10 - GLSA-200711-23

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Summary
Title	VMware Workstation and Player: Multiple vulnerabilities

Informations
Name	GLSA-200711-23	First vendor Publication	2007-11-18
Vendor	Gentoo	Last vendor Modification	2007-11-18
Severity (Vendor)	Normal	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score	10	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

VMware guest operating systems might be able to execute arbitrary code with elevated privileges on the host operating system through multiple flaws.

Background

VMware Workstation is a virtual machine for developers and system administrators. VMware Player is a freeware virtualization software that can run guests produced by other VMware products.

Description

Multiple vulnerabilities have been discovered in several VMware products. Neel Mehta and Ryan Smith (IBM ISS X-Force) discovered that the DHCP server contains an integer overflow vulnerability
(CVE-2007-0062), an integer underflow vulnerability (CVE-2007-0063) and another error when handling malformed packets (CVE-2007-0061), leading to stack-based buffer overflows or stack corruption. Rafal Wojtczvk
(McAfee) discovered two unspecified errors that allow authenticated users with administrative or login privileges on a guest operating system to corrupt memory or cause a Denial of Service (CVE-2007-4496, CVE-2007-4497). Another unspecified vulnerability related to untrusted virtual machine images was discovered (CVE-2007-5617).

VMware products also shipped code copies of software with several vulnerabilities: Samba (GLSA-200705-15), BIND (GLSA-200702-06), MIT Kerberos 5 (GLSA-200707-11), Vixie Cron (GLSA-200704-11), shadow
(GLSA-200606-02), OpenLDAP (CVE-2006-4600), PAM (CVE-2004-0813, CVE-2007-1716), GCC (CVE-2006-3619) and GDB (CVE-2006-4146).

Impact

Remote attackers within a guest system could possibly exploit these vulnerabilities to execute code on the host system with elevated privileges or to cause a Denial of Service.

Workaround

There is no known workaround at this time.

Resolution

All VMware Workstation users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose
">=app-emulation/vmware-workstation-5.5.5.56455"

All VMware Player users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose
">=app-emulation/vmware-player-1.0.5.56455"

References

[ 1 ] CVE-2004-0813 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0813
[ 2 ] CVE-2006-3619 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3619
[ 3 ] CVE-2006-4146 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4146
[ 4 ] CVE-2006-4600 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4600
[ 5 ] CVE-2007-0061 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0061
[ 6 ] CVE-2007-0062 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0062
[ 7 ] CVE-2007-0063 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0063
[ 8 ] CVE-2007-1716 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1716
[ 9 ] CVE-2007-4496 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4496
[ 10 ] CVE-2007-4497 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4497
[ 11 ] CVE-2007-5617 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5617
[ 12 ] GLSA-200606-02 : http://www.gentoo.org/security/en/glsa/glsa-200606-02.xml [ 13 ] GLSA-200702-06 : http://www.gentoo.org/security/en/glsa/glsa-200702-06.xml [ 14 ] GLSA-200704-11 : http://www.gentoo.org/security/en/glsa/glsa-200704-11.xml [ 15 ] GLSA-200705-15 : http://www.gentoo.org/security/en/glsa/glsa-200705-15.xml [ 16 ] GLSA-200707-11 : http://www.gentoo.org/security/en/glsa/glsa-200707-11.xml [ 17 ] VMSA-2007-0006

http://lists.vmware.com/pipermail/security-announce/2007/000001.html

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200711-23.xml

Original Source

Url : http://security.gentoo.org/glsa/glsa-200711-23.xml

CWE : Common Weakness Enumeration

%	Id	Name
43 %	CWE-119	Failure to Constrain Operations within the Bounds of a Memory Buffer
14 %	CWE-399	Resource Management Errors
14 %	CWE-264	Permissions, Privileges, and Access Controls
14 %	CWE-191	Integer Underflow (Wrap or Wraparound)
14 %	CWE-189	Numeric Errors (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10011

Oval ID:	oval:org.mitre.oval:def:10011
Title:	Unknown vulnerability in the SG_IO functionality in ide-cd allows local users to bypass read-only access and perform unauthorized write and erase operations.
Description:	Unknown vulnerability in the SG_IO functionality in ide-cd allows local users to bypass read-only access and perform unauthorized write and erase operations.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2004-0813	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3	Product(s):
Definition Synopsis:
RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section pam-devel is earlier than 0:0.75-72 AND pam is earlier than 0:0.75-72 AND mkisofs is earlier than 8:2.01.0.a32-0.EL3.6 AND cdrecord is earlier than 8:2.01.0.a32-0.EL3.6 AND cdrtools is earlier than 8:2.01.0.a32-0.EL3.6 AND cdrecord-devel is earlier than 8:2.01.0.a32-0.EL3.6

