The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2012-406:03 advisory.

    [Security Fix]
    - CONFIG_XFS_DEBUGxfs_readlinkXFS()(CVE-2011-4077)
    - ghash_updateghash_final(CVE-2011-4081)
    - JBD(Journaling Block Device)cleanup_journal_tailext3ext4(kernel OOPS)(CVE-2011-4132)
    - KVMkvm_vm_ioctl_assign_deviceuser requesting device assignmentPCI(CVE-2011-4347)
    - sendmsg__sys_sendmsg(CVE-2011-4594)
    - PPC(CVE-2011-4611)
    - KVMcreate_pit_time(NULL)(CVE-2011-4622)
    - XFSon-disk ACLs(Access Control Lists)(CVE-2012-0038)
    - 32bitKVMsyscall(CVE-2012-0045)
    - igmp_heard_queryIGMP(Internet GroupManagement Protocol)(CVE-2012-0207)     CVEJVN     http://jvndb.jvn.jp

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Nick Bowler discovered the kernel GHASH message digest algorithm incorrectly handled error conditions. A local attacker could exploit this to cause a kernel oops.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 11 SP1 kernel has been updated to 2.6.32.54, fixing numerous bugs and security issues.

The following security issues have been fixed :

  - A potential hypervisor escape by issuing SG_IO commands     to partitiondevices was fixed by restricting access to     these commands. (CVE-2011-4127)

  - KEYS: Fix a NULL pointer deref in the user-defined key     type, which allowed local attackers to Oops the kernel.
    (CVE-2011-4110)

  - Avoid potential NULL pointer deref in ghash, which     allowed local attackers to Oops the kernel.
    (CVE-2011-4081)

  - Fixed a memory corruption possibility in xfs readlink,     which could be used by local attackers to crash the     system or potentially execute code by mounting a     prepared xfs filesystem image. (CVE-2011-4077)

  - A overflow in the xfs acl handling was fixed that could     be used by local attackers to crash the system or     potentially execute code by mounting a prepared xfs     filesystem image. (CVE-2012-0038)

  - A flaw in the ext3/ext4 filesystem allowed a local     attacker to crash the kernel by getting a prepared     ext3/ext4 filesystem mounted. (CVE-2011-4132)

  - Access to the taskstats /proc file was restricted to     avoid local attackers gaining knowledge of IO of other     users (and so effecting side-channel attacks for e.g.
    guessing passwords by typing speed). (CVE-2011-2494)

  - When using X.25 communication a malicious sender could     corrupt data structures, causing crashes or potential     code execution. Please note that X.25 needs to be setup     to make this effective, which these days is usually not     the case. (CVE-2010-3873)

  - When using X.25 communication a malicious sender could     make the machine leak memory, causing crashes. Please     note that X.25 needs to be setup to make this effective,     which these days is usually not the case.
    (CVE-2010-4164)

  - A remote denial of service due to a NULL pointer     dereference by using IPv6 fragments was fixed.
    (CVE-2011-2699) The following non-security issues have     been fixed (excerpt from changelog) :

  - elousb: Fixed bug in USB core API usage, code cleanup.

  - cifs: overhaul cifs_revalidate and rename to     cifs_revalidate_dentry.

  - cifs: set server_eof in cifs_fattr_to_inode.

  - xfs: Fix missing xfs_iunlock() on error recovery path in     xfs_readlink().

  - Silence some warnings about ioctls on partitions.

  - netxen: Remove all references to unified firmware file.

  - bonding: send out gratuitous arps even with no address     configured.

  - patches.fixes/ocfs2-serialize_unaligned_aio.patch:
    ocfs2: serialize unaligned aio.

  -     patches.fixes/bonding-check-if-clients-MAC-addr-has-chan     ged.patch: Update references.

  - xfs: Fix wait calculations on lock acquisition and use     milliseconds instead of jiffies to print the wait time.

  - ipmi: reduce polling when interrupts are available.

  - ipmi: reduce polling.

  - export shrink_dcache_for_umount_subtree.

  - patches.suse/stack-unwind: Fix more 2.6.29 merge     problems plus a glue code problem.

  - PM / Sleep: Fix race between CPU hotplug and freezer.

  - jbd: Issue cache flush after checkpointing.

  - lpfc: make sure job exists when processing BSG.

  - blktap: fix locking (again).

  - xen: Update Xen patches to 2.6.32.52.

  - reiserfs: Lock buffers unconditionally in     reiserfs_write_full_page().

  - writeback: Include all dirty inodes in background     writeback.

  - reiserfs: Fix quota mount option parsing.

