Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.64068
Category:Red Hat Local Security Checks
Title:RedHat Security Advisory RHSA-2009:1081
Summary:NOSUMMARY
Description:Description:
The remote host is missing updates to kernel-rt announced in
advisory RHSA-2009:1081.

These updated packages fix the following security issues:

* a buffer overflow flaw was found in the CIFSTCon() function of the Linux
kernel Common Internet File System (CIFS) implementation. When mounting a
CIFS share, a malicious server could send an overly-long string to the
client, possibly leading to a denial of service or privilege escalation on
the client mounting the CIFS share. (CVE-2009-1439, Important)

* the Linux kernel Network File System daemon (nfsd) implementation did not
drop the CAP_MKNOD capability when handling requests from local,
unprivileged users. This flaw could possibly lead to an information leak or
privilege escalation. (CVE-2009-1072, Moderate)

* a deficiency was found in the Linux kernel signals implementation. The
kill_something_info() function did not check if a process was outside the
caller's namespace before sending the kill signal, making it possible to
kill processes in all process ID (PID) namespaces, breaking PID namespace
isolation. (CVE-2009-1338, Moderate)

* a flaw was found in the AGPGART driver. The agp_generic_alloc_page() and
agp_generic_alloc_pages() functions did not zero out the memory pages they
allocate, which may later be available to user-space processes. This flaw
could possibly lead to an information leak. (CVE-2009-1192, Low)

All Red Hat Enterprise MRG users should upgrade to these updated packages,
which contain backported patches to resolve these issues. Note: The system
must be rebooted for this update to take effect.

Solution:
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date

http://rhn.redhat.com/errata/RHSA-2009-1081.html
http://www.redhat.com/security/updates/classification/#important

CVSS Score:
7.8

CVSS Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:C

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2009-1072
BugTraq ID: 34205
http://www.securityfocus.com/bid/34205
Bugtraq: 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components (Google Search)
http://www.securityfocus.com/archive/1/507985/100/0/threaded
Debian Security Information: DSA-1800 (Google Search)
http://www.debian.org/security/2009/dsa-1800
http://thread.gmane.org/gmane.linux.kernel/805280
http://www.openwall.com/lists/oss-security/2009/03/23/1
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10314
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8382
http://www.redhat.com/support/errata/RHSA-2009-1081.html
http://secunia.com/advisories/34422
http://secunia.com/advisories/34432
http://secunia.com/advisories/34786
http://secunia.com/advisories/35121
http://secunia.com/advisories/35185
http://secunia.com/advisories/35343
http://secunia.com/advisories/35390
http://secunia.com/advisories/35394
http://secunia.com/advisories/35656
http://secunia.com/advisories/37471
SuSE Security Announcement: SUSE-SA:2009:021 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00007.html
SuSE Security Announcement: SUSE-SA:2009:028 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00002.html
SuSE Security Announcement: SUSE-SA:2009:030 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00000.html
SuSE Security Announcement: SUSE-SA:2009:031 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00001.html
http://www.ubuntu.com/usn/usn-793-1
http://www.vupen.com/english/advisories/2009/0802
http://www.vupen.com/english/advisories/2009/3316
XForce ISS Database: linux-kernel-capmknod-security-bypass(49356)
https://exchange.xforce.ibmcloud.com/vulnerabilities/49356
Common Vulnerability Exposure (CVE) ID: CVE-2009-1192
BugTraq ID: 34673
http://www.securityfocus.com/bid/34673
Bugtraq: 20090516 rPSA-2009-0084-1 kernel (Google Search)
http://www.securityfocus.com/archive/1/503610/100/0/threaded
Debian Security Information: DSA-1787 (Google Search)
http://www.debian.org/security/2009/dsa-1787
Debian Security Information: DSA-1794 (Google Search)
http://www.debian.org/security/2009/dsa-1794
http://www.mandriva.com/security/advisories?name=MDVSA-2009:119
http://www.mandriva.com/security/advisories?name=MDVSA-2009:135
http://openwall.com/lists/oss-security/2009/04/22/2
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10567
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8003
http://secunia.com/advisories/34981
http://secunia.com/advisories/35011
http://secunia.com/advisories/35120
http://secunia.com/advisories/35387
http://secunia.com/advisories/37351
SuSE Security Announcement: SUSE-SA:2009:032 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00002.html
SuSE Security Announcement: SUSE-SA:2009:054 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00005.html
SuSE Security Announcement: SUSE-SA:2009:056 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00007.html
Common Vulnerability Exposure (CVE) ID: CVE-2009-1338
http://lkml.org/lkml/2008/7/23/148
http://www.openwall.com/lists/oss-security/2009/04/16/2
http://www.openwall.com/lists/oss-security/2009/04/17/4
http://www.openwall.com/lists/oss-security/2009/04/21/1
XForce ISS Database: kernel-killsomethinginfo-security-bypass(50386)
https://exchange.xforce.ibmcloud.com/vulnerabilities/50386
Common Vulnerability Exposure (CVE) ID: CVE-2009-1439
BugTraq ID: 34453
http://www.securityfocus.com/bid/34453
https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01126.html
https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01271.html
http://blog.fefe.de/?ts=b72905a8
http://xorl.wordpress.com/2009/04/07/linux-kernel-tree-connect-cifs-remote-buffer-overflow/
http://lists.samba.org/archive/linux-cifs-client/2009-April/004322.html
http://www.openwall.com/lists/oss-security/2009/04/04/1
http://www.openwall.com/lists/oss-security/2009/04/07/3
http://www.openwall.com/lists/oss-security/2009/04/07/7
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10321
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8265
http://secunia.com/advisories/35217
http://secunia.com/advisories/35226
CopyrightCopyright (c) 2009 E-Soft Inc. http://www.securityspace.com

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.