Definition Id: oval:org.mitre.oval:def:10463

Oval ID:	oval:org.mitre.oval:def:10463
Title:	Buffer overflow in the (1) DWARF (dwarfread.c) and (2) DWARF2 (dwarf2read.c) debugging code in GNU Debugger (GDB) 6.5 allows user-assisted attackers, or restricted users, to execute arbitrary code via a crafted file with a location block (DW_FORM_block) that contains a large number of operations.
Description:	Buffer overflow in the (1) DWARF (dwarfread.c) and (2) DWARF2 (dwarf2read.c) debugging code in GNU Debugger (GDB) 6.5 allows user-assisted attackers, or restricted users, to execute arbitrary code via a crafted file with a location block (DW_FORM_block) that contains a large number of operations.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2006-4146	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND gdb is earlier than 0:6.3.0.0-1.138.el3 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND gdb is earlier than 0:6.3.0.0-1.143.el4

Definition Id: oval:org.mitre.oval:def:11483

Oval ID:	oval:org.mitre.oval:def:11483
Title:	pam_console does not properly restore ownership for certain console devices when there are multiple users logged into the console and one user logs out, which might allow local users to gain privileges.
Description:	pam_console does not properly restore ownership for certain console devices when there are multiple users logged into the console and one user logs out, which might allow local users to gain privileges.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2007-1716	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section pam-devel is earlier than 0:0.75-72 AND pam is earlier than 0:0.75-72 AND mkisofs is earlier than 8:2.01.0.a32-0.EL3.6 AND cdrecord is earlier than 8:2.01.0.a32-0.EL3.6 AND cdrtools is earlier than 8:2.01.0.a32-0.EL3.6 AND cdrecord-devel is earlier than 8:2.01.0.a32-0.EL3.6 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section pam-devel is earlier than 0:0.77-66.23 AND pam is earlier than 0:0.77-66.23 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section pam-devel is earlier than 0:0.99.6.2-3.26.el5 AND pam is earlier than 0:0.99.6.2-3.26.el5

Definition Id: oval:org.mitre.oval:def:16767

Oval ID:	oval:org.mitre.oval:def:16767
Title:	USN-543-1 -- linux-restricted-modules-2.6.17/20, vmware-player-kernel-2.6.15 vulnerabilities
Description:	Neel Mehta and Ryan Smith discovered that the VMWare Player DHCP server did not correctly handle certain packet structures.
Family:	unix	Class:	patch
Reference(s):	USN-543-1 CVE-2007-0061 CVE-2007-0062 CVE-2007-0063 CVE-2007-4496 CVE-2007-4497	Version:	8
Platform(s):	Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04	Product(s):	linux-restricted-modules-2.6.17 linux-restricted-modules-2.6.20 vmware-player-kernel-2.6.15
Definition Synopsis:
Release section Ubuntu 6.06 is installed AND vmware-player-kernel-modules-2.6.15-29 DPKG is earlier than 2.6.15.11-13 AND Release section Ubuntu 6.10 is installed AND vmware-player-kernel-modules-2.6.17-12 DPKG is earlier than 2.6.17.9-12.4 AND Release section Ubuntu 7.04 is installed Packages match section vmware-player-kernel-modules-2.6.20-16 DPKG is earlier than 2.6.20.6-16.30 AND vmware-server-kernel-modules-2.6.20-16 DPKG is earlier than 2.6.20.6-16.30 AND vmware-tools-kernel-modules-2.6.20-16 DPKG is earlier than 2.6.20.6-16.30

