Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2002.104 -- RHSA-2002:028-13
Updated 2.4 kernel available
28 February 2002
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: 2.4 kernel
Vendor: Red Hat
Operating System: Red Hat Linux 7.1
Red Hat Linux 7.2
Platform: Alpha
Athlon
i386
i586
i686
IA-64
s390
Impact: Increased Privileges
Reduced Security
Access Required: Remote
- --------------------------BEGIN INCLUDED TEXT--------------------
- ---------------------------------------------------------------------
Red Hat, Inc. Red Hat Security Advisory
Synopsis: Updated 2.4 kernel available
Advisory ID: RHSA-2002:028-13
Issue date: 2002-02-13
Updated on: 2002-02-27
Product: Red Hat Linux
Keywords: irc connection tracking netfilter lcall
Cross references:
Obsoletes: RHSA-2002:007
- ---------------------------------------------------------------------
1. Topic:
The Linux Netfilter team has found a problem in the "IRC connection
tracking" component of the firewall within the linux kernel. This problem
affects Red Hat Linux versions 7.1 and 7.2.
2. Relevant releases/architectures:
Red Hat Linux 7.1 - alpha, athlon, i386, i586, i686, ia64
Red Hat Linux 7.2 - athlon, i386, i586, i686, ia64, s390
3. Problem description:
The Linux Netfilter team has found a problem in the IRC connection
tracking component of the firewall within the linux kernel. This component
is distributed with kernels in Red Hat Linux 7.1 and 7.2, although it is
not used in default installations.
The problem consists of an excessively broad netmask setting which is
applied to check if an "IRC DCC" connection through a masquerading firewall
should be allowed. This results in unwanted ports being opened on the
firewall, which could, depending on the firewall filter ruleset, allow
inbound connections.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2002-0060 to this issue. Thanks to Jozsef Kadlecsik
and Harald Welte of the netfilter team.
Users are advised to upgrade to this errata kernel containing patches
which fix these issues.
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied. Red Hat Linux 7.1 users should
update the packages in the XFree86 Erratum (RHEA-2002:010).
The procedure for upgrading the kernel is documented at:
http://www.redhat.com/support/docs/howto/kernel-upgrade/
Please read the directions for your architecture carefully before
proceeding with the kernel upgrade.
Please note that this update is also available via Red Hat Network. Many
people find this to be an easier way to apply updates. To use Red Hat
Network, launch the Red Hat Update Agent with the following command:
up2date
This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system. Note that you need to select the kernel
explicitly on default configurations of up2date.
Note for customers using Red Hat Linux for the IBM s/390:
Users of Red Hat Linux for the IBM s/390 with binary only kernel modules
