Test ID:	1.3.6.1.4.1.25623.1.0.842964
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-3146-2)
Summary:	The remote host is missing an update for the 'linux-lts-xenial' package(s) announced via the USN-3146-2 advisory.
Description:	Summary: The remote host is missing an update for the 'linux-lts-xenial' package(s) announced via the USN-3146-2 advisory. Vulnerability Insight: USN-3146-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. It was discovered that the __get_user_asm_ex implementation in the Linux kernel for x86/x86_64 contained extended asm statements that were incompatible with the exception table. A local attacker could use this to gain administrative privileges. (CVE-2016-9644) Andreas Gruenbacher and Jan Kara discovered that the filesystem implementation in the Linux kernel did not clear the setgid bit during a setxattr call. A local attacker could use this to possibly elevate group privileges. (CVE-2016-7097) Marco Grassi discovered that the driver for Areca RAID Controllers in the Linux kernel did not properly validate control messages. A local attacker could use this to cause a denial of service (system crash) or possibly gain privileges. (CVE-2016-7425) Daxing Guo discovered a stack-based buffer overflow in the Broadcom IEEE802.11n FullMAC driver in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly gain privileges. (CVE-2016-8658) Affected Software/OS: 'linux-lts-xenial' package(s) on Ubuntu 14.04. Solution: Please install the updated package(s). CVSS Score: 9.3 CVSS Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-7097 1038201 http://www.securitytracker.com/id/1038201 92659 http://www.securityfocus.com/bid/92659 RHSA-2017:0817 http://rhn.redhat.com/errata/RHSA-2017-0817.html RHSA-2017:1842 https://access.redhat.com/errata/RHSA-2017:1842 RHSA-2017:2077 https://access.redhat.com/errata/RHSA-2017:2077 RHSA-2017:2669 https://access.redhat.com/errata/RHSA-2017:2669 USN-3146-1 http://www.ubuntu.com/usn/USN-3146-1 USN-3146-2 http://www.ubuntu.com/usn/USN-3146-2 USN-3147-1 http://www.ubuntu.com/usn/USN-3147-1 [linux-fsdevel] 20160526 [PATCH 2/2] posix_acl: Clear SGID bit when modifying file permissions http://www.spinics.net/lists/linux-fsdevel/msg98328.html [linux-fsdevel] 20160819 [PATCH v2] posix_acl: Clear SGID bit when setting file permissions http://marc.info/?l=linux-fsdevel&m=147162313630259&w=2 [oss-security] 20160826 Re: CVE request -- linux kernel: Setting a POSIX ACL via setxattr doesn't clear the setgid bit http://www.openwall.com/lists/oss-security/2016/08/26/3 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=073931017b49d9458aa351605b43a7e34598caef https://bugzilla.redhat.com/show_bug.cgi?id=1368938 https://github.com/torvalds/linux/commit/073931017b49d9458aa351605b43a7e34598caef https://source.android.com/security/bulletin/2017-04-01 https://support.f5.com/csp/article/K31603170?utm_source=f5support&amp%3Butm_medium=RSS Common Vulnerability Exposure (CVE) ID: CVE-2016-7425 BugTraq ID: 93037 http://www.securityfocus.com/bid/93037 http://marc.info/?l=linux-scsi&m=147394796228991&w=2 http://marc.info/?l=linux-scsi&m=147394713328707&w=2 http://www.openwall.com/lists/oss-security/2016/09/17/2 http://www.ubuntu.com/usn/USN-3144-1 http://www.ubuntu.com/usn/USN-3144-2 http://www.ubuntu.com/usn/USN-3145-1 http://www.ubuntu.com/usn/USN-3145-2 Common Vulnerability Exposure (CVE) ID: CVE-2016-8658 BugTraq ID: 93541 http://www.securityfocus.com/bid/93541 http://www.openwall.com/lists/oss-security/2016/10/13/1 Common Vulnerability Exposure (CVE) ID: CVE-2016-9644 BugTraq ID: 94545 http://www.securityfocus.com/bid/94545 http://www.openwall.com/lists/oss-security/2016/11/07/4
Copyright	Copyright (C) 2016 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.