers 927 / 929 / 930)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	high
41539	SuSE 10 Security Update : the Linux kernel (ZYPP Patch Number 6237)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	high
43746	CentOS 5 : kernel (CESA-2009:0473)	Nessus	CentOS Local Security Checks	2010/1/6	2021/1/4	medium
60688	Scientific Linux Security Update : kernel on SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
59137	SuSE 10 Security Update : the Linux kernel (ZYPP Patch Number 6236)	Nessus	SuSE Local Security Checks	2012/5/17	2021/1/14	high
67070	CentOS 3 : kernel (CESA-2009:1550)	Nessus	CentOS Local Security Checks	2013/6/29	2021/1/4	high
801469	CentOS RHSA-2009-0473 Security Check	Log Correlation Engine	Generic			high

偵測

搜尋 Plugin

medium

high

medium

medium

high

critical

medium

high

high

medium

high

high

high

high