(OCO) should contact their vendor to obtain updated modules for this kernel
patch.
5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):
6. RPMs required:
Red Hat Linux 7.1:
SRPMS:
ftp://updates.redhat.com/7.1/en/os/SRPMS/kernel-2.4.9-31.src.rpm
alpha:
ftp://updates.redhat.com/7.1/en/os/alpha/kernel-2.4.9-31.alpha.rpm
ftp://updates.redhat.com/7.1/en/os/alpha/kernel-smp-2.4.9-31.alpha.rpm
ftp://updates.redhat.com/7.1/en/os/alpha/kernel-source-2.4.9-31.alpha.rpm
ftp://updates.redhat.com/7.1/en/os/alpha/kernel-BOOT-2.4.9-31.alpha.rpm
ftp://updates.redhat.com/7.1/en/os/alpha/kernel-headers-2.4.9-31.alpha.rpm
ftp://updates.redhat.com/7.1/en/os/alpha/kernel-doc-2.4.9-31.alpha.rpm
athlon:
ftp://updates.redhat.com/7.1/en/os/athlon/kernel-2.4.9-31.athlon.rpm
ftp://updates.redhat.com/7.1/en/os/athlon/kernel-smp-2.4.9-31.athlon.rpm
i386:
ftp://updates.redhat.com/7.1/en/os/i386/kernel-2.4.9-31.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/kernel-source-2.4.9-31.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/kernel-BOOT-2.4.9-31.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/kernel-headers-2.4.9-31.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/kernel-doc-2.4.9-31.i386.rpm
i586:
ftp://updates.redhat.com/7.1/en/os/i586/kernel-2.4.9-31.i586.rpm
ftp://updates.redhat.com/7.1/en/os/i586/kernel-smp-2.4.9-31.i586.rpm
i686:
ftp://updates.redhat.com/7.1/en/os/i686/kernel-2.4.9-31.i686.rpm
ftp://updates.redhat.com/7.1/en/os/i686/kernel-smp-2.4.9-31.i686.rpm
ftp://updates.redhat.com/7.1/en/os/i686/kernel-enterprise-2.4.9-31.i686.rpm
ftp://updates.redhat.com/7.1/en/os/i686/kernel-debug-2.4.9-31.i686.rpm
ia64:
ftp://updates.redhat.com/7.1/en/os/ia64/kernel-2.4.9-31.ia64.rpm
ftp://updates.redhat.com/7.1/en/os/ia64/kernel-smp-2.4.9-31.ia64.rpm
ftp://updates.redhat.com/7.1/en/os/ia64/kernel-source-2.4.9-31.ia64.rpm
ftp://updates.redhat.com/7.1/en/os/ia64/kernel-headers-2.4.9-31.ia64.rpm
ftp://updates.redhat.com/7.1/en/os/ia64/kernel-doc-2.4.9-31.ia64.rpm
Red Hat Linux 7.2:
SRPMS:
ftp://updates.redhat.com/7.2/en/os/SRPMS/kernel-2.4.9-31.src.rpm
athlon:
ftp://updates.redhat.com/7.2/en/os/athlon/kernel-2.4.9-31.athlon.rpm
ftp://updates.redhat.com/7.2/en/os/athlon/kernel-smp-2.4.9-31.athlon.rpm
i386:
ftp://updates.redhat.com/7.2/en/os/i386/kernel-2.4.9-31.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/kernel-source-2.4.9-31.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/kernel-BOOT-2.4.9-31.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/kernel-headers-2.4.9-31.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/kernel-doc-2.4.9-31.i386.rpm
i586:
ftp://updates.redhat.com/7.2/en/os/i586/kernel-2.4.9-31.i586.rpm
ftp://updates.redhat.com/7.2/en/os/i586/kernel-smp-2.4.9-31.i586.rpm
i686:
ftp://updates.redhat.com/7.2/en/os/i686/kernel-2.4.9-31.i686.rpm
ftp://updates.redhat.com/7.2/en/os/i686/kernel-smp-2.4.9-31.i686.rpm
