The remote OracleVM system is missing necessary patches to address critical security updates :

CVE-2009-1192 The (1) agp_generic_alloc_page and (2) agp_generic_alloc_pages functions in drivers/char/agp/generic.c in the agp subsystem in the Linux kernel before 2.6.30-rc3 do not zero out pages that may later be available to a user-space process, which allows local users to obtain sensitive information by reading these pages.

CVE-2009-1072 nfsd in the Linux kernel before 2.6.28.9 does not drop the CAP_MKNOD capability before handling a user request in a thread, which allows local users to create device nodes, as demonstrated on a filesystem that has been exported with the root_squash option.

CVE-2009-1758 The hypervisor_callback function in Xen, possibly before 3.4.0, as applied to the Linux kernel 2.6.30-rc4, 2.6.18, and probably other versions allows guest user applications to cause a denial of service (kernel oops) of the guest OS by triggering a segmentation fault in 'certain address ranges.'

CVE-2009-1439 Buffer overflow in fs/cifs/connect.c in CIFS in the Linux kernel 2.6.29 and earlier allows remote attackers to cause a denial of service (crash) via a long nativeFileSystem field in a Tree Connect response to an SMB mount request.

CVE-2009-1633 Multiple buffer overflows in the cifs subsystem in the Linux kernel before 2.6.29.4 allow remote CIFS servers to cause a denial of service (memory corruption) and possibly have unspecified other impact via (1) a malformed Unicode string, related to Unicode string area alignment in fs/cifs/sess.c  or (2) long Unicode characters, related to fs/cifs/cifssmb.c and the cifs_readdir function in fs/cifs/readdir.c.

CVE-2009-1630 The nfs_permission function in fs/nfs/dir.c in the NFS client implementation in the Linux kernel 2.6.29.3 and earlier, when atomic_open is available, does not check execute (aka EXEC or MAY_EXEC) permission bits, which allows local users to bypass permissions and execute files, as demonstrated by files on an NFSv4 fileserver.

  - [agp] zero pages before sending to userspace (Jiri Olsa)     [497025 497026] (CVE-2009-1192)

  - [misc] add some long-missing capabilities to CAP_FS_MASK     (Eric Paris) [499075 497271 499076 497272]     (CVE-2009-1072)

  - [x86] xen: fix local denial of service (Chris     Lalancette) [500950 500951] (CVE-2009-1758)

  - [fs] cifs: unicode alignment and buffer sizing problems     (Jeff Layton) [494279 494280] (CVE-2009-1439)

  - [fs] cifs: buffer overruns when converting strings (Jeff     Layton) [496576 496577] (CVE-2009-1633)

  - [fs] cifs: fix error handling in parse_DFS_referrals     (Jeff Layton) [496576 496577] (CVE-2009-1633)

  - [fs] cifs: fix pointer and checks in cifs_follow_symlink     (Jeff Layton) [496576 496577] (CVE-2009-1633)

  - [nfs] v4: client handling of MAY_EXEC in nfs_permission     (Peter Staubach) [500301 500302] (CVE-2009-1630)

  - backport cifs support from OEL5U3

Security fixes :

  - several flaws were found in the way the Linux kernel     CIFS implementation handles Unicode strings. CIFS     clients convert Unicode strings sent by a server to     their local character sets, and then write those strings     into memory. If a malicious server sent a long enough     string, it could write past the end of the target memory     region and corrupt other memory areas, possibly leading     to a denial of service or privilege escalation on the     client mounting the CIFS share. (CVE-2009-1439,     CVE-2009-1633, Important)

  - the Linux kernel Network File System daemon (nfsd)     implementation did not drop the CAP_MKNOD capability     when handling requests from local, unprivileged users.
    This flaw could possibly lead to an information leak or     privilege escalation. (CVE-2009-1072, Moderate)

  - Frank Filz reported the NFSv4 client was missing a file     permission check for the execute bit in some situations.
    This could allow local, unprivileged users to run     non-executable files on NFSv4 mounted file systems.
    (CVE-2009-1630, Moderate)

