Linux kernel 2.6.x 'SG_IO IOCTL' SCSI请求本地特权提升漏洞

Bugtraq ID: 51176 CVE ID：CVE-2011-4127 Linux是一款开放源代码的操作系统。 Paolo Bonzini发现主机linux系统允许在分区或LVM卷上执行SGIO ioctl，并允许向底层块设备传递命令。这可进一步在虚拟化上下文利用，因为virtio磁盘通过SGIO ioctl支持有限的SCSI直通。如果分区上或LVM卷上的virtio磁盘设置为format=raw，类似sgdd的工具可用于读和写相同磁盘上的其他数据，即便这些数据属于宿主机或其他guest。 0 Linux kernel 2.6.x 厂商解决方案...

RHEL 6 : kernel (RHSA-2011:1849)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:1849 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security fix: Using the SGIO IOCTL to issue SCSI...

RHEL 5 : tomcat5 (RHSA-2011:1845)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:1845 advisory. - tomcat: file permission bypass flaw CVE-2010-3718 - tomcat: XSS vulnerability in HTML Manager interface CVE-2011-0013 - tomcat: Multiple...

JBoss Operations Network多个跨站脚本执行漏洞

BUGTRAQ ID: 51095 CVE ID: CVE-2011-3206 JBoss Operations Network是基于Java EE的开源网络管理软件。 JBoss Operations Network在JON管理接口的实现上存在多个跨站脚本执行漏洞，远程攻击者诱使用户浏览特制URL利用这些漏洞执行跨站脚本攻击，窃取Cookie身份验证凭证 0 RedHat JBoss Operations Network 2.4.1 厂商补丁： RedHat ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

RedHat Update for netpbm RHSA-2011:1811-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

RedHat Update for pidgin RHSA-2011:1820-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

RHEL 6 : dhcp (RHSA-2011:1819)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:1819 advisory. The Dynamic Host Configuration Protocol DHCP is a protocol that allows individual devices on an IP network to get their own network configuration...

icu, libicu security update

CentOS Errata and Security Advisory CESA-2011:1815 Updated icu packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base...

sos security, bug fix, and enhancement update

2.2-17.0.1.el6 - Direct traceroute to linux.oracle.com John Haxby orabug 11713272 - Allow '-' in ticket SR numbers John Haxby - Disable --upload option as it will not work with Oracle support - Check oraclelinux-release instead of redhat-release to get OS version John Haxby bug 11681869 - Remove ...

kernel: sctp dos

A certain Red Hat patch to the sctpsockmigrate function in net/sctp/socket.c in the Linux kernel before 2.6.21, as used in Red Hat Enterprise Linux RHEL 5, allows remote attackers to cause a denial of service NULL pointer dereference and OOPS via a crafted SCTP packet...

JBoss Enterprise SOA Platform调用程序身份验证绕过漏洞

BUGTRAQ ID: 50720 CVE ID: CVE-2011-4085 JBoss企业应用平台（JBoss Enterprise Application Platform，EAP）是J2EE应用的中间件平台。 JBoss Enterprise Application Platform在调用程序的实现上存在安全漏洞，攻击者可利用此漏洞绕过身份验证机制，非法访问受影响应用程序。 RedHat JBoss EAP 5.x 厂商补丁： RedHat ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.jboss.org/...

Fedora 14 : openswan-2.6.33-3.fc14 (2011-15127)

Fixes for CVE-2011-4073. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable...

Apache - Denial of Service

Apache - Denial of Service / This is a reverse engineered version of the exploit for CVE-2011-3192 made by ev1lut10n http://jayakonstruksi.com/backupintsec/rapache.tgz. Copyright 2011 Ramon de C Valle Compile with the following command: gcc -Wall -pthread -o rcvalle-rapache rcvalle-rapache.c /...

RedHat Update for perl RHSA-2011:1797-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

RHEL 4 / 5 : perl (RHSA-2011:1797)

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:1797 advisory. - perl-CGI, perl-CGI-Simple: CVE-2010-2761 - hardcoded MIME boundary value for multipart content, CVE-2010-4410 - CRLF injection allowin...

Linux系统kexec-tools mkdumprd工具信息泄露漏洞

BUGTRAQ ID: 50415 CVE ID: CVE-2011-3589 Linux是自由电脑操作系统内核。 Linux系统的mkdumprd工具在实现上存在本地信息泄露漏洞，本地攻击者可利用此漏洞获取敏感信息 Linux kernel 3.x Linux kernel 2.6.x RedHat Enterprise Linux Workstation 6 RedHat Enterprise Linux Server 6 RedHat Enterprise Linux HPC Node 6 RedHat Enterprise Linux Desktop 6 厂商补丁： Linux...

Linux系统kexec-tools "kdump/mkdumprd"信息泄露漏洞

BUGTRAQ ID: 50420 CVE ID: CVE-2011-3590 Linux是自由电脑操作系统。 Linux系统的kdump/mkdumprd工具在实现上存在本地信息泄露漏洞，本地攻击者可利用此漏洞获取敏感信息，例如根用户使用的ssh密钥。 Linux kernel 3.x Linux kernel 2.6.x RedHat Enterprise Linux Workstation 6 RedHat Enterprise Linux Server 6 RedHat Enterprise Linux HPC Node 6 RedHat Enterprise Linux...

RHEL 6 : squid (RHSA-2011:1791)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2011:1791 advisory. Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. An input validation flaw was found i...

RHEL 6 : sos (RHSA-2011:1536)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2011:1536 advisory. Sos is a set of tools that gather information about system hardware and configuration. The sosreport utility incorrectly included Certificate-based R...

RHEL 6 : libxml2 (RHSA-2011:1749)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:1749 advisory. The libxml2 library is a development toolbox providing the implementation of various XML standards. One of those standards is the XML Path...