Test ID:	1.3.6.1.4.1.25623.1.0.122395
Category:	Oracle Linux Local Security Checks
Title:	Oracle: Security Advisory (ELSA-2010-0088)
Summary:	The remote host is missing an update for the 'kvm' package(s) announced via the ELSA-2010-0088 advisory.
Description:	Summary: The remote host is missing an update for the 'kvm' package(s) announced via the ELSA-2010-0088 advisory. Vulnerability Insight: [kvm-83-105.0.1.el5_4.22] - Add kvm-add-oracle-workaround-for-libvirt-bug.patch [kvm-83-105.el5_4.22] - kvm-CVE-2010-0297-usb-linux.c-fix-buffer-overflow.patch [bz#560769] - Resolves: bz#560769 (CVE-2010-0297 kvm-userspace-rhel5: usb-linux.c: fix buffer overflow [rhel-5.4.z]) [kvm-83-105.el5_4.21] - kvm-kernel-KVM-introduce-kvm_read_guest_virt-kvm_write_guest_vi.patch [bz#559093] - kvm-kernel-KVM-remove-the-vmap-usage.patch [bz#559093] - kvm-kernel-KVM-Use-kvm_-read-write-_guest_virt-to-read-and-writ.patch [bz#559093] - kvm-kernel-KVM-fix-memory-access-during-x86-emulation.patch [bz#559093] - kvm-kernel-Check-IOPL-level-during-io-instruction-emulation.patch [bz#560697] - kvm-kernel-Fix-popf-emulation.patch [bz#560697] - kvm-kernel-Check-CPL-level-during-privilege-instruction-emulati.patch [bz#560697] - kvm-kernel-KVM-PIT-control-word-is-write-only.patch [bz#560888] - Resolves: bz#559093 (EMBARGOED CVE-2010-0298 kvm: emulator privilege escalation [rhel-5.4.z]) - Resolves: bz#560697 (EMBARGOED CVE-2010-0306 kvm: emulator privilege escalation IOPL/CPL level check [rhel-5.4.z]) - Resolves: bz#560888 (CVE-2010-0309 kvm: cat /dev/port in guest cause the host hang [rhel-5.4.z]) [kvm-83-105.el5_4.20] - Updated kversion to 2.6.18-164.11.1.el5 to match build root - kvm-qemu-add-routines-for-atomic-16-bit-accesses.patch [bz#561022] - kvm-qemu-virtio-atomic-access-for-index-values.patch [bz#561022] - Resolves: bz#561022 (QEMU terminates without warning with virtio-net and SMP enabled) [kvm-83-105.el5_4.19] - Updated kversion to 2.6.18-164.10.1.el5 to match build root - kvm-Fix-VDI-audio-stop.patch [bz#552519] - Resolves: bz#552519 (KVM : QEMU-Audio attempting to stop unactivated audio device (snd_playback_stop: ASSERT playback_channel->base.active failed).) [kvm-83-105.el5_4.18] - kvm-Fix-a-race-in-the-device-that-cuased-guest-stack-on-.patch [bz#553249] - Resolves: bz#553249 (hypercall device - Vm becomes non responsive on Sysmark benchmark (when more than 7 vm's running simultaneously)) [kvm-83-105.el5_4.17] - kvm-kernel-KVM-x86-make-double-triple-fault-promotion-generic-t.patch [bz#552518] - kvm-kernel-KVM-x86-raise-TSS-exception-for-NULL-CS-and-SS-segme.patch [bz#552518] - Resolves: bz#552518 (Rhev-Block driver causes 'unhandled vm exit' with 32bit win2k3r2sp2 Guest VM on restart) - kvm-RHEL-5.X-5.4.Z-Makefile-fix-ksm-dir-has-no-ARCH-pref.patch [bz#552530] - Resolves: bz#552530 (Build tree for RHEL 5.X and RHEL 5.4.z contains build bugs) [kvm-83-105.el5_4.16] - kvm-savevm-add-version_id-to-all-savevm-functions.patch [bz#552529] - kvm-We-need-current-machine-defined-sooner.patch [bz#552529] - kvm-Add-support-for-DeviceVersion-to-machine-type.patch [bz#552529] - kvm-Add-machine-name-alias-support.patch [bz#552529] - kvm-Introduce-rhel5.4.0-machine-type.patch [bz#552529] - kvm-Introduce-rhel-5.4.4-machine-type.patch [bz#552529] - ... [Please see the references for more information on the vulnerabilities] Affected Software/OS: 'kvm' package(s) on Oracle Linux 5. Solution: Please install the updated package(s). CVSS Score: 7.2 CVSS Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2010-0297 38158 http://www.securityfocus.com/bid/38158 RHSA-2010:0088 https://rhn.redhat.com/errata/RHSA-2010-0088.html [kvm] 20090702 KVM crashes when using certain USB device http://www.mail-archive.com/kvm%40vger.kernel.org/msg18447.html [kvm] 20090721 Re: KVM crashes when using certain USB device http://www.mail-archive.com/kvm%40vger.kernel.org/msg19581.html http://www.mail-archive.com/kvm%40vger.kernel.org/msg19596.html [oss-security] 20100202 KVM possible security issues fixed http://marc.info/?l=oss-security&m=126510479211473&w=2 [oss-security] 20100204 Re: KVM possible security issues fixed http://marc.info/?l=oss-security&m=126527304127254&w=2 http://git.savannah.gnu.org/cgit/qemu.git/commit/?id=babd03fde68093482528010a5435c14ce9128e3f http://wiki.qemu.org/ChangeLog https://bugzilla.redhat.com/show_bug.cgi?id=557025 kernel-usb-bo(56194) https://exchange.xforce.ibmcloud.com/vulnerabilities/56194 oval:org.mitre.oval:def:11786 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11786 Common Vulnerability Exposure (CVE) ID: CVE-2010-0298 38492 http://secunia.com/advisories/38492 DSA-1996 http://www.debian.org/security/2010/dsa-1996 RHSA-2010:0095 https://rhn.redhat.com/errata/RHSA-2010-0095.html https://bugzilla.redhat.com/show_bug.cgi?id=559091 oval:org.mitre.oval:def:11335 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11335 Common Vulnerability Exposure (CVE) ID: CVE-2010-0306 38499 http://secunia.com/advisories/38499 https://bugzilla.redhat.com/show_bug.cgi?id=560654 oval:org.mitre.oval:def:10953 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10953 Common Vulnerability Exposure (CVE) ID: CVE-2010-0309 38922 http://secunia.com/advisories/38922 ADV-2010-0638 http://www.vupen.com/english/advisories/2010/0638 USN-914-1 http://www.ubuntu.com/usn/USN-914-1 [kvm] 20100129 KVM: PIT: control word is write-only http://www.mail-archive.com/kvm%40vger.kernel.org/msg28002.html [oss-security] 20100202 CVE request - kvm: cat /dev/port in the guest can cause host DoS http://www.openwall.com/lists/oss-security/2010/02/02/1 [oss-security] 20100202 Re: CVE request - kvm: cat /dev/port in the guest can cause host DoS http://www.openwall.com/lists/oss-security/2010/02/02/4 https://bugzilla.redhat.com/show_bug.cgi?id=560887 oval:org.mitre.oval:def:11095 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11095
Copyright	Copyright (C) 2015 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.