English | Deutsch | Español | Português
 UserID:
 Passwd:
new user
 About:   Dedicated  | Advanced  | Standard  | Recurring  | No Risk  | Desktop  | Basic  | Single  | Security Seal  | FAQ
  Price/Feature Summary  | Order  | New Vulnerabilities  | Confidentiality  | Vulnerability Search
 Vulnerability   
Search   
    Search 75516 CVE descriptions
and 39786 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.63908
Category:Red Hat Local Security Checks
Title:RedHat Security Advisory RHSA-2009:0451
Summary:Redhat Security Advisory RHSA-2009:0451
Description:The remote host is missing updates announced in
advisory RHSA-2009:0451.

The kernel-rt packages contain the Linux kernel, the core of any Linux
operating system.

These updated packages fix the following security issues:

* a logic error was found in the do_setlk() function of the Linux kernel
Network File System (NFS) implementation. If a signal interrupted a lock
request, the local POSIX lock was incorrectly created. This could cause a
denial of service on the NFS server if a file descriptor was closed before
its corresponding lock request returned. (CVE-2008-4307, Important)

* a deficiency was found in the Linux kernel system call auditing
implementation on 64-bit systems. This could allow a local, unprivileged
user to circumvent a system call audit configuration, if that configuration
filtered based on the syscall number or arguments.
(CVE-2009-0834, Important)

* Chris Evans reported a deficiency in the Linux kernel secure-computing
implementation on 64-bit systems. This could allow a local, unprivileged
user to bypass intended access restrictions, if those access restriction
filters were based on the syscall number or arguments.
(CVE-2009-0835, Important)

* the exit_notify() function in the Linux kernel did not properly reset the
exit signal if a process executed a set user ID (setuid) application before
exiting. This could allow a local, unprivileged user to elevate their
privileges. (CVE-2009-1337, Important)

* Chris Evans reported a deficiency in the Linux kernel signals
implementation. The clone() system call permits the caller to indicate the
signal it wants to receive when its child exits. When clone() is called
with the CLONE_PARENT flag, it permits the caller to clone a new child that
shares the same parent as itself, enabling the indicated signal to be sent
to the caller's parent (instead of the caller), even if the caller's parent
has different real and effective user IDs. This could lead to a denial of
service of the parent. (CVE-2009-0028, Moderate)

* an off-by-two error was found in the set_selection() function of the
Linux kernel. This could allow a local, unprivileged user to cause a denial
of service when making a selection of characters in a UTF-8 console. Note:
physical console access is required to exploit this issue.
(CVE-2009-1046, Low)

These updated packages also fix the following bug:

* the __scsi_device_lookup_by_target() function was always returning the
first matching device, regardless of the state of the device. This meant
that any valid device listed after a deleted device would not be found. The
__scsi_device_lookup_by_target() function was modified so that deleted
devices are skipped, and valid devices are now found. (BZ#495976)

All Red Hat Enterprise MRG users should install this update, which resolves
these issues. For this update to take effect, the system must be rebooted.