ftp://updates.redhat.com/7.2/en/os/i686/kernel-enterprise-2.4.9-31.i686.rpm
ftp://updates.redhat.com/7.2/en/os/i686/kernel-debug-2.4.9-31.i686.rpm
ia64:
ftp://updates.redhat.com/7.2/en/os/ia64/kernel-2.4.9-31.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/kernel-smp-2.4.9-31.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/kernel-source-2.4.9-31.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/kernel-headers-2.4.9-31.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/kernel-doc-2.4.9-31.ia64.rpm
s390:
ftp://updates.redhat.com/7.2/en/os/s390/kernel-2.4.9-31.s390.rpm
ftp://updates.redhat.com/7.2/en/os/s390/kernel-source-2.4.9-31.s390.rpm
ftp://updates.redhat.com/7.2/en/os/s390/kernel-BOOT-2.4.9-31.s390.rpm
ftp://updates.redhat.com/7.2/en/os/s390/kernel-headers-2.4.9-31.s390.rpm
ftp://updates.redhat.com/7.2/en/os/s390/kernel-doc-2.4.9-31.s390.rpm
7. Verification:
MD5 sum Package Name
- --------------------------------------------------------------------------
599a9027496067a54b46716c4af2184a 7.1/en/os/SRPMS/kernel-2.4.9-31.src.rpm
4bccc363fdf0f00805ef4c34bbf8b43d 7.1/en/os/alpha/kernel-2.4.9-31.alpha.rpm
92f4dd670944fd607181089b04a1dcd9 7.1/en/os/alpha/kernel-BOOT-2.4.9-31.alpha.rpm
5cb53f48285237d8027b17604ab39616 7.1/en/os/alpha/kernel-doc-2.4.9-31.alpha.rpm
9f95ed2c259c6eeb2cbc13a8e21a447c 7.1/en/os/alpha/kernel-headers-2.4.9-31.alpha.rpm
d43622963a55e817233a258d8318a120 7.1/en/os/alpha/kernel-smp-2.4.9-31.alpha.rpm
9d43960cc26be1783d8004addbb2bb9b 7.1/en/os/alpha/kernel-source-2.4.9-31.alpha.rpm
8b0c9d11ee3f66790b4dca48f018e10b 7.1/en/os/athlon/kernel-2.4.9-31.athlon.rpm
8e710a5f2a98932c2bc9e0d3d073e244 7.1/en/os/athlon/kernel-smp-2.4.9-31.athlon.rpm
64705698f9f5eaf1e79185863382f941 7.1/en/os/i386/kernel-2.4.9-31.i386.rpm
b239ceebf5b5c28a348cd960d3195f03 7.1/en/os/i386/kernel-BOOT-2.4.9-31.i386.rpm
6883d71ffe17dff75514ac38228cd5f0 7.1/en/os/i386/kernel-doc-2.4.9-31.i386.rpm
dae89931407ae5832e374e49d8347234 7.1/en/os/i386/kernel-headers-2.4.9-31.i386.rpm
cba833ad4e2b45392e4de085ca0e920f 7.1/en/os/i386/kernel-source-2.4.9-31.i386.rpm
8e50430f6c4f452d2625819ba7464c47 7.1/en/os/i586/kernel-2.4.9-31.i586.rpm
e72f4fd75463bba1d51b7c7df1999704 7.1/en/os/i586/kernel-smp-2.4.9-31.i586.rpm
5e2b0b72141cbba077eb9c6b4d99991c 7.1/en/os/i686/kernel-2.4.9-31.i686.rpm
a744dabe626acd95740aeb9af88b6d5b 7.1/en/os/i686/kernel-debug-2.4.9-31.i686.rpm
aea058a30a30b3708b988c326ada6d0a 7.1/en/os/i686/kernel-enterprise-2.4.9-31.i686.rpm
3af0f1894a0c8b80486146298144727a 7.1/en/os/i686/kernel-smp-2.4.9-31.i686.rpm
322164648ff900315ea8d062f43de2e8 7.1/en/os/ia64/kernel-2.4.9-31.ia64.rpm
3f7c2c541be3797083cc7ac32e0fdebd 7.1/en/os/ia64/kernel-doc-2.4.9-31.ia64.rpm
c8681048d6817a289ca59e0b4c38e611 7.1/en/os/ia64/kernel-headers-2.4.9-31.ia64.rpm
19026b6d0ce77ce6ced75aa5de77b49a 7.1/en/os/ia64/kernel-smp-2.4.9-31.ia64.rpm
