ID de Prueba:	1.3.6.1.4.1.25623.1.0.120395
Categoría:	Amazon Linux Local Security Checks
Título:	Amazon Linux: Security Advisory (ALAS-2011-22)
Resumen:	The remote host is missing an update for the 'kernel' package(s) announced via the ALAS-2011-22 advisory.
Descripción:	Summary: The remote host is missing an update for the 'kernel' package(s) announced via the ALAS-2011-22 advisory. Vulnerability Insight: The epoll implementation in the Linux kernel 2.6.37.2 and earlier does not properly traverse a tree of epoll file descriptors, which allows local users to cause a denial of service (CPU consumption) via a crafted application that makes epoll_create and epoll_ctl system calls. Buffer overflow in the xfs_readlink function in fs/xfs/xfs_vnodeops.c in XFS in the Linux kernel 2.6, when CONFIG_XFS_DEBUG is disabled, allows local users to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via an XFS image containing a symbolic link with a long pathname. crypto/ghash-generic.c in the Linux kernel before 3.1 allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact by triggering a failed or missing ghash_setkey function call, followed by a (1) ghash_update function call or (2) ghash_final function call, as demonstrated by a write operation on an AF_ALG socket. Affected Software/OS: 'kernel' package(s) on Amazon Linux. Solution: Please install the updated package(s). CVSS Score: 6.9 CVSS Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2011-1083 43522 http://secunia.com/advisories/43522 48115 http://secunia.com/advisories/48115 48410 http://secunia.com/advisories/48410 48898 http://secunia.com/advisories/48898 48964 http://secunia.com/advisories/48964 71265 http://www.osvdb.org/71265 RHSA-2012:0862 http://rhn.redhat.com/errata/RHSA-2012-0862.html SUSE-SU-2012:0554 http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00021.html SUSE-SU-2012:0616 http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00013.html [linux-kernel] 20110225 [PATCH] optimize epoll loop detection http://article.gmane.org/gmane.linux.kernel/1105744 [linux-kernel] 20110226 Re: [PATCH] optimize epoll loop detection http://article.gmane.org/gmane.linux.kernel/1105888 [linux-kernel] 20110228 Re: [PATCH] optimize epoll loop detection http://article.gmane.org/gmane.linux.kernel/1106686 [oss-security] 20110301 CVE request: kernel: Multiple DoS issues in epoll http://openwall.com/lists/oss-security/2011/03/02/1 [oss-security] 20110302 Re: CVE request: kernel: Multiple DoS issues in epoll http://openwall.com/lists/oss-security/2011/03/02/2 https://bugzilla.redhat.com/show_bug.cgi?id=681578 Common Vulnerability Exposure (CVE) ID: CVE-2011-4077 HPSBGN02970 http://marc.info/?l=bugtraq&m=139447903326211&w=2 [oss-security] 20111026 CVE Request -- kernel: xfs: potential buffer overflow in xfs_readlink() http://www.openwall.com/lists/oss-security/2011/10/26/1 [oss-security] 20111026 Re: CVE Request -- kernel: xfs: potential buffer overflow in xfs_readlink() http://www.openwall.com/lists/oss-security/2011/10/26/3 [xfs] 20111018 [PATCH] Fix possible memory corruption in xfs_readlink http://oss.sgi.com/archives/xfs/2011-10/msg00345.html http://xorl.wordpress.com/2011/12/07/cve-2011-4077-linux-kernel-xfs-readlink-memory-corruption/ https://bugzilla.redhat.com/show_bug.cgi?id=749156 Common Vulnerability Exposure (CVE) ID: CVE-2011-4081 [oss-security] 20111027 Re: CVE request: kernel: crypto: ghash: null pointer deref if no key is set http://www.openwall.com/lists/oss-security/2011/10/27/2 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=7ed47b7d142ec99ad6880bbbec51e9f12b3af74c http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.1 https://bugzilla.redhat.com/show_bug.cgi?id=749475 https://github.com/torvalds/linux/commit/7ed47b7d142ec99ad6880bbbec51e9f12b3af74c
Copyright	Copyright (C) 2015 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.