  - bonding: check if clients MAC addr has changed.

  - rpc client can not deal with ENOSOCK, so translate it     into ENOCONN.

  - st: modify tape driver to allow writing immediate     filemarks.

  - xfs: fix for xfssyncd failure to wake.

  - ipmi: Fix deadlock in start_next_msg().

  - net: bind() fix error return on wrong address family.

  - net: ipv4: relax AF_INET check in bind().

  - net/ipv6: check for mistakenly passed in non-AF_INET6     sockaddrs.

  - Bluetooth: Fixed Atheros AR3012 Maryann PID/VID     supported.

  - percpu: fix chunk range calculation.

  - x86, UV: Fix kdump reboot.

  - dm: Use done_bytes for io_completion.

  - Bluetooth: Add Atheros AR3012 Maryann PID/VID supported.

  - Bluetooth: Add Atheros AR3012 one PID/VID supported.

  - fix missing hunk in oplock break patch.

  - patches.arch/s390-34-01-pfault-cpu-hotplug.patch:
    Refresh.

  - Surrounded s390x lowcore change with __GENKSYMS__

  - patches.xen/xen3-patch-2.6.30: Refresh.

  - sched, x86: Avoid unnecessary overflow in sched_clock.

  - ACPI thermal: Do not invalidate thermal zone if critical     trip point is bad.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-2003 advisory.

    - [fs] xfs: Fix possible memory corruption in xfs_readlink (Carlos Maiolino) {CVE-2011-4077}
    - crypto: ghash - Avoid null pointer dereference if no key is set (Nick Bowler) {CVE-2011-4081}
    - jbd/jbd2: validate sb->s_first in journal_get_superblock() (Eryu Guan) {CVE-2011-4132}
    - KVM: Device assignment permission checks (Joe Jin) {CVE-2011-4347}
    - KVM: x86: Prevent starting PIT timers in the absence of irqchip support (Jan Kiszka) {CVE-2011-4622}
    - xfs: validate acl count (Joe Jin) {CVE-2012-0038}
    - KVM: x86: fix missing checks in syscall emulation (Joe Jin) {CVE-2012-0045}
    - KVM: x86: extend 'struct x86_emulate_ops' with 'get_cpuid' (Joe Jin) {CVE-2012-0045}
    - igmp: Avoid zero delay when receiving odd mixture of IGMP queries (Ben Hutchings) {CVE-2012-0207}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The epoll implementation in the Linux kernel 2.6.37.2 and earlier does not properly traverse a tree of epoll file descriptors, which allows local users to cause a denial of service (CPU consumption) via a crafted application that makes epoll_create and epoll_ctl system calls.

Buffer overflow in the xfs_readlink function in fs/xfs/xfs_vnodeops.c in XFS in the Linux kernel 2.6, when CONFIG_XFS_DEBUG is disabled, allows local users to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via an XFS image containing a symbolic link with a long pathname.

crypto/ghash-generic.c in the Linux kernel before 3.1 allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact by triggering a failed or missing ghash_setkey function call, followed by a (1) ghash_update function call or (2) ghash_final function call, as demonstrated by a write operation on an AF_ALG socket.

Peter Huewe discovered an information leak in the handling of reading security-related TPM data. A local, unprivileged user could read the results of a previous TPM command. (CVE-2011-1162)

Vasiliy Kulikov discovered that taskstats did not enforce access restrictions. A local attacker could exploit this to read certain information, leading to a loss of privacy. (CVE-2011-2494)

Qianfeng Zhang discovered that the bridge networking interface incorrectly handled certain network packets. A remote attacker could exploit this to crash the system, leading to a denial of service.
(CVE-2011-2942)

Yasuaki Ishimatsu discovered a flaw in the kernel's clock implementation. A local unprivileged attacker could exploit this causing a denial of service. (CVE-2011-3209)

Zheng Liu discovered a flaw in how the ext4 filesystem splits extents.
A local unprivileged attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-3638)

Scot Doyle discovered that the bridge networking interface incorrectly handled certain network packets. A remote attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-4087)

A bug was found in the way headroom check was performed in udp6_ufo_fragment() function. A remote attacker could use this flaw to crash the system. (CVE-2011-4326).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A bug was discovered in the XFS filesystem's handling of pathnames. A local attacker could exploit this to crash the system, leading to a denial of service, or gain root privileges. (CVE-2011-4077)

Nick Bowler discovered the kernel GHASH message digest algorithm incorrectly handled error conditions. A local attacker could exploit this to cause a kernel oops. (CVE-2011-4081)

