Peter Huewe discovered an information leak in the handling of reading security-related TPM data. A local, unprivileged user could read the results of a previous TPM command. (CVE-2011-1162)

Clement Lecigne discovered a bug in the HFS filesystem. A local attacker could exploit this to cause a kernel oops. (CVE-2011-2203)

A flaw was found in how the Linux kernel handles user-defined key types. An unprivileged local user could exploit this to crash the system. (CVE-2011-4110)

Peter Huewe discovered an information leak in the handling of reading security-related TPM data. A local, unprivileged user could read the results of a previous TPM command. (CVE-2011-1162)

Clement Lecigne discovered a bug in the HFS filesystem. A local attacker could exploit this to cause a kernel oops. (CVE-2011-2203)

A flaw was found in how the Linux kernel handles user-defined key types. An unprivileged local user could exploit this to crash the system. (CVE-2011-4110).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Clement Lecigne discovered a bug in the HFS filesystem. A local attacker could exploit this to cause a kernel oops. (CVE-2011-2203)

A bug was discovered in the XFS filesystem's handling of pathnames. A local attacker could exploit this to crash the system, leading to a denial of service, or gain root privileges. (CVE-2011-4077)

A flaw was found in how the Linux kernel handles user-defined key types. An unprivileged local user could exploit this to crash the system. (CVE-2011-4110)

A flaw was found in the Journaling Block Device (JBD). A local attacker able to mount ext3 or ext4 file systems could exploit this to crash the system, leading to a denial of service. (CVE-2011-4132)

Clement Lecigne discovered a bug in the HFS file system bounds checking. When a malformed HFS file system is mounted a local user could crash the system or gain root privileges. (CVE-2011-4330)

Chen Haogang discovered an integer overflow that could result in memory corruption. A local unprivileged user could use this to crash the system. (CVE-2012-0044)

Juri Aedla discovered that the kernel incorrectly handled /proc/<pid>/mem permissions. A local attacker could exploit this and gain root privileges. (CVE-2012-0056).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2013-0039 for details.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-1479 advisory.

    - [fs] cifs: always do is_path_accessible check in cifs_mount (Jeff Layton) [738299 738300]     {CVE-2011-3363}
    - [fs] cifs: add fallback in is_path_accessible for old servers (Jeff Layton) [738299 738300]     {CVE-2011-3363}
    - [char] tpm: Zero buffer after copying to userspace (Jiri Benc) [732630 732631] {CVE-2011-1162}
    - [fs] hfs: fix hfs_find_init() sb->ext_tree NULL ptr oops (Phillip Lougher) [712775 712776]     {CVE-2011-2203}
    - [misc] kernel: plug taskstats io infoleak (Jerome Marchand) [716845 716846] {CVE-2011-2494}
    - [xen] passthrough: block VT-d MSI trap injection (Paolo Bonzini) [716301 716302] {CVE-2011-1898}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:1479 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    This update fixes the following security issues:

    * Using PCI passthrough without interrupt remapping support allowed Xen     hypervisor guests to generate MSI interrupts and thus potentially inject     traps. A privileged guest user could use this flaw to crash the host or     possibly escalate their privileges on the host. The fix for this issue can     prevent PCI passthrough working and guests starting. Refer to Red Hat     Bugzilla bug 715555 for details. (CVE-2011-1898, Important)

    * A flaw was found in the way CIFS (Common Internet File System) shares     with DFS referrals at their root were handled. An attacker on the local     network who is able to deploy a malicious CIFS server could create a CIFS     network share that, when mounted, would cause the client system to crash.
    (CVE-2011-3363, Moderate)

    * A NULL pointer dereference flaw was found in the way the Linux kernel's     key management facility handled user-defined key types. A local,     unprivileged user could use the keyctl utility to cause a denial of     service. (CVE-2011-4110, Moderate)

    * A flaw in the way memory containing security-related data was handled in     tpm_read() could allow a local, unprivileged user to read the results of a     previously run TPM command. (CVE-2011-1162, Low)

    * A NULL pointer dereference flaw was found in the Linux kernel's HFS file     system implementation. A local attacker could use this flaw to cause a     denial of service by mounting a disk that contains a specially-crafted HFS     file system with a corrupted MDB extent record. (CVE-2011-2203, Low)

    * The I/O statistics from the taskstats subsystem could be read without     any restrictions. A local, unprivileged user could use this flaw to gather     confidential information, such as the length of a password used in a     process. (CVE-2011-2494, Low)

    Red Hat would like to thank Yogesh Sharma for reporting CVE-2011-3363;
    Peter Huewe for reporting CVE-2011-1162; Clement Lecigne for reporting     CVE-2011-2203; and Vasiliy Kulikov of Openwall for reporting CVE-2011-2494.

    This update also fixes several bugs and adds one enhancement. Documentation     for these changes will be available shortly from the Technical Notes     document linked to in the References section.

