ID CVE-2011-1576
Summary The Generic Receive Offload (GRO) implementation in the Linux kernel 2.6.18 on Red Hat Enterprise Linux 5 and 2.6.32 on Red Hat Enterprise Linux 6, as used in Red Hat Enterprise Virtualization (RHEV) Hypervisor and other products, allows remote attackers to cause a denial of service via crafted VLAN packets that are processed by the napi_reuse_skb function, leading to (1) a memory leak or (2) memory corruption, a different vulnerability than CVE-2011-1478.
References
Vulnerable Configurations
  • Linux Kernel 2.6.18
    cpe:2.3:o:linux:linux_kernel:2.6.18
  • Red Hat Enterprise Linux 5
    cpe:2.3:o:redhat:enterprise_linux:5
  • cpe:2.3:a:redhat:enterprise_virtualization_hypervisor
    cpe:2.3:a:redhat:enterprise_virtualization_hypervisor
  • Red Hat Enterprise Linux 6.0
    cpe:2.3:o:redhat:enterprise_linux:6.0
CVSS
Base: 5.7 (as of 01-09-2011 - 08:43)
Impact:
Exploitability:
CWE CWE-119
CAPEC
  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.
  • Overflow Binary Resource File
    An attack of this type exploits a buffer overflow vulnerability in the handling of binary resources. Binary resources may include music files like MP3, image files like JPEG files, and any other binary file. These attacks may pass unnoticed to the client machine through normal usage of files, such as a browser loading a seemingly innocent JPEG file. This can allow the attacker access to the execution stack and execute arbitrary code in the target process. This attack pattern is a variant of standard buffer overflow attacks using an unexpected vector (binary files) to wrap its attack and open up a new attack vector. The attacker is required to either directly serve the binary content to the victim, or place it in a locale like a MP3 sharing application, for the victim to download. The attacker then is notified upon the download or otherwise locates the vulnerability opened up by the buffer overflow.
  • Buffer Overflow via Symbolic Links
    This type of attack leverages the use of symbolic links to cause buffer overflows. An attacker can try to create or manipulate a symbolic link file such that its contents result in out of bounds data. When the target software processes the symbolic link file, it could potentially overflow internal buffers with insufficient bounds checking.
  • Overflow Variables and Tags
    This type of attack leverages the use of tags or variables from a formatted configuration data to cause buffer overflow. The attacker crafts a malicious HTML page or configuration file that includes oversized strings, thus causing an overflow.
  • Buffer Overflow via Parameter Expansion
    In this attack, the target software is given input that the attacker knows will be modified and expanded in size during processing. This attack relies on the target software failing to anticipate that the expanded data may exceed some internal limit, thereby creating a buffer overflow.
  • Buffer Overflow in an API Call
    This attack targets libraries or shared code modules which are vulnerable to buffer overflow attacks. An attacker who has access to an API may try to embed malicious code in the API function call and exploit a buffer overflow vulnerability in the function's implementation. All clients that make use of the code library thus become vulnerable by association. This has a very broad effect on security across a system, usually affecting more than one software process.
  • Buffer Overflow in Local Command-Line Utilities
    This attack targets command-line utilities available in a number of shells. An attacker can leverage a vulnerability found in a command-line utility to escalate privilege to root.