Definition Id: oval:org.mitre.oval:def:9617

Oval ID:	oval:org.mitre.oval:def:9617
Title:	Directory traversal vulnerability in FastJar 0.93, as used in Gnu GCC 4.1.1 and earlier, and 3.4.6 and earlier, allows user-assisted attackers to overwrite arbitrary files via a .jar file containing filenames with "../" sequences.
Description:	Directory traversal vulnerability in FastJar 0.93, as used in Gnu GCC 4.1.1 and earlier, and 3.4.6 and earlier, allows user-assisted attackers to overwrite arbitrary files via a .jar file containing filenames with "../" sequences.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2006-3619	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section gcc-ppc32 is earlier than 0:3.2.3-59 AND gcc-java is earlier than 0:3.2.3-59 AND gcc-g77 is earlier than 0:3.2.3-59 AND libgcj is earlier than 0:3.2.3-59 AND gcc-c++ is earlier than 0:3.2.3-59 AND libobjc is earlier than 0:3.2.3-59 AND libstdc++ is earlier than 0:3.2.3-59 AND libf2c is earlier than 0:3.2.3-59 AND gcc-c++-ppc32 is earlier than 0:3.2.3-59 AND gcc-objc is earlier than 0:3.2.3-59 AND libgnat is earlier than 0:3.2.3-59 AND libstdc++-devel is earlier than 0:3.2.3-59 AND gcc-gnat is earlier than 0:3.2.3-59 AND cpp is earlier than 0:3.2.3-59 AND libgcj-devel is earlier than 0:3.2.3-59 AND gcc is earlier than 0:3.2.3-59 AND libgcc is earlier than 0:3.2.3-59 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section gcc-ppc32 is earlier than 0:3.4.6-8 AND gcc-java is earlier than 0:3.4.6-8 AND gcc-g77 is earlier than 0:3.4.6-8 AND libgcj is earlier than 0:3.4.6-8 AND gcc-c++ is earlier than 0:3.4.6-8 AND libobjc is earlier than 0:3.4.6-8 AND libstdc++ is earlier than 0:3.4.6-8 AND libf2c is earlier than 0:3.4.6-8 AND gcc-c++-ppc32 is earlier than 0:3.4.6-8 AND gcc-objc is earlier than 0:3.4.6-8 AND libgnat is earlier than 0:3.4.6-8 AND libstdc++-devel is earlier than 0:3.4.6-8 AND gcc-gnat is earlier than 0:3.4.6-8 AND cpp is earlier than 0:3.4.6-8 AND libgcj-devel is earlier than 0:3.4.6-8 AND gcc is earlier than 0:3.4.6-8 AND libgcc is earlier than 0:3.4.6-8

Definition Id: oval:org.mitre.oval:def:9618

Oval ID:	oval:org.mitre.oval:def:9618
Title:	slapd in OpenLDAP before 2.3.25 allows remote authenticated users with selfwrite Access Control List (ACL) privileges to modify arbitrary Distinguished Names (DN).
Description:	slapd in OpenLDAP before 2.3.25 allows remote authenticated users with selfwrite Access Control List (ACL) privileges to modify arbitrary Distinguished Names (DN).
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2006-4600	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section openldap-devel is earlier than 0:2.0.27-23 AND openldap-clients is earlier than 0:2.0.27-23 AND openldap is earlier than 0:2.0.27-23 AND openldap-servers is earlier than 0:2.0.27-23 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section compat-openldap is earlier than 0:2.1.30-7.4E AND openldap-devel is earlier than 0:2.2.13-7.4E AND openldap-clients is earlier than 0:2.2.13-7.4E AND openldap is earlier than 0:2.2.13-7.4E AND openldap-servers-sql is earlier than 0:2.2.13-7.4E AND openldap-servers is earlier than 0:2.2.13-7.4E

