From Red Hat Security Advisory 2009:0020 :

Updated Bind packages to correct a security issue are now available for Red Hat Enterprise Linux 2.1, 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols.

A flaw was discovered in the way BIND checked the return value of the OpenSSL DSA_do_verify function. On systems using DNSSEC, a malicious zone could present a malformed DSA certificate and bypass proper certificate validation, allowing spoofing attacks. (CVE-2009-0025)

For users of Red Hat Enterprise Linux 3 this update also addresses a bug which can cause BIND to occasionally exit with an assertion failure.

All BIND users are advised to upgrade to the updated package, which contains a backported patch to resolve this issue. After installing the update, BIND daemon will be restarted automatically.

From Red Hat Security Advisory 2009:0046 :

Updated ntp packages to correct a security issue are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Network Time Protocol (NTP) is used to synchronize a computer's time with a referenced time source.

A flaw was discovered in the way the ntpd daemon checked the return value of the OpenSSL EVP_VerifyFinal function. On systems using NTPv4 authentication, this could lead to an incorrect verification of cryptographic signatures, allowing time-spoofing attacks.
(CVE-2009-0021)

Note: This issue only affects systems that have enabled NTP authentication. By default, NTP authentication is not enabled.

All ntp users are advised to upgrade to the updated packages, which contain a backported patch to resolve this issue. After installing the update, the ntpd daemon will restart automatically.

The remote VMware ESX host is missing a security-related patch. It is, therefore, is affected by multiple vulnerabilities :

  - A format string flaw exists in the Vim help tag     processor in the helptags_one() function that allows a     remote attacker to execute arbitrary code by tricking a     user into executing the 'helptags' command on malicious     help files. (CVE-2007-2953)

  - Multiple flaws exist in the Vim system functions due to     a failure to sanitize user-supplied input. An attacker     can exploit these to execute arbitrary code by tricking     a user into opening a crafted file. (CVE-2008-2712)

  - A heap-based buffer overflow condition exists in the Vim     mch_expand_wildcards() function. An attacker can exploit     this, via shell metacharacters in a crafted file name,     to execute arbitrary code. (CVE-2008-3432)

  - Multiple flaws exist in Vim keyword and tag handling due     to improper handling of escape characters. An attacker     can exploit this, via a crafted document, to execute     arbitrary shell commands or Ex commands. (CVE-2008-4101)

  - A security bypass vulnerability exists in OpenSSL due to     a failure to properly check the return value from the     EVP_VerifyFinal() function. A remote attacker can     exploit this, via a malformed SSL/TLS signature for DSA     and ECDSA keys, to bypass the validation of the     certificate chain. (CVE-2008-5077)

  - A security bypass vulnerability exists in BIND due to a     failure to properly check the return value from the     OpenSSL DSA_verify() function. A remote attacker can     exploit this, via a malformed SSL/TLS signature, to     bypass the validation of the certificate chain on those     systems using DNSSEC. (CVE-2009-0025)

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.7.  Mac OS X 10.5.7 contains security fixes for the following products : 

- Apache
- ATS
- BIND
- CFNetwork
- CoreGraphics
-Cscope
- CUPS
- Disk Images
- enscript
- Flash player
- Help Viewer
- iChat
- Internation Components for Unicode
- IPSec
- Kerberos
- Kernel
- Launch Services
- libxml
- Net-SNMP
- Network Time
- Networking
- OpenSSL
- PHP
- QuickDraw Manager
- ruby
- Safari
- Spotlight
- system_cmds
- telnet
- WebKit
- X11
- Terminal

ID	名稱	產品	系列	已發布	已更新	嚴重性
67792	Oracle Linux 3 / 4 / 5 : bind (ELSA-2009-0020)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	medium
67793	Oracle Linux 4 / 5 : ntp (ELSA-2009-0046)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	medium
89112	VMware ESX Multiple Vulnerabilities (VMSA-2009-0004) (remote check)	Nessus	Misc.	2016/3/3	2021/1/6	high
5023	Mac OS X 10.5 < 10.5.7 Multiple Vulnerabilities	Nessus Network Monitor	Generic	2004/8/18	2019/3/6	critical
800792	Mac OS X 10.5 < 10.5.7 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection			high

偵測

搜尋 Plugin

medium

medium

high

critical

high