Access
VectorComplexityAuthentication
ADJACENT_NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE COMPLETE
nessus via4
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2011-1106.NASL
    description Updated kernel packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.0 Extended Update Support. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issue : * A flaw allowed napi_reuse_skb() to be called on VLAN (virtual LAN) packets. An attacker on the local network could trigger this flaw by sending specially crafted packets to a target system, possibly causing a denial of service. (CVE-2011-1576, Moderate) Red Hat would like to thank Ryan Sweat for reporting this issue. This update also fixes the following bugs : * The LSI SAS2 controller firmware issued an 0x620f fault while performing I/O operations and with a Task Manager running, causing possible data corruption. This update corrects this issue. (BZ#710625) * The crashkernel memory region can overlap the RunTime Abstraction Services (RTAS) memory region. If the crashkernel memory region was freed, the RTAS memory region was freed as well and the system would crash. With this update, the crash_free_reserved_phys_range() function is overridden and overlaps with the RTAS memory region are checked so that system crashes no longer occur. (BZ#710626) * If the microcode module was loaded, saving and restoring a Xen guest returned a warning message and a backtrace error. With this update, backtrace errors are no longer returned, and saving and restoring a Xen guest works as expected. (BZ#710632) * When the Distributed Lock Manager (DLM) queued three callbacks for a lock in the following sequence: blocking - completion - blocking, it would consider the final blocking callback redundant and skip it. Because the callback was skipped, GFS would not release the lock, causing processes on other nodes to wait indefinitely for it. With this update, the DLM does not skip the necessary blocking callback. (BZ#710642) * The XFRM_SUB_POLICY feature causes all bundles to be at the finest granularity possible. As a result of the data structure used to implement this, the system performance would drop considerably. This update disables a part of XFRM_SUB_POLICY, eliminating the poor performance at the cost of sub-IP address selection granularity in the policy. (BZ#710645) * A kernel panic in the mpt2sas driver could occur on an IBM system using a drive with SMART (Self-Monitoring, Analysis and Reporting Technology) issues. This was because the driver was sending an SEP request while the kernel was in the interrupt context, causing the driver to enter the sleep state. With this update, a fake event is now executed from the interrupt context, assuring the SEP request is properly issued. (BZ#714189) Finally, this update provides the following enhancements : * This update introduces a kernel module option that allows the Flow Director to be disabled. (BZ#711549) * This update introduces parallel port printer support for Red Hat Enterprise Linux 6. (BZ#713825) * This update restricts access to the /proc/kcore file to ELF headers only. (BZ#710638) Users should upgrade to these updated packages, which contain backported patches to resolve these issues and add these enhancements. The system must be rebooted for this update to take effect.
    last seen 2019-02-21
    modified 2018-07-25
    plugin id 63994
    published 2013-01-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=63994
    title RHEL 6 : kernel (RHSA-2011:1106)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2011-2038.NASL
    description Description of changes: * CVE-2011-4127: KVM privilege escalation through insufficient validation in SG_IO ioctl. Using the SG_IO IOCTL to issue SCSI requests to partitions or LVM volumes resulted in the requests being passed to the underlying block device. If a privileged user only had access to a single partition or LVM volume, they could use this flaw to bypass those restrictions and gain read and write access (and be able to issue other SCSI commands) to the entire block device. In KVM (Kernel-based Virtual Machine) environments using raw format virtio disks backed by a partition or LVM volume, a privileged guest user could bypass intended restrictions and issue read and write requests (and other SCSI commands) on the host, and possibly access the data of other guests that reside on the same underlying block device. (CVE-2011-4127, Important) * CVE-2011-1493: Insufficient validation in X.25 Rose parsing. Dan Rosenberg discovered that the X.25 Rose network stack did not correctly handle certain fields. If a system was running with Rose enabled, a remote attacker could send specially crafted traffic to gain root privileges. * Additional fix for CVE-2011-1576: Denial of service with VLAN packets and GRO. Oracle's previous fix for CVE-2011-1576 did not completely address the issue. [2.6.32-300.4.1.el6uek] - [pci] intel-iommu: Default to non-coherent for domains unattached to iommus (Joe Jin) - [dm] do not forward ioctls from logical volumes to the underlying device (Joe Jin) {CVE-2011-4127} - [block] fail SCSI passthrough ioctls on partition devices (Joe Jin) {CVE-2011-4127} - [block] add and use scsi_blk_cmd_ioctl (Joe Jin) {CVE-2011-4127} - [net] gro: reset vlan_tci on reuse (Dan Carpenter) {CVE-2011-1576} - [net] rose: Add length checks to CALL_REQUEST parsing (Ben Hutchings) {CVE-2011-1493} - [net] rose_loopback_timer sets VC number <= ROSE_DEFAULT_MAXVC (Bernard Pidoux F6BVP) {CVE-2011-1493}