CPE : Common Platform Enumeration

Type	Description	Count
Application	Fastjar cpe:2.3:a:fastjar:fastjar:0.93:::::::*	1
Application	Gnu Gdb cpe:2.3:a:gnu:gdb:6.5:::::::*	1
Application	Ide-Cd cpe:2.3:a:ide-cd:ide-cd::::::::	1
Application	Openldap cpe:2.3:a:openldap:openldap:2.0.24:::::::* cpe:2.3:a:openldap:openldap:2.0.23:::::::* cpe:2.3:a:openldap:openldap:2.0.22:::::::* cpe:2.3:a:openldap:openldap:2.0.21:::::::* cpe:2.3:a:openldap:openldap:2.0.20:::::::*	5
Application	Vmware Ace cpe:2.3:a:vmware:ace:2.0.1_build_55017:::::::* cpe:2.3:a:vmware:ace:2.0.1:::::::* cpe:2.3:a:vmware:ace:2.0:::::::* cpe:2.3:a:vmware:ace:1.0.7:::::::* cpe:2.3:a:vmware:ace:1.0.6:::::::* cpe:2.3:a:vmware:ace:1.0.5:::::::* cpe:2.3:a:vmware:ace:1.0.4:::::::* cpe:2.3:a:vmware:ace:1.0.3_build_54075:::::::* cpe:2.3:a:vmware:ace:1.0.3:::::::* cpe:2.3:a:vmware:ace:1.0.2:::::::* cpe:2.3:a:vmware:ace:1.0.1:::::::* cpe:2.3:a:vmware:ace:1.0.0:::::::* cpe:2.3:a:vmware:ace:1.0:::::::* cpe:2.3:a:vmware:ace::::::::	14
Application	Vmware Player cpe:2.3:a:vmware:player:2.0.1:::::::* cpe:2.3:a:vmware:player:2.0:::::::* cpe:2.3:a:vmware:player:1.0.8:::::::* cpe:2.3:a:vmware:player:1.0.7:::::::* cpe:2.3:a:vmware:player:1.0.6:::::::* cpe:2.3:a:vmware:player:1.0.5:::::::* cpe:2.3:a:vmware:player:1.0.4:::::::* cpe:2.3:a:vmware:player:1.0.3:::::::* cpe:2.3:a:vmware:player:1.0.2:::::::* cpe:2.3:a:vmware:player:1.0.1:::::::* cpe:2.3:a:vmware:player:1.0.0:::::::* cpe:2.3:a:vmware:player::::::::	12
Application	Vmware Server cpe:2.3:a:vmware:server:1.0.4_build_56528:::::::* cpe:2.3:a:vmware:server:1.0.4:::::::* cpe:2.3:a:vmware:server:1.0.3:::::::* cpe:2.3:a:vmware:server:1.0.2:::::::* cpe:2.3:a:vmware:server:1.0.1_build_29996:::::::* cpe:2.3:a:vmware:server:1.0.1:::::::* cpe:2.3:a:vmware:server:1.0:::::::* cpe:2.3:a:vmware:server:::::::: cpe:2.3:a:vmware:server:-:::::::*	9
Application	Vmware Vmware Workstation cpe:2.3:a:vmware:vmware_workstation:6.0.1:::::::*	1
Application	Vmware Workstation cpe:2.3:a:vmware:workstation:6.0.1_build_55017:::::::* cpe:2.3:a:vmware:workstation:6.0.1:::::::* cpe:2.3:a:vmware:workstation:6.0:::::::* cpe:2.3:a:vmware:workstation:5.5.8:::::::* cpe:2.3:a:vmware:workstation:5.5.7:::::::* cpe:2.3:a:vmware:workstation:5.5.6:::::::* cpe:2.3:a:vmware:workstation:5.5.5_build_56455:::::::* cpe:2.3:a:vmware:workstation:5.5.5:::::::* cpe:2.3:a:vmware:workstation:5.5.4_build_44386:::::::* cpe:2.3:a:vmware:workstation:5.5.4:::::::* cpe:2.3:a:vmware:workstation:5.5.3_build_42958:::::::* cpe:2.3:a:vmware:workstation:5.5.3_build_34685:::::::* cpe:2.3:a:vmware:workstation:5.5.3:::::::* cpe:2.3:a:vmware:workstation:5.5.3:42958:::::: cpe:2.3:a:vmware:workstation:5.5.2:::::::* cpe:2.3:a:vmware:workstation:5.5.1_build_19175:::::::* cpe:2.3:a:vmware:workstation:5.5.1:::::::* cpe:2.3:a:vmware:workstation:5.5.0_build_13124:::::::* cpe:2.3:a:vmware:workstation:5.5.0:::::::* cpe:2.3:a:vmware:workstation:5.5:::::::* cpe:2.3:a:vmware:workstation:5.0.0_build_13124:::::::* cpe:2.3:a:vmware:workstation:5.0.0:::::::* cpe:2.3:a:vmware:workstation:5:::::::* cpe:2.3:a:vmware:workstation:4.5.2_build_8848:::::::* cpe:2.3:a:vmware:workstation:4.5.2_build_8848:r4:::::: cpe:2.3:a:vmware:workstation:4.5.2:::::::* cpe:2.3:a:vmware:workstation:4.0.2:::::::* cpe:2.3:a:vmware:workstation:4.0.1_build_5289:::::::* cpe:2.3:a:vmware:workstation:4.0.1:::::::* cpe:2.3:a:vmware:workstation:4.0:::::::* cpe:2.3:a:vmware:workstation:3.4:::::::* cpe:2.3:a:vmware:workstation:3.2.1:patch1:::::: cpe:2.3:a:vmware:workstation:2.0.1:::::::* cpe:2.3:a:vmware:workstation:2.0:::::::* cpe:2.3:a:vmware:workstation:1.1.2:::::::* cpe:2.3:a:vmware:workstation:1.1.1:::::::* cpe:2.3:a:vmware:workstation:1.1:::::::* cpe:2.3:a:vmware:workstation:1.0.5:::::::* cpe:2.3:a:vmware:workstation:1.0.4:::::::* cpe:2.3:a:vmware:workstation:1.0.2:::::::* cpe:2.3:a:vmware:workstation:1.0.1:::::::* cpe:2.3:a:vmware:workstation:::::::: cpe:2.3:a:vmware:workstation:-:::::::*	43
Os	Canonical Ubuntu Linux cpe:2.3:o:canonical:ubuntu_linux:7.04:::::::* cpe:2.3:o:canonical:ubuntu_linux:6.10:::::::* cpe:2.3:o:canonical:ubuntu_linux:6.06::::lts:::	3
Os	Redhat Enterprise Linux cpe:2.3:o:redhat:enterprise_linux:4.4:::::::*	1
Os	Vmware Esx cpe:2.3:o:vmware:esx:3.0.1:::::::* cpe:2.3:o:vmware:esx:3.0.0:::::::* cpe:2.3:o:vmware:esx:2.5.4:::::::* cpe:2.3:o:vmware:esx:2.5.3:::::::* cpe:2.3:o:vmware:esx:2.1.3:::::::* cpe:2.3:o:vmware:esx:2.0.2:::::::*	6