  - a missing check was found in the hypervisor_callback()     function in the Linux kernel provided by the kernel-xen     package. This could cause a denial of service of a     32-bit guest if an application running in that guest     accesses a certain memory location in the kernel.
    (CVE-2009-1758, Moderate)

  - a flaw was found in the AGPGART driver. The     agp_generic_alloc_page() and agp_generic_alloc_pages()     functions did not zero out the memory pages they     allocate, which may later be available to user-space     processes. This flaw could possibly lead to an     information leak. (CVE-2009-1192, Low)

Bug fixes :

  - a race in the NFS client between destroying cached     access rights and unmounting an NFS file system could     have caused a system crash. 'Busy inodes' messages may     have been logged. (BZ#498653)

  - nanosleep() could sleep several milliseconds less than     the specified time on Intel Itanium&reg;-based systems.
    (BZ#500349)

  - LEDs for disk drives in AHCI mode may have displayed a     fault state when there were no faults. (BZ#500120)

  - ptrace_do_wait() reported tasks were stopped each time     the process doing the trace called wait(), instead of     reporting it once. (BZ#486945)

  - epoll_wait() may have caused a system lockup and     problems for applications. (BZ#497322)

  - missing capabilities could possibly allow users with an     fsuid other than 0 to perform actions on some file     system types that would otherwise be prevented.
    (BZ#497271)

  - on NFS mounted file systems, heavy write loads may have     blocked nfs_getattr() for long periods, causing commands     that use stat(2), such as ls, to hang. (BZ#486926)

  - in rare circumstances, if an application performed     multiple O_DIRECT reads per virtual memory page and also     performed fork(2), the buffer storing the result of the     I/O may have ended up with invalid data. (BZ#486921)

  - when using GFS2, gfs2_quotad may have entered an     uninterpretable sleep state. (BZ#501742)

  - with this update, get_random_int() is more random and no     longer uses a common seed value, reducing the     possibility of predicting the values returned.
    (BZ#499783)

  - the '-fwrapv' flag was added to the gcc build options to     prevent gcc from optimizing away wrapping. (BZ#501751)

  - a kernel panic when enabling and disabling iSCSI paths.
    (BZ#502916)

  - using the Broadcom NetXtreme BCM5704 network device with     the tg3 driver caused high system load and very bad     performance. (BZ#502837)

  - '/proc/[pid]/maps' and '/proc/[pid]/smaps' can only be     read by processes able to use the ptrace() call on a     given process; however, certain information from     '/proc/[pid]/stat' and '/proc/[pid]/wchan' could be used     to reconstruct memory maps. (BZ#499546)

The system must be rebooted for this update to take effect.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in the following components :

  - Apache Geronimo
  - Apache Tomcat
  - Apache Xerces2
  - cURL/libcURL
  - ISC BIND
  - Libxml2
  - Linux kernel
  - Linux kernel 64-bit
  - Linux kernel Common Internet File System
  - Linux kernel eCryptfs
  - NTP
  - Python
  - Java Runtime Environment (JRE)
  - Java SE Development Kit (JDK)
  - Java SE Abstract Window Toolkit (AWT)
  - Java SE Plugin
  - Java SE Provider
  - Java SE Swing
  - Java SE Web Start

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-4307     Bryn M. Reeves reported a denial of service in the NFS     filesystem. Local users can trigger a kernel BUG() due     to a race condition in the do_setlk function.

  - CVE-2008-5079     Hugo Dias reported a DoS condition in the ATM subsystem     that can be triggered by a local user by calling the     svc_listen function twice on the same socket and reading     /proc/net/atm/*vc.

  - CVE-2008-5395     Helge Deller discovered a denial of service condition     that allows local users on PA-RISC systems to crash a     system by attempting to unwind a stack containing     userspace addresses.

  - CVE-2008-5700     Alan Cox discovered a lack of minimum timeouts on SG_IO     requests, which allows local users of systems using ATA     to cause a denial of service by forcing drives into PIO     mode.

  - CVE-2008-5701     Vlad Malov reported an issue on 64-bit MIPS systems     where a local user could cause a system crash by crafing     a malicious binary which makes o32 syscalls with a     number less than 4000.