    last seen 2019-02-21
    modified 2015-12-01
    plugin id 68426
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=68426
    title Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2011-2038)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2011-1090.NASL
    description An updated rhev-hypervisor package that fixes one security issue and several bugs is now available. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The rhev-hypervisor package provides a Red Hat Enterprise Virtualization Hypervisor ISO disk image. The Red Hat Enterprise Virtualization Hypervisor is a dedicated Kernel-based Virtual Machine (KVM) hypervisor. It includes everything necessary to run and manage virtual machines: A subset of the Red Hat Enterprise Linux operating environment and the Red Hat Enterprise Virtualization Agent. Note: Red Hat Enterprise Virtualization Hypervisor is only available for the Intel 64 and AMD64 architectures with virtualization extensions. A flaw was found that allowed napi_reuse_skb() to be called on VLAN (virtual LAN) packets. An attacker on the local network could trigger this flaw by sending specially crafted packets to a target system, possibly causing a denial of service. (CVE-2011-1576) Red Hat would like to thank Ryan Sweat for reporting CVE-2011-1576. This updated package provides updated components that include fixes for security issues; however, these issues have no security impact for Red Hat Enterprise Virtualization Hypervisor. These fixes are for bash issue CVE-2008-5374; curl issue CVE-2011-2192; kernel issues CVE-2010-4649, CVE-2011-0695, CVE-2011-0711, CVE-2011-1044, CVE-2011-1182, CVE-2011-1573, CVE-2011-1593, CVE-2011-1745, CVE-2011-1746, CVE-2011-1776, CVE-2011-1780, CVE-2011-1936, CVE-2011-2022, CVE-2011-2213, CVE-2011-2492, CVE-2011-2525, and CVE-2011-2689; libvirt issue CVE-2011-2511; and rsync issue CVE-2007-6200. This update also fixes several bugs. Documentation for these bug fixes will be available shortly from the Technical Notes document linked to in the References section. As Red Hat Enterprise Virtualization Hypervisor is based on KVM, the bug fixes from the KVM update RHBA-2011:1068 have been included in this update : https://rhn.redhat.com/errata/RHBA-2011-1068.html Users of Red Hat Enterprise Virtualization Hypervisor are advised to upgrade to this updated package, which resolves this issue and fixes the bugs noted in the Technical Notes.
    last seen 2019-02-21
    modified 2018-12-20
    plugin id 79279
    published 2014-11-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79279
    title RHEL 5 : rhev-hypervisor (RHSA-2011:1090)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_KERNEL-111202.NASL
    description The SUSE Linux Enterprise 11 Service Pack 1 kernel has been updated to version 2.6.32.49 and fixes various bugs and security issues. - The TCP/IP initial sequence number generation effectively only used 24 bits of 32 to generate randomness, making a brute-force man-in-the-middle attack on TCP/IP connections feasible. The generator was changed to use full 32bit randomness. (CVE-2011-3188) - Fernando Gont discovered that the IPv6 stack used predictable fragment identification numbers. A remote attacker could exploit this to exhaust network resources, leading to a denial of service. (CVE-2011-2699) - A NULL ptr dereference on mounting corrupt hfs filesystems was fixed which could be used by local attackers to crash the kernel. (CVE-2011-2203) - Added a kernel option to ensure ecryptfs is mounting only on paths belonging to the current ui, which would have allowed local attackers to potentially gain privileges via symlink attacks. (CVE-2011-1833) - The Generic Receive Offload (GRO) implementation in the Linux kernel allowed remote attackers to cause a denial of service via crafted VLAN packets that are processed by the napi_reuse_skb function, leading to (1) a memory leak or (2) memory corruption, a different vulnerability than CVE-2011-1478. (CVE-2011-1576) - A name overflow in the hfs filesystem was fixed, where mounting a corrupted hfs filesystem could lead to a stack overflow and code execution in the kernel. This requires a local attacker to be able to mount hfs filesystems. (CVE-2011-4330) - A bug was found in the way headroom check was performed in udp6_ufo_fragment() function. A remote attacker could use this flaw to crash the system. (CVE-2011-4326) The following non-security bugs have been fixed : - ALSA: hda - Fix S3/S4 problem on machines with VREF-pin mute-LED. (bnc#732535) - patches.xen/xen-pcpu-hotplug: Fix a double kfree(). - ixgbe: fix bug with vlan strip in promsic mode (bnc#687049, fate#311821). - ixgbe: fix panic when shutting down system with WoL enabled. - fnic: Allow users