2bdf102fd5b9e7b7e04c6e14d258eeae 7.1/en/os/ia64/kernel-source-2.4.9-31.ia64.rpm
599a9027496067a54b46716c4af2184a 7.2/en/os/SRPMS/kernel-2.4.9-31.src.rpm
8b0c9d11ee3f66790b4dca48f018e10b 7.2/en/os/athlon/kernel-2.4.9-31.athlon.rpm
8e710a5f2a98932c2bc9e0d3d073e244 7.2/en/os/athlon/kernel-smp-2.4.9-31.athlon.rpm
64705698f9f5eaf1e79185863382f941 7.2/en/os/i386/kernel-2.4.9-31.i386.rpm
b239ceebf5b5c28a348cd960d3195f03 7.2/en/os/i386/kernel-BOOT-2.4.9-31.i386.rpm
6883d71ffe17dff75514ac38228cd5f0 7.2/en/os/i386/kernel-doc-2.4.9-31.i386.rpm
dae89931407ae5832e374e49d8347234 7.2/en/os/i386/kernel-headers-2.4.9-31.i386.rpm
cba833ad4e2b45392e4de085ca0e920f 7.2/en/os/i386/kernel-source-2.4.9-31.i386.rpm
8e50430f6c4f452d2625819ba7464c47 7.2/en/os/i586/kernel-2.4.9-31.i586.rpm
e72f4fd75463bba1d51b7c7df1999704 7.2/en/os/i586/kernel-smp-2.4.9-31.i586.rpm
5e2b0b72141cbba077eb9c6b4d99991c 7.2/en/os/i686/kernel-2.4.9-31.i686.rpm
a744dabe626acd95740aeb9af88b6d5b 7.2/en/os/i686/kernel-debug-2.4.9-31.i686.rpm
aea058a30a30b3708b988c326ada6d0a 7.2/en/os/i686/kernel-enterprise-2.4.9-31.i686.rpm
3af0f1894a0c8b80486146298144727a 7.2/en/os/i686/kernel-smp-2.4.9-31.i686.rpm
322164648ff900315ea8d062f43de2e8 7.2/en/os/ia64/kernel-2.4.9-31.ia64.rpm
3f7c2c541be3797083cc7ac32e0fdebd 7.2/en/os/ia64/kernel-doc-2.4.9-31.ia64.rpm
c8681048d6817a289ca59e0b4c38e611 7.2/en/os/ia64/kernel-headers-2.4.9-31.ia64.rpm
19026b6d0ce77ce6ced75aa5de77b49a 7.2/en/os/ia64/kernel-smp-2.4.9-31.ia64.rpm
2bdf102fd5b9e7b7e04c6e14d258eeae 7.2/en/os/ia64/kernel-source-2.4.9-31.ia64.rpm
03414b5deff2f6f673342ea3b8d5cf63 7.2/en/os/s390/kernel-2.4.9-31.s390.rpm
29db2044bac2e46027afa7479f39a394 7.2/en/os/s390/kernel-BOOT-2.4.9-31.s390.rpm
b24851e70837659048e8416e0552fb0f 7.2/en/os/s390/kernel-doc-2.4.9-31.s390.rpm
b5ad515e3bffc79fdbc73a3e0b07b5cc 7.2/en/os/s390/kernel-headers-2.4.9-31.s390.rpm
27d48439af20ab9f9b6ad84942913fe7 7.2/en/os/s390/kernel-source-2.4.9-31.s390.rpm
These packages are GPG signed by Red Hat, Inc. for security. Our key
is available at:
http://www.redhat.com/about/contact/pgpkey.html
You can verify each package with the following command:
rpm --checksig <filename>
If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
rpm --checksig --nogpg <filename>
8. References:
http://www.netfilter.org/security/irc-dcc-mask.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0060
Copyright(c) 2000, 2001 Red Hat, Inc.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the original authors to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/Information/advisories.html
If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for emergencies.
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key
iQCVAwUBPH5TQyh9+71yA2DNAQGIMwP6AiLyJKYbXCTm19vDdRPU2TgYAYi0S0zn
Si/OVTmkbqsrEdknz1/cG09nbT3gb1brVxAeI4rkci9K4D+IJRNYSnxlsDJ/IFJ3
o9ZJfyKqiQSJWJzwlqmoAmLNFtr3H8/YmpagmVm7s331tkS75PyefA2zcFmTXZm0
kL/ezqG+fRY=
=+6nS
-----END PGP SIGNATURE-----