A flaw was found in the Journaling Block Device (JBD). A local attacker able to mount ext3 or ext4 file systems could exploit this to crash the system, leading to a denial of service. (CVE-2011-4132)

A bug was found in the way headroom check was performed in udp6_ufo_fragment() function. A remote attacker could use this flaw to crash the system. (CVE-2011-4326)

Clement Lecigne discovered a bug in the HFS file system bounds checking. When a malformed HFS file system is mounted a local user could crash the system or gain root privileges. (CVE-2011-4330)

Peter Huewe discovered an information leak in the handling of reading security-related TPM data. A local, unprivileged user could read the results of a previous TPM command. (CVE-2011-1162)

A bug was discovered in the XFS filesystem's handling of pathnames. A local attacker could exploit this to crash the system, leading to a denial of service, or gain root privileges. (CVE-2011-4077)

Nick Bowler discovered the kernel GHASH message digest algorithm incorrectly handled error conditions. A local attacker could exploit this to cause a kernel oops. (CVE-2011-4081)

A flaw was found in the Journaling Block Device (JBD). A local attacker able to mount ext3 or ext4 file systems could exploit this to crash the system, leading to a denial of service. (CVE-2011-4132)

A bug was found in the way headroom check was performed in udp6_ufo_fragment() function. A remote attacker could use this flaw to crash the system. (CVE-2011-4326)

Clement Lecigne discovered a bug in the HFS file system bounds checking. When a malformed HFS file system is mounted a local user could crash the system or gain root privileges. (CVE-2011-4330).

A bug was discovered in the XFS filesystem's handling of pathnames. A local attacker could exploit this to crash the system, leading to a denial of service, or gain root privileges. (CVE-2011-4077)

Nick Bowler discovered the kernel GHASH message digest algorithm incorrectly handled error conditions. A local attacker could exploit this to cause a kernel oops. (CVE-2011-4081)

Scot Doyle discovered that the bridge networking interface incorrectly handled certain network packets. A remote attacker could exploit this to crash the system, leading to a denial of service.
(CVE-2011-4087)

A flaw was found in the Journaling Block Device (JBD). A local attacker able to mount ext3 or ext4 file systems could exploit this to crash the system, leading to a denial of service. (CVE-2011-4132)

A bug was found in the way headroom check was performed in udp6_ufo_fragment() function. A remote attacker could use this flaw to crash the system. (CVE-2011-4326)

Clement Lecigne discovered a bug in the HFS file system bounds checking. When a malformed HFS file system is mounted a local user could crash the system or gain root privileges. (CVE-2011-4330)

A bug was discovered in the XFS filesystem's handling of pathnames. A local attacker could exploit this to crash the system, leading to a denial of service, or gain root privileges. (CVE-2011-4077)

Nick Bowler discovered the kernel GHASH message digest algorithm incorrectly handled error conditions. A local attacker could exploit this to cause a kernel oops. (CVE-2011-4081)

A flaw was found in the Journaling Block Device (JBD). A local attacker able to mount ext3 or ext4 file systems could exploit this to crash the system, leading to a denial of service. (CVE-2011-4132)

Clement Lecigne discovered a bug in the HFS file system bounds checking. When a malformed HFS file system is mounted a local user could crash the system or gain root privileges. (CVE-2011-4330).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0010 advisory.

    The kernel-rt packages contain the Linux kernel, the core of any Linux     operating system.

    This update fixes the following security issues:

    * A malicious CIFS (Common Internet File System) server could send a     specially-crafted response to a directory read request that would result in     a denial of service or privilege escalation on a system that has a CIFS     share mounted. (CVE-2011-3191, Important)

    * The way fragmented IPv6 UDP datagrams over the bridge with UDP     Fragmentation Offload (UFO) functionality on were handled could allow a     remote attacker to cause a denial of service. (CVE-2011-4326, Important)

    * GRO (Generic Receive Offload) fields could be left in an inconsistent     state. An attacker on the local network could use this flaw to cause a     denial of service. GRO is enabled by default in all network drivers that     support it. (CVE-2011-2723, Moderate)

    * IPv4 and IPv6 protocol sequence number and fragment ID generation could     allow a man-in-the-middle attacker to inject packets and possibly hijack     connections. Protocol sequence numbers and fragment IDs are now more     random. (CVE-2011-3188, Moderate)

    * A flaw in the FUSE (Filesystem in Userspace) implementation could allow     a local user in the fuse group who has access to mount a FUSE file system     to cause a denial of service. (CVE-2011-3353, Moderate)