to modify dev_loss_tmo setting. (bnc#719786) - x86, intel: Do not mark sched_clock() as stable. (bnc#725709) - ALSA: hda - Keep vref-LED during power-saving on IDT codecs. (bnc#731981) - cifs: Assume passwords are encoded according to iocharset. (bnc#731035) - scsi_dh: Check queuedata pointer before proceeding. (bnc#714744) - netback: use correct index for invalidation in netbk_tx_check_mop(). - ACPI video: introduce module parameter video.use_bios_initial_backlight. (bnc#731229) - SUNRPC: prevent task_cleanup running on freed xprt. (bnc#709671) - add device entry for Broadcom Valentine combo card. (bnc#722429) - quota: Fix WARN_ON in lookup_one_len. (bnc#728626) - Update Xen patches to 2.6.32.48. - pv-on-hvm/kexec: add xs_reset_watches to shutdown watches from old kernel. (bnc#694863) - x86: undo_limit_pages() must reset page count. - mm/vmstat.c: cache align vm_stat. (bnc#729721) - s390/ccwgroup: fix uevent vs dev attrs race (bnc#659101,LTC#69028). - Warn on pagecache limit usage (FATE309111). - SCSI: st: fix race in st_scsi_execute_end. (bnc#720536) - ACPI: introduce 'acpi_rsdp=' parameter for kdump. (bnc#717263) - elousb: Limit the workaround warning to one per error, control workaround activity. (bnc#719916) - SCSI: libiscsi: reset cmd timer if cmds are making progress. (bnc#691440) - SCSI: fix crash in scsi_dispatch_cmd(). (bnc#724989) - NFS/sunrpc: do not use a credential with extra groups. (bnc#725878) - s390/qdio: EQBS retry after CCQ 96 (bnc#725453,LTC#76117). - fcoe: Reduce max_sectors to 1024. (bnc#695898) - apparmor: return -ENOENT when there is no profile for a hat. (bnc#725502) - sched, cgroups: disallow attaching kthreadd. (bnc#721840) - nfs: Check validity of cl_rpcclient in nfs_server_list_show. (bnc#717884) - x86, vt-d: enable x2apic opt out (disabling x2apic through BIOS flag) (bnc#701183, fate#311989). - block: Free queue resources at blk_release_queue(). (bnc#723815) - ALSA: hda - Add post_suspend patch ops. (bnc#724800) - ALSA: hda - Allow codec-specific set_power_state ops. (bnc#724800) - ALSA: hda - Add support for vref-out based mute LED control on IDT codecs. (bnc#724800) - scsi_dh_rdac : Add definitions for different RDAC operating modes. (bnc#724365) - scsi_dh_rdac : Detect the different RDAC operating modes. (bnc#724365) - scsi_dh_rdac : decide whether to send mode select based on operating mode. (bnc#724365) - scsi_dh_rdac: Use WWID from C8 page instead of Subsystem id from C4 page to identify storage. (bnc#724365) - vlan: Match underlying dev carrier on vlan add. (bnc#722504) - scsi_lib: pause between error retries. (bnc#675127) - xfs: use KM_NOFS for allocations during attribute list operations. (bnc#721830) - bootsplash: Do not crash when no fb is set. (bnc#723542) - cifs: do not allow cifs_iget to match inodes of the wrong type. (bnc#711501) - cifs: fix noserverino handling when 1 extensions are enabled. (bnc#711501) - cifs: reduce false positives with inode aliasing serverino autodisable. (bnc#711501) - parport_pc: release IO region properly if unsupported ITE887x card is found. (bnc#721464) - writeback: avoid unnecessary calculation of bdi dirty thresholds. (bnc#721299) - 1: Fix bogus it_blocksize in VIO iommu code. (bnc#717690) - ext4: Fix max file size and logical block counting of extent format file. (bnc#706374) - novfs: Unable to change password in the Novell Client for Linux. (bnc#713229) - xfs: add more ilock tracing. - sched: move wakeup tracepoint above out_running. (bnc#712002) - config.conf: Build KMPs for the -trace flavor as well (fate#312759, bnc#712404, bnc#712405, bnc#721337). - memsw: remove noswapaccount kernel parameter. (bnc#719450)
    last seen 2019-02-21
    modified 2013-12-05
    plugin id 57297
    published 2011-12-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=57297
    title SuSE 11.1 Security Update : Linux kernel (SAT Patch Numbers 5493 / 5510 / 5511)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-2303.NASL
    description Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2011-1020 Kees Cook discovered an issue in the /proc filesystem that allows local users to gain access to sensitive process information after execution of a setuid binary. - CVE-2011-1576 Ryan Sweat discovered an issue in the VLAN implementation. Local users may be able to cause a kernel memory leak, resulting in a denial of service. - CVE-2011-2484 Vasiliy Kulikov of Openwall discovered that the number of exit handlers that a process can register is not capped, resulting in local denial of service through resource exhaustion (CPU time and memory). - CVE-2011-2491 Vasily Averin discovered an issue with the NFS locking implementation. A malicious NFS server can cause a client to hang indefinitely in an unlock call. - CVE-2011-2492 Marek Kroemeke and Filip Palian discovered that uninitialized struct elements in the Bluetooth subsystem could lead to a leak of sensitive kernel memory through leaked stack memory. - CVE-2011-2495 Vasiliy Kulikov of Openwall discovered that the io file of a process' proc directory was world-readable, resulting in local information disclosure of information such as password