The remote host is missing an update for the
# Copyright (C) 2017 Greenbone Networks GmbH
# Text descriptions are largely excerpted from the referenced
# advisory, and are Copyright (C) of their respective author(s)
#
# SPDX-License-Identifier: GPL-2.0-or-later
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
if(description)
{
script_oid("1.3.6.1.4.1.25623.1.0.851513");
script_version("2020-01-31T08:23:39+0000");
script_tag(name:"last_modification", value:"2020-01-31 08:23:39 +0000 (Fri, 31 Jan 2020)");
script_tag(name:"creation_date", value:"2017-02-22 15:18:43 +0100 (Wed, 22 Feb 2017)");
script_cve_id("CVE-2015-1350", "CVE-2015-8964", "CVE-2016-7042", "CVE-2016-7913",
"CVE-2016-7917", "CVE-2016-8632", "CVE-2016-8655", "CVE-2016-8666",
"CVE-2016-9083", "CVE-2016-9084", "CVE-2016-9555", "CVE-2016-9794",
"CVE-2016-7039");
script_tag(name:"cvss_base", value:"10.0");
script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:C/I:C/A:C");
script_tag(name:"qod_type", value:"package");
script_name("openSUSE: Security Advisory for kernel (openSUSE-SU-2016:3050-1)");
script_tag(name:"summary", value:"The remote host is missing an update for the 'kernel'
package(s) announced via the referenced advisory.");
script_tag(name:"vuldetect", value:"Checks if a vulnerable package version is present on the target host.");
script_tag(name:"insight", value:"The openSUSE Leap 42.2 kernel was updated to 4.4.36 to receive various
security and bugfixes.
The following security bugs were fixed:
- CVE-2015-1350: The VFS subsystem in the Linux kernel 3.x provides an
incomplete set of requirements for setattr operations that
underspecifies removing extended privilege attributes, which allowed
local users to cause a denial of service (capability stripping) via a
failed invocation of a system call, as demonstrated by using chown to
remove a capability from the ping or Wireshark dumpcap program
(bnc#914939).
- CVE-2015-8964: The tty_set_termios_ldisc function in
drivers/tty/tty_ldisc.c in the Linux kernel allowed local users to
obtain sensitive information from kernel memory by reading a tty data
structure (bnc#1010507).
- CVE-2016-7042: The proc_keys_show function in security/keys/proc.c in
the Linux kernel through 4.8.2, when the GNU Compiler Collection (gcc)
stack protector is enabled, uses an incorrect buffer size for certain
timeout data, which allowed local users to cause a denial of service
(stack memory corruption and panic) by reading the /proc/keys file
(bnc#1004517).
- CVE-2016-7913: The xc2028_set_config function in
drivers/media/tuners/tuner-xc2028.c in the Linux kernel allowed local
users to gain privileges or cause a denial of service (use-after-free)
via vectors involving omission of the firmware name from a certain data
structure (bnc#1010478).
- CVE-2016-7917: The nfnetlink_rcv_batch function in
net/netfilter/nfnetlink.c in the Linux kernel did not check whether a
batch message's length field is large enough, which allowed local users
to obtain sensitive information from kernel memory or cause a denial of
service (infinite loop or out-of-bounds read) by leveraging the
CAP_NET_ADMIN capability (bnc#1010444).
- CVE-2016-8632: The tipc_msg_build function in net/tipc/msg.c in the
Linux kernel did not validate the relationship between the minimum
fragment length and the maximum packet size, which allowed local users
to gain privileges or cause a denial of service (heap-based buffer
overflow) by leveraging the CAP_NET_ADMIN capability (bnc#1008831).
- CVE-2016-8655: A race condition in the af_packet packet_set_ring
function could be used by local attackers to crash the kernel or gain
privileges (bsc#1012754).
- CVE-2016-8666: The IP stack in the Linux kernel allowed remote attackers
to cause a denial of service (stack consumption and panic) or possibly
have unspecified other impact by triggering use of the GRO path for
packets with tunnel stacking, as dem ...