    * A flaw in the b43 driver. If a system had an active wireless interface     that uses the b43 driver, an attacker able to send a specially-crafted     frame to that interface could cause a denial of service. (CVE-2011-3359,     Moderate)

    * A flaw in the way CIFS shares with DFS referrals at their root were     handled could allow an attacker on the local network, who is able to deploy     a malicious CIFS server, to create a CIFS network share that, when mounted,     would cause the client system to crash. (CVE-2011-3363, Moderate)

    * A flaw in the m_stop() implementation could allow a local, unprivileged     user to trigger a denial of service. (CVE-2011-3637, Moderate)

    * Flaws in ghash_update() and ghash_final() could allow a local,     unprivileged user to cause a denial of service. (CVE-2011-4081, Moderate)

    * A flaw in the key management facility could allow a local, unprivileged     user to cause a denial of service via the keyctl utility. (CVE-2011-4110,     Moderate)

    * A flaw in the Journaling Block Device (JBD) could allow a local attacker     to crash the system by mounting a specially-crafted ext3 or ext4 disk.
    (CVE-2011-4132, Moderate)

    * A flaw in the way memory containing security-related data was handled in     tpm_read() could allow a local, unprivileged user to read the results of a     previously run TPM command. (CVE-2011-1162, Low)

    * I/O statistics from the taskstats subsystem could be read without any     restrictions, which could allow a local, unprivileged user to gather     confidential information, such as the length of a password used in a     process. (CVE-2011-2494, Low)

    * Flaws in tpacket_rcv() and packet_recvmsg() could allow a local,     unprivileged user to leak information to user-space. (CVE-2011-2898, Low)

    Red Hat would like to thank Darren Lavender for reporting CVE-2011-3191;
    Brent Meshier for reporting CVE-2011-2723; Dan Kaminsky for reporting     CVE-2011-3188; Yogesh Sharma for reporting CVE-2011-3363; Nick Bowler for     reporting CVE-2011-4081; Peter Huewe for reporting CVE-2011-1162; and     Vasiliy Kulikov of Openwall for reporting CVE-2011-2494.

    This update also fixes the following bugs:

    * Previously, a mismatch in the build-id of the kernel-rt and the one in     the related debuginfo package caused failures in SystemTap and perf.
    (BZ#768413)

    * IBM x3650m3 systems were not able to boot the MRG Realtime kernel because     they require a pmcraid driver that was not available. The pmcraid driver is     included in this update. (BZ#753992)

    Users should upgrade to these updated packages, which correct these issues.
    The system must be rebooted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
284302	MiracleLinux 4 : kernel-2.6.32-220.7.1.el6 (AXSA:2012-406:03)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/19	high
57467	Ubuntu 11.10 : linux vulnerability (USN-1322-1)	Nessus	Ubuntu Local Security Checks	2012/1/10	2019/9/19	high
57853	SuSE 11.1 Security Update : Linux Kernel (SAT Patch Numbers 5723 / 5725)	Nessus	SuSE Local Security Checks	2012/2/7	2021/1/19	high
68669	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2012-2003)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2026/2/9	high
69581	Amazon Linux AMI : kernel (ALAS-2011-22)	Nessus	Amazon Linux Local Security Checks	2013/9/4	2020/7/30	medium
57058	Ubuntu 10.04 LTS : linux-lts-backport-oneiric vulnerabilities (USN-1294-1)	Nessus	Ubuntu Local Security Checks	2011/12/9	2019/9/19	high
57303	USN-1302-1 : linux-ti-omap4 vulnerabilities	Nessus	Ubuntu Local Security Checks	2011/12/14	2016/12/1	high
57304	Ubuntu 10.10 : linux-mvl-dove vulnerabilities (USN-1303-1)	Nessus	Ubuntu Local Security Checks	2011/12/14	2019/1/2	high
57305	USN-1304-1 : linux-ti-omap4 vulnerabilities	Nessus	Ubuntu Local Security Checks	2011/12/14	2016/12/1	high
57343	Ubuntu 11.04 : linux vulnerabilities (USN-1312-1)	Nessus	Ubuntu Local Security Checks	2011/12/20	2019/9/19	high
57344	Ubuntu 10.04 LTS : linux-lts-backport-oneiric vulnerability (USN-1313-1)	Nessus	Ubuntu Local Security Checks	2011/12/20	2019/9/19	medium
76635	RHEL 6 : kernel-rt (RHSA-2012:0010)	Nessus	Red Hat Local Security Checks	2014/7/22	2025/3/24	critical

検出

プラグインの検索

high

high

high

high

medium

high

high

high

high

high

medium

critical