Test ID:	1.3.6.1.4.1.25623.1.0.842977
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-3147-1)
Summary:	The remote host is missing an update for the 'linux' package(s) announced via the USN-3147-1 advisory.
Description:	Summary: The remote host is missing an update for the 'linux' package(s) announced via the USN-3147-1 advisory. Vulnerability Insight: Andreas Gruenbacher and Jan Kara discovered that the filesystem implementation in the Linux kernel did not clear the setgid bit during a setxattr call. A local attacker could use this to possibly elevate group privileges. (CVE-2016-7097) Marco Grassi discovered that the driver for Areca RAID Controllers in the Linux kernel did not properly validate control messages. A local attacker could use this to cause a denial of service (system crash) or possibly gain privileges. (CVE-2016-7425) Affected Software/OS: 'linux' package(s) on Ubuntu 16.10. Solution: Please install the updated package(s). CVSS Score: 7.2 CVSS Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-7097 1038201 http://www.securitytracker.com/id/1038201 92659 http://www.securityfocus.com/bid/92659 RHSA-2017:0817 http://rhn.redhat.com/errata/RHSA-2017-0817.html RHSA-2017:1842 https://access.redhat.com/errata/RHSA-2017:1842 RHSA-2017:2077 https://access.redhat.com/errata/RHSA-2017:2077 RHSA-2017:2669 https://access.redhat.com/errata/RHSA-2017:2669 USN-3146-1 http://www.ubuntu.com/usn/USN-3146-1 USN-3146-2 http://www.ubuntu.com/usn/USN-3146-2 USN-3147-1 http://www.ubuntu.com/usn/USN-3147-1 [linux-fsdevel] 20160526 [PATCH 2/2] posix_acl: Clear SGID bit when modifying file permissions http://www.spinics.net/lists/linux-fsdevel/msg98328.html [linux-fsdevel] 20160819 [PATCH v2] posix_acl: Clear SGID bit when setting file permissions http://marc.info/?l=linux-fsdevel&m=147162313630259&w=2 [oss-security] 20160826 Re: CVE request -- linux kernel: Setting a POSIX ACL via setxattr doesn't clear the setgid bit http://www.openwall.com/lists/oss-security/2016/08/26/3 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=073931017b49d9458aa351605b43a7e34598caef https://bugzilla.redhat.com/show_bug.cgi?id=1368938 https://github.com/torvalds/linux/commit/073931017b49d9458aa351605b43a7e34598caef https://source.android.com/security/bulletin/2017-04-01 https://support.f5.com/csp/article/K31603170?utm_source=f5support&amp%3Butm_medium=RSS Common Vulnerability Exposure (CVE) ID: CVE-2016-7425 BugTraq ID: 93037 http://www.securityfocus.com/bid/93037 http://marc.info/?l=linux-scsi&m=147394796228991&w=2 http://marc.info/?l=linux-scsi&m=147394713328707&w=2 http://www.openwall.com/lists/oss-security/2016/09/17/2 http://www.ubuntu.com/usn/USN-3144-1 http://www.ubuntu.com/usn/USN-3144-2 http://www.ubuntu.com/usn/USN-3145-1 http://www.ubuntu.com/usn/USN-3145-2
Copyright	Copyright (C) 2016 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.