lengths. - CVE-2011-2496 Robert Swiecki discovered that mremap() could be abused for local denial of service by triggering a BUG_ON assert. - CVE-2011-2497 Dan Rosenberg discovered an integer underflow in the Bluetooth subsystem, which could lead to denial of service or privilege escalation. - CVE-2011-2517 It was discovered that the netlink-based wireless configuration interface performed insufficient length validation when parsing SSIDs, resulting in buffer overflows. Local users with the CAP_NET_ADMIN capability can cause a denial of service. - CVE-2011-2525 Ben Pfaff reported an issue in the network scheduling code. A local user could cause a denial of service (NULL pointer dereference) by sending a specially crafted netlink message. - CVE-2011-2700 Mauro Carvalho Chehab of Red Hat reported a buffer overflow issue in the driver for the Si4713 FM Radio Transmitter driver used by N900 devices. Local users could exploit this issue to cause a denial of service or potentially gain elevated privileges. - CVE-2011-2723 Brent Meshier reported an issue in the GRO (generic receive offload) implementation. This can be exploited by remote users to create a denial of service (system crash) in certain network device configurations. - CVE-2011-2905 Christian Ohm discovered that the 'perf' analysis tool searches for its config files in the current working directory. This could lead to denial of service or potential privilege escalation if a user with elevated privileges is tricked into running 'perf' in a directory under the control of the attacker. - CVE-2011-2909 Vasiliy Kulikov of Openwall discovered that a programming error in the Comedi driver could lead to the information disclosure through leaked stack memory. - CVE-2011-2918 Vince Weaver discovered that incorrect handling of software event overflows in the 'perf' analysis tool could lead to local denial of service. - CVE-2011-2928 Timo Warns discovered that insufficient validation of Be filesystem images could lead to local denial of service if a malformed filesystem image is mounted. - CVE-2011-3188 Dan Kaminsky reported a weakness of the sequence number generation in the TCP protocol implementation. This can be used by remote attackers to inject packets into an active session. - CVE-2011-3191 Darren Lavender reported an issue in the Common Internet File System (CIFS). A malicious file server could cause memory corruption leading to a denial of service. This update also includes a fix for a regression introduced with the previous security fix for CVE-2011-1768 (Debian bug #633738).
    last seen 2019-02-21
    modified 2018-11-28
    plugin id 56130
    published 2011-09-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=56130
    title Debian DSA-2303-2 : linux-2.6 - privilege escalation/denial of service/information leak
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-1220-1.NASL
    description Ryan Sweat discovered that the kernel incorrectly handled certain VLAN packets. On some systems, a remote attacker could send specially crafted traffic to crash the system, leading to a denial of service. (CVE-2011-1576) Timo Warns discovered that the EFI GUID partition table was not correctly parsed. A physically local attacker that could insert mountable devices could exploit this to crash the system or possibly gain root privileges. (CVE-2011-1776) Dan Rosenberg discovered that the IPv4 diagnostic routines did not correctly validate certain requests. A local attacker could exploit this to consume CPU resources, leading to a denial of service. (CVE-2011-2213) Dan Rosenberg discovered that the Bluetooth stack incorrectly handled certain L2CAP requests. If a system was using Bluetooth, a remote attacker could send specially crafted traffic to crash the system or gain root privileges. (CVE-2011-2497) Mauro Carvalho Chehab discovered that the si4713 radio driver did not correctly check the length of memory copies. If this hardware was available, a local attacker could exploit this to crash the system or gain root privileges. (CVE-2011-2700) Herbert Xu discovered that certain fields were incorrectly handled when Generic Receive Offload (CVE-2011-2723) Time Warns discovered that long symlinks were incorrectly handled on Be filesystems. A local attacker could exploit this with a malformed Be filesystem and crash the system, leading to a denial of service. (CVE-2011-2928) Dan Kaminsky discovered that the kernel incorrectly handled random sequence number generation. An attacker could use this flaw to possibly predict sequence numbers and inject packets. (CVE-2011-3188) Darren Lavender discovered that the CIFS client incorrectly handled certain large values. A remote attacker with a malicious server could exploit this to crash the system or possibly execute arbitrary code as the root user. (CVE-2011-3191)
    last seen 2019-02-21
    modified 2016-12-01
    plugin id 56345
    published 2011-09-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=56345
    title USN-1220-1 : linux-ti-omap4 vulnerabilities
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20110715_KERNEL_ON_SL5_X.NASL
    description