  - CVE-2008-5702     Zvonimir Rakamaric reported an off-by-one error in the     ib700wdt watchdog driver which allows local users to     cause a buffer underflow by making a specially crafted     WDIOC_SETTIMEOUT ioctl call.

  - CVE-2009-0028     Chris Evans discovered a situation in which a child     process can send an arbitrary signal to its parent.

  - CVE-2009-0029     Christian Borntraeger discovered an issue effecting the     alpha, mips, powerpc, s390 and sparc64 architectures     that allows local users to cause a denial of service or     potentially gain elevated privileges.

  - CVE-2009-0031     Vegard Nossum discovered a memory leak in the keyctl     subsystem that allows local users to cause a denial of     service by consuming all of kernel memory.

  - CVE-2009-0065     Wei Yongjun discovered a memory overflow in the SCTP     implementation that can be triggered by remote users,     permitting remote code execution.

  - CVE-2009-0269     Duane Griffin provided a fix for an issue in the     eCryptfs subsystem which allows local users to cause a     denial of service (fault or memory corruption).

  - CVE-2009-0322     Pavel Roskin provided a fix for an issue in the dell_rbu     driver that allows a local user to cause a denial of     service (oops) by reading 0 bytes from a sysfs entry.

  - CVE-2009-0675     Roel Kluin discovered inverted logic in the skfddi     driver that permits local, unprivileged users to reset     the driver statistics.

  - CVE-2009-0676     Clement LECIGNE discovered a bug in the sock_getsockopt     function that may result in leaking sensitive kernel     memory.

  - CVE-2009-0745     Peter Kerwien discovered an issue in the ext4 filesystem     that allows local users to cause a denial of service     (kernel oops) during a resize operation.

  - CVE-2009-0834     Roland McGrath discovered an issue on amd64 kernels that     allows local users to circumvent system call audit     configurations which filter based on the syscall numbers     or argument details.

  - CVE-2009-0859     Jiri Olsa discovered that a local user can cause a     denial of service (system hang) using a SHM_INFO shmctl     call on kernels compiled with CONFIG_SHMEM disabled.
    This issue does not affect prebuilt Debian kernels.

  - CVE-2009-1046     Mikulas Patocka reported an issue in the console     subsystem that allows a local user to cause memory     corruption by selecting a small number of 3-byte UTF-8     characters.

  - CVE-2009-1192     Shaohua Li reported an issue in the AGP subsystem that     may allow local users to read sensitive kernel memory     due to a leak of uninitialized memory.

  - CVE-2009-1242     Benjamin Gilbert reported a local denial of service     vulnerability in the KVM VMX implementation that allows     local users to trigger an oops.

  - CVE-2009-1265     Thomas Pollet reported an overflow in the af_rose     implementation that allows remote attackers to retrieve     uninitialized kernel memory that may contain sensitive     data.

  - CVE-2009-1337     Oleg Nesterov discovered an issue in the exit_notify     function that allows local users to send an arbitrary     signal to a process by running a program that modifies     the exit_signal field and then uses an exec system call     to launch a setuid application.

  - CVE-2009-1338     Daniel Hokka Zakrisson discovered that a kill(-1) is     permitted to reach processes outside of the current     process namespace.

  - CVE-2009-1439     Pavan Naregundi reported an issue in the CIFS filesystem     code that allows remote users to overwrite memory via a     long nativeFileSystem field in a Tree Connect response     during mount.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
79460	OracleVM 2.1 : kernel (OVMSA-2009-0014)	Nessus	OracleVM Local Security Checks	2014/11/26	2021/1/14	high
60599	Scientific Linux Security Update : kernel on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
89117	VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2009-0016) (remote check)	Nessus	Misc.	2016/3/3	2021/1/6	critical
38668	Debian DSA-1787-1 : linux-2.6.24 - denial of service/privilege escalation/information leak	Nessus	Debian Local Security Checks	2009/5/4	2021/1/4	critical

検出

プラグインの検索

high

high

critical

critical