OpenVAS Exploits

Date	Description
2010-06-25	Name : Mandriva Update for fastjar MDVSA-2010:122 (fastjar) File : nvt/gb_mandriva_MDVSA_2010_122.nasl
2009-12-10	Name : Mandriva Security Advisory MDVSA-2009:312 (dhcp) File : nvt/mdksa_2009_312.nasl
2009-10-13	Name : SLES10: Security update for DHCP File : nvt/sles10_dhcp0.nasl
2009-10-10	Name : SLES9: Security update for DHCP File : nvt/sles9p5043200.nasl
2009-07-29	Name : Mandrake Security Advisory MDVSA-2009:153 (dhcp) File : nvt/mdksa_2009_153.nasl
2009-07-29	Name : Ubuntu USN-805-1 (ruby1.9) File : nvt/ubuntu_805_1.nasl
2009-04-09	Name : Mandriva Update for gcc MDVSA-2008:066 (gcc) File : nvt/gb_mandriva_MDVSA_2008_066.nasl
2009-03-23	Name : Ubuntu Update for linux-restricted-modules-2.6.17/20, vmware-player-kernel-2... File : nvt/gb_ubuntu_USN_543_1.nasl
2009-03-02	Name : SuSE Security Summary SUSE-SR:2009:005 File : nvt/suse_sr_2009_005.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200711-23 (vmware-workstation vmware-player) File : nvt/glsa_200711_23.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200808-05 (dhcp) File : nvt/glsa_200808_05.nasl
2008-09-04	Name : FreeBSD Ports: openldap-server, openldap-sasl-server File : nvt/freebsd_openldap-server.nasl
2008-01-17	Name : Debian Security Advisory DSA 1170-1 (gcc-3.4) File : nvt/deb_1170_1.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
40096	VMware Multiple Products Guest Image Login Unspecified DoS
40095	VMware Multiple Products Unspecified Administrative Memory Corruption Guest I...
40094	VMware Multiple Products DHCP Server Packet Handling Multiple Remote Overflows
40093	VMware Multiple Products DHCP Server Remote Memory Corruption Arbitrary Code ...
40092	VMware Multiple Products Untrusted Virtual Image Unspecified Issue
37271	pam_console Console Device Permission Restoration Weakness
28464	OpenLDAP slapd selfwrite Arbitrary DN Modification
28318	GDB DWARF Debugging Code Crafted Location Block Overflow A remote overflow exists in GDB DWARF. The compiler fails to handle 'DWARF' or 'DWARF2' information resulting in a buffer overflow. With a specially crafted request, an attacker can execute arbitrary code resulting in a loss of integrity.
27380	Gnu GCC fastjar JAR Processing Traversal Arbitrary File Write
10352	Linux Kernel ide-cd SG_IO Arbitrary Operation Execution