Description truncated, please see the referenced URL(s) for more information.");
script_tag(name:"affected", value:"Linux Kernel on openSUSE Leap 42.2");
script_tag(name:"solution", value:"Please install the updated package(s).");
script_xref(name:"openSUSE-SU", value:"2016:3050-1");
script_tag(name:"solution_type", value:"VendorFix");
script_category(ACT_GATHER_INFO);
script_copyright("Copyright (C) 2017 Greenbone Networks GmbH");
script_family("SuSE Local Security Checks");
script_dependencies("gather-package-list.nasl");
script_mandatory_keys("ssh/login/suse", "ssh/login/rpms", re:"ssh/login/release=openSUSELeap42\.2");
exit(0);
}
include("revisions-lib.inc");
include("pkg-lib-rpm.inc");
release = rpm_get_ssh_release();
if(!release)
exit(0);
res = "";
report = "";
if(release == "openSUSELeap42.2") {
if(!isnull(res = isrpmvuln(pkg:"kernel-devel", rpm:"kernel-devel~4.4.36~5.1", rls:"openSUSELeap42.2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"kernel-docs", rpm:"kernel-docs~4.4.36~5.3", rls:"openSUSELeap42.2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"kernel-docs-html", rpm:"kernel-docs-html~4.4.36~5.3", rls:"openSUSELeap42.2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"kernel-docs-pdf", rpm:"kernel-docs-pdf~4.4.36~5.3", rls:"openSUSELeap42.2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"kernel-macros", rpm:"kernel-macros~4.4.36~5.1", rls:"openSUSELeap42.2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"kernel-source", rpm:"kernel-source~4.4.36~5.1", rls:"openSUSELeap42.2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"kernel-source-vanilla", rpm:"kernel-source-vanilla~4.4.36~5.1", rls:"openSUSELeap42.2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"kernel-debug", rpm:"kernel-debug~4.4.36~5.1", rls:"openSUSELeap42.2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"kernel-debug-base", rpm:"kernel-debug-base~4.4.36~5.1", rls:"openSUSELeap42.2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"kernel-debug-base-debuginfo", rpm:"kernel-debug-base-debuginfo~4.4.36~5.1", rls:"openSUSELeap42.2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"kernel-debug-debuginfo", rpm:"kernel-debug-debuginfo~4.4.36~5.1", rls:"openSUSELeap42.2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"kernel-debug-debugsource", rpm:"kernel-debug-debugsource~4.4.36~5.1", rls:"openSUSELeap42.2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"kernel-debug-devel", rpm:"kernel-debug-devel~4.4.36~5.1", rls:"openSUSELeap42.2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"kernel-debug-devel-debuginfo", rpm:"kernel-debug-devel-debuginfo~4.4.36~5.1", rls:"openSUSELeap42.2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"kernel-default", rpm:"kernel-default~4.4.36~5.1", rls:"openSUSELeap42.2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"kernel-default-base", rpm:"kernel-default-base~4.4.36~5.1", rls:"openSUSELeap42.2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"kernel-default-base-debuginfo", rpm:"kernel-default-base-debuginfo~4.4.36~5.1", rls:"openSUSELeap42.2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"kernel-default-debuginfo", rpm:"kernel-default-debuginfo~4.4.36~5.1", rls:"openSUSELeap42.2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"kernel-default-debugsource", rpm:"kernel-default-debugsource~4.4.36~5.1", rls:"openSUSELeap42.2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"kernel-default-devel", rpm:"kernel-default-devel~4.4.36~5.1", rls:"openSUSELeap42.2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"kernel-obs-build", rpm:"kernel-obs-build~4.4.36~5.1", rls:"openSUSELeap42.2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"kernel-obs-build-debugsource", rpm:"kernel-obs-build-debugsource~4.4.36~5.1", rls:"openSUSELeap42.2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"kernel-obs-qa", rpm:"kernel-obs-qa~4.4.36~5.1", rls:"openSUSELeap42.2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"kernel-syms", rpm:"kernel-syms~4.4.36~5.1", rls:"openSUSELeap42.2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"kernel-vanilla", rpm:"kernel-vanilla~4.4.36~5.1", rls:"openSUSELeap42.2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"kernel-vanilla-base", rpm:"kernel-vanilla-base~4.4.36~5.1", rls:"openSUSELeap42.2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"kernel-vanilla-base-debuginfo", rpm:"kernel-vanilla-base-debuginfo~4.4.36~5.1", rls:"openSUSELeap42.2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"kernel-vanilla-debuginfo", rpm:"kernel-vanilla-debuginfo~4.4.36~5.1", rls:"openSUSELeap42.2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"kernel-vanilla-debugsource", rpm:"kernel-vanilla-debugsource~4.4.36~5.1", rls:"openSUSELeap42.2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"kernel-vanilla-devel", rpm:"kernel-vanilla-devel~4.4.36~5.1", rls:"openSUSELeap42.2"))) {
report += res;
}
if(report != "") {
security_message(data:report);
} else if(__pkg_match) {
exit(99);
}
exit(0);
}
exit(0);