Solution:
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date

http://rhn.redhat.com/errata/RHSA-2009-0451.html
http://www.redhat.com/security/updates/classification/#important
Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2008-4307
Bugtraq: 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components (Google Search)
http://www.securityfocus.com/archive/1/archive/1/507985/100/0/threaded
http://openwall.com/lists/oss-security/2009/01/13/1
Debian Security Information: DSA-1787 (Google Search)
http://www.debian.org/security/2009/dsa-1787
Debian Security Information: DSA-1794 (Google Search)
http://www.debian.org/security/2009/dsa-1794
http://www.redhat.com/support/errata/RHSA-2009-0451.html
RedHat Security Advisories: RHSA-2009:0459
http://rhn.redhat.com/errata/RHSA-2009-0459.html
RedHat Security Advisories: RHSA-2009:0473
http://rhn.redhat.com/errata/RHSA-2009-0473.html
http://www.ubuntu.com/usn/usn-751-1
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:7728
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9233
http://secunia.com/advisories/34917
http://secunia.com/advisories/34962
http://secunia.com/advisories/34981
http://secunia.com/advisories/35011
http://secunia.com/advisories/35015
http://secunia.com/advisories/37471
http://www.vupen.com/english/advisories/2009/3316
Common Vulnerability Exposure (CVE) ID: CVE-2009-0028
Bugtraq: 20090516 rPSA-2009-0084-1 kernel (Google Search)
http://www.securityfocus.com/archive/1/archive/1/503610/100/0/threaded
http://scary.beasts.org/security/CESA-2009-002.html
http://scarybeastsecurity.blogspot.com/2009/02/linux-kernel-minor-signal-vulnerability.html
Debian Security Information: DSA-1800 (Google Search)
http://www.debian.org/security/2009/dsa-1800
http://www.mandriva.com/security/advisories?name=MDVSA-2009:118
http://www.redhat.com/support/errata/RHSA-2009-0326.html
SuSE Security Announcement: SUSE-SA:2009:010 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00003.html
SuSE Security Announcement: SUSE-SA:2009:030 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00000.html
SuSE Security Announcement: SUSE-SA:2009:031 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00001.html
BugTraq ID: 33906
http://www.securityfocus.com/bid/33906
http://osvdb.org/52204
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11187
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:7947
http://secunia.com/advisories/33758
http://secunia.com/advisories/34680
http://secunia.com/advisories/35121
http://secunia.com/advisories/35120
http://secunia.com/advisories/35390
http://secunia.com/advisories/35394
http://secunia.com/advisories/34033
Common Vulnerability Exposure (CVE) ID: CVE-2009-0834
http://marc.info/?l=linux-kernel&m=123579056530191&w=2
http://marc.info/?l=linux-kernel&m=123579065130246&w=2
http://marc.info/?l=oss-security&m=123597642832637&w=2
http://scary.beasts.org/security/CESA-2009-001.html
SuSE Security Announcement: SUSE-SA:2009:028 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00002.html
BugTraq ID: 33951
http://www.securityfocus.com/bid/33951
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:8508
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9600
http://www.securitytracker.com/id?1022153
http://secunia.com/advisories/34084
http://secunia.com/advisories/35185
XForce ISS Database: linux-kernel-auditsyscallentry-sec-bypass(49061)
http://xforce.iss.net/xforce/xfdb/49061
Common Vulnerability Exposure (CVE) ID: CVE-2009-0835
http://marc.info/?l=linux-kernel&m=123579069630311&w=2
http://marc.info/?l=oss-security&m=123597627132485&w=2
http://lkml.org/lkml/2009/2/28/23
http://scary.beasts.org/security/CESA-2009-004.html
http://scarybeastsecurity.blogspot.com/2009/02/linux-kernel-minor-seccomp.html
https://bugzilla.redhat.com/show_bug.cgi?id=487255
SuSE Security Announcement: SUSE-SA:2009:021 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00007.html
BugTraq ID: 33948
http://www.securityfocus.com/bid/33948
http://secunia.com/advisories/34786
Common Vulnerability Exposure (CVE) ID: CVE-2009-1046
http://lists.openwall.net/linux-kernel/2009/01/30/333
http://lists.openwall.net/linux-kernel/2009/02/02/364
http://www.openwall.com/lists/oss-security/2009/02/12/10
http://www.openwall.com/lists/oss-security/2009/02/12/11
http://www.openwall.com/lists/oss-security/2009/02/12/9
BugTraq ID: 33672
http://www.securityfocus.com/bid/33672
Common Vulnerability Exposure (CVE) ID: CVE-2009-1337
Bugtraq: 20100625 VMSA-2010-0010 ESX 3.5 third party update for Service Console kernel (Google Search)
http://www.securityfocus.com/archive/1/archive/1/512019/100/0/threaded
http://marc.info/?l=linux-kernel&m=123560588713763&w=2
http://www.openwall.com/lists/oss-security/2009/04/07/1
http://www.openwall.com/lists/oss-security/2009/04/17/3
https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01126.html
http://www.mandriva.com/security/advisories?name=MDVSA-2009:119
http://www.mandriva.com/security/advisories?name=MDVSA-2009:135
http://www.redhat.com/support/errata/RHSA-2009-1024.html
http://www.redhat.com/support/errata/RHSA-2009-1077.html
RedHat Security Advisories: RHSA-2009:1550
https://rhn.redhat.com/errata/RHSA-2009-1550.html
SuSE Security Announcement: SUSE-SA:2009:032 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00002.html
http://www.ubuntu.com/usn/usn-793-1
BugTraq ID: 34405
http://www.securityfocus.com/bid/34405
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10919
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11206
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:8295
http://www.securitytracker.com/id?1022141
http://secunia.com/advisories/35226
http://secunia.com/advisories/35160
http://secunia.com/advisories/35387
http://secunia.com/advisories/35656
http://secunia.com/advisories/35324
CopyrightCopyright (c) 2009 E-Soft Inc. http://www.securityspace.com

This is only one of 39786 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.

New User Registration
Email:
UserID:
Passwd:
Please email me your monthly newsletters, informing the latest services, improvements & surveys.
Please email me a vulnerability test announcement whenever a new test is added.
   Privacy
Registered User Login
 
UserID:   
Passwd:  

 Forgot userid or passwd?
Email/Userid:




Home | About Us | Contact Us | Partner Programs | Privacy | Mailing Lists | Abuse
Security Audits | Managed DNS | Network Monitoring | Site Analyzer | Internet Research Reports
Web Probe | Whois

© 1998-2014 E-Soft Inc. All rights reserved.