Nessus® Vulnerability Scanner

Date	Description
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-0473.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2007-0469.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-0465.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-0430.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-0310.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2007-0229.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-0220.nasl - Type : ACT_GATHER_INFO
2013-06-29	Name : The remote CentOS host is missing a security update. File : centos_RHSA-2007-0229.nasl - Type : ACT_GATHER_INFO
2013-06-29	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-0310.nasl - Type : ACT_GATHER_INFO
2013-06-29	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-0737.nasl - Type : ACT_GATHER_INFO
2013-06-29	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-0220.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing a security update. File : sl_20070501_gdb_on_SL4.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20070501_gcc_on_SL4.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20070501_openldap_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20070611_gcc_on_SL3.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing a security update. File : sl_20070611_gdb_{on_SL3_x}.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20070611_openldap_on_SL3.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20070611_pam_on_SL3.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20071109_pam_on_SL5.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20071115_pam_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2010-06-23	Name : The remote Mandriva Linux host is missing a security update. File : mandriva_MDVSA-2010-122.nasl - Type : ACT_GATHER_INFO
2009-12-04	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-312.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12347.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_dhcp-5975.nasl - Type : ACT_GATHER_INFO
2009-07-27	Name : The remote VMware ESX host is missing one or more security-related patches. File : vmware_VMSA-2007-0006.nasl - Type : ACT_GATHER_INFO
2009-07-21	Name : The remote openSUSE host is missing a security update. File : suse_11_0_dhcp-090126.nasl - Type : ACT_GATHER_INFO
2009-07-20	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-153.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2008-066.nasl - Type : ACT_GATHER_INFO
2009-02-19	Name : The remote openSUSE host is missing a security update. File : suse_dhcp-5958.nasl - Type : ACT_GATHER_INFO
2008-08-07	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200808-05.nasl - Type : ACT_GATHER_INFO
2007-11-20	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200711-23.nasl - Type : ACT_GATHER_INFO
2007-11-16	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-543-1.nasl - Type : ACT_GATHER_INFO
2007-11-16	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0737.nasl - Type : ACT_GATHER_INFO
2007-11-10	Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-356-1.nasl - Type : ACT_GATHER_INFO
2007-11-08	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0555.nasl - Type : ACT_GATHER_INFO
2007-10-25	Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2007-0970.nasl - Type : ACT_GATHER_INFO
2007-10-04	Name : The remote Windows host has an application that is affected by multiple issues. File : vmware_ws_server_multiple.nasl - Type : ACT_GATHER_INFO
2007-06-14	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-0473.nasl - Type : ACT_GATHER_INFO
2007-06-14	Name : The remote CentOS host is missing a security update. File : centos_RHSA-2007-0469.nasl - Type : ACT_GATHER_INFO
2007-06-14	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-0465.nasl - Type : ACT_GATHER_INFO
2007-06-14	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-0430.nasl - Type : ACT_GATHER_INFO
2007-06-12	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0473.nasl - Type : ACT_GATHER_INFO
2007-06-12	Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2007-0469.nasl - Type : ACT_GATHER_INFO
2007-06-12	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0465.nasl - Type : ACT_GATHER_INFO
2007-06-12	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0430.nasl - Type : ACT_GATHER_INFO
2007-05-02	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0310.nasl - Type : ACT_GATHER_INFO
2007-05-02	Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2007-0229.nasl - Type : ACT_GATHER_INFO
2007-05-02	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0220.nasl - Type : ACT_GATHER_INFO
2007-02-18	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-171.nasl - Type : ACT_GATHER_INFO
2007-01-17	Name : The remote Fedora Core host is missing a security update. File : fedora_2006-975.nasl - Type : ACT_GATHER_INFO
2006-10-14	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1170.nasl - Type : ACT_GATHER_INFO
2006-10-10	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_ae7124ff547c11db8f1a000a48049292.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 11:35:20	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	8
Oval ID(s)	6
CPE ID(s)	97
osvdb(s)	10
Openvas Exploit(s)	13
Nessus® Exploit(s)	52

	Related
10	CVE-2007-5617
10	CVE-2007-0063
10	CVE-2007-0062
10	CVE-2007-0061
6.5	CVE-2007-4496
5.5	CVE-2007-4497
5.1	CVE-2006-4146
3.4	CVE-2007-1716
2.6	CVE-2006-3619
2.3	CVE-2006-4600
2.1	CVE-2004-0813
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 11 more Alert(s)