    Users should upgrade to these updated packages, which contain backported     patches to correct these issues, and fix the bugs and add the enhancement     noted in the Technical Notes. The system must be rebooted for this update     to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Peter Huewe discovered an information leak in the handling of reading security-related TPM data. A local, unprivileged user could read the results of a previous TPM command. (CVE-2011-1162)

Clement Lecigne discovered a bug in the HFS filesystem. A local attacker could exploit this to cause a kernel oops. (CVE-2011-2203)

Han-Wen Nienhuys reported a flaw in the FUSE kernel module. A local user who can mount a FUSE file system could cause a denial of service. (CVE-2011-3353)

A flaw was found in how the Linux kernel handles user-defined key types. An unprivileged local user could exploit this to crash the system. (CVE-2011-4110)

Clement Lecigne discovered a bug in the HFS filesystem. A local attacker could exploit this to cause a kernel oops. (CVE-2011-2203)

A flaw was found in how the Linux kernel handles user-defined key types. An unprivileged local user could exploit this to crash the system. (CVE-2011-4110).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Peter Huewe discovered an information leak in the handling of reading security-related TPM data. A local, unprivileged user could read the results of a previous TPM command. (CVE-2011-1162)

Dan Rosenberg reported an error in the old ABI compatibility layer of ARM kernels. A local attacker could exploit this flaw to cause a denial of service or gain root privileges. (CVE-2011-1759)

Ben Hutchings reported a flaw in the kernel's handling of corrupt LDM partitions. A local user could exploit this to cause a denial of service or escalate privileges. (CVE-2011-2182)

Clement Lecigne discovered a bug in the HFS filesystem. A local attacker could exploit this to cause a kernel oops. (CVE-2011-2203)

A flaw was found in how the Linux kernel handles user-defined key types. An unprivileged local user could exploit this to crash the system. (CVE-2011-4110).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Nick Bowler discovered the kernel GHASH message digest algorithm incorrectly handled error conditions. A local attacker could exploit this to cause a kernel oops.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The openSUSE 12.1 kernel was updated to 3.1.9 to fix bugs and security issues. The full list of changes in 3.1.9 is available here :

http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.9 http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.8 http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.7 http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.6 http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.5 http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.4 http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.3 http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.2 http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.1.2 

Following security issues have been fixed :

CVE-2011-2203: Missing NULL pointer check in hfs filesystem code

CVE-2011-4604: Fix possible kernel memory corruption if B.A.T.M.A.N.
mesh protocol is being used.

CVE-2012-0056: Local root vulnerability via writing to /proc/pid/mem

CVE-2012-0207: Remote DoS vulnerability via crafted IGMP packages.

Following non-security bug fixes have been added :

  - BTRFS support has been improved with many bug fixes.

ID	名稱	產品	系列	已發布	已更新	嚴重性
57447	USN-1318-1 : linux-fsl-imx51 vulnerabilities	Nessus	Ubuntu Local Security Checks	2012/1/6	2016/12/1	low
57661	Ubuntu 10.04 LTS : linux-lts-backport-natty vulnerabilities (USN-1337-1)	Nessus	Ubuntu Local Security Checks	2012/1/24	2019/9/19	low
57688	Ubuntu 11.04 : linux vulnerabilities (USN-1345-1)	Nessus	Ubuntu Local Security Checks	2012/1/25	2019/9/19	low
57660	Ubuntu 11.10 : linux vulnerability (USN-1336-1)	Nessus	Ubuntu Local Security Checks	2012/1/24	2019/9/19	high
79507	OracleVM 2.2 : kernel (OVMSA-2013-0039)	Nessus	OracleVM Local Security Checks	2014/11/26	2021/1/4	high
68394	Oracle Linux 5 : kernel (ELSA-2011-1479)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2026/2/9	medium
56974	RHEL 5 : kernel (RHSA-2011:1479)	Nessus	Red Hat Local Security Checks	2011/11/30	2025/3/20	medium
57448	USN-1319-1 : linux-ti-omap4 vulnerabilities	Nessus	Ubuntu Local Security Checks	2012/1/6	2016/12/1	medium
57496	Ubuntu 10.04 LTS : linux-ec2 vulnerabilities (USN-1324-1)	Nessus	Ubuntu Local Security Checks	2012/1/12	2019/9/19	low
57665	Ubuntu 10.10 : linux vulnerabilities (USN-1341-1)	Nessus	Ubuntu Local Security Checks	2012/1/24	2019/9/19	high
57467	Ubuntu 11.10 : linux vulnerability (USN-1322-1)	Nessus	Ubuntu Local Security Checks	2012/1/10	2019/9/19	high
74767	openSUSE Security Update : kernel (openSUSE-2012-65)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	high

偵測

搜尋 Plugin

low

low

low

high

high

medium

medium

medium

low

high

high

high