Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2003.0387 -- RHSA-2003:145-01 Updated kernel fixes security vulnerabilities and updates drivers 30 May 2003 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: kernel Publisher: Red Hat Operating System: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 Red Hat Linux Advanced Workstation 2.1 Platform: IA-64 Impact: Root Compromise Denial of Service Access Required: Existing Account Remote CVE Names: CAN-2003-0127 CAN-2003-0244 Ref: ESB-2002.585 - --------------------------BEGIN INCLUDED TEXT-------------------- - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Updated kernel fixes security vulnerabilities and updates drivers Advisory ID: RHSA-2003:145-01 Issue date: 2003-05-27 Updated on: 2003-05-27 Product: Red Hat Enterprise Linux Keywords: ptrace x450 Cross references: Obsoletes: CVE Names: CAN-2003-0127 CAN-2003-0244 - --------------------------------------------------------------------- 1. Topic: These updated kernel packages address security vulnerabilites, including a potential data corruption scenario. In addition, a number of drivers have been updated, bugs have been resolved, and support for the IBM x450 platform and the Madison processor have been added. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - ia64 Red Hat Linux Advanced Workstation 2.1 - ia64 3. Problem description: The Linux kernel handles the basic functions of the operating system. A ptrace-related vulnerability has been discovered that could allow a local user to gain elevated (root) privileges without authorization. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0127 to this issue. A flaw has been discovered that could potentially lead to data corruption. The scenario only occurs while performing memory mapped file I/O, where the file is simultaneously unlinked and the corresponding file blocks reallocated. Furthermore, the memory mapped must be to a partial page at the end of a file on an ext3 file system. As such, Red Hat considers this scenario unlikely. A flaw has been found in several hash table implementations in the kernel networking code. A remote attacker could send packets with carefully chosen, forged source addresses in such a way as to make every routing cache entry get hashed into the same hash chain. The result would be that the kernel would use a disproportionate amount of processor time to deal with new packets, resulting in a remote denial of service attack. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0244 to this issue. In addition, the following drivers have been updated to the version indicated: - - e1000: 4.4.19-k1 - - e100: 2.1.29-k2 - - ips: 6.00.26 - - qla2100, qla2200, qla2300: v6.04.01 - - tg3 driver to 1.4c - - cciss driver to 2.4.44 - - mpt fusion: 2.05.00 - - aic7xxx to 6.2.32 - - aic79xx to 1.3.6 If the system is configured to use alternate drivers, we recommend applying the kudzu errata RHEA-2003:132 prior to updating the kernel. The updated kernel also adds support for the IBM x450 platform and the Madison processor, and incorporates improved support for the hugetlb file system. This file system makes efficient use of the large page size support that the Itanium architecture provides. All users should upgrade to these errata packages, which address these issues. 4. Solution: Release notes, driver notes, and driver disks for this update are available at the following URL: http://www.redhat.com/support/errata/rhel/ Before applying this update, make sure all previously released errata relevant to your system have been applied, especially the additional packages from RHSA-2002:205 and RHSA-2002:206 respectively. The procedure for upgrading the kernel manually is documented at: http://www.redhat.com/support/docs/howto/kernel-upgrade/ Please read the directions for your architecture carefully before proceeding with the kernel upgrade. Please note that this update is also available via Red Hat Network. Many people find this to be an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. Note that you need to select the kernel explicitly on default configurations of up2date. 5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info): 81349 - Machine with QLogic card hung during RAC QA 81794 - IPF: AS2.1 Errata 2: spare lun patch for VA and XP storage arrays 88301 - RHEL AS2.1 IPF: Seeing MCAs on system while testing Tulip driver 81803 - AS2.1 Errata 2: Fix to serial driver 6. RPMs required: Red Hat Enterprise Linux AS (Advanced Server) version 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/kernel-2.4.18-e.31.src.rpm ia64: Available from Red Hat Network: kernel-source-2.4.18-e.31.ia64.rpm Available from Red Hat Network: kernel-smp-2.4.18-e.31.ia64.rpm Available from Red Hat Network: kernel-doc-2.4.18-e.31.ia64.rpm Available from Red Hat Network: kernel-2.4.18-e.31.ia64.rpm Red Hat Linux Advanced Workstation 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/kernel-2.4.18-e.31.src.rpm ia64: Available from Red Hat Network: kernel-source-2.4.18-e.31.ia64.rpm Available from Red Hat Network: kernel-smp-2.4.18-e.31.ia64.rpm Available from Red Hat Network: kernel-doc-2.4.18-e.31.ia64.rpm Available from Red Hat Network: kernel-2.4.18-e.31.ia64.rpm 7. Verification: MD5 sum Package Name - -------------------------------------------------------------------------- ba07dc3a6150a7512fc11f177b909526 2.1AS/en/os/SRPMS/kernel-2.4.18-e.31.src.rpm e0ff58250b006c516f799866f0066e5c 2.1AS/en/os/ia64/kernel-2.4.18-e.31.ia64.rpm 4e578976d53cfd049cf72b3c5e072ae7 2.1AS/en/os/ia64/kernel-doc-2.4.18-e.31.ia64.rpm d83d298a453b3d5c132c24a290b4ea7a 2.1AS/en/os/ia64/kernel-smp-2.4.18-e.31.ia64.rpm 8abaf7731b2447b3232bda41123a4638 2.1AS/en/os/ia64/kernel-source-2.4.18-e.31.ia64.rpm ba07dc3a6150a7512fc11f177b909526 2.1AW/en/os/SRPMS/kernel-2.4.18-e.31.src.rpm e0ff58250b006c516f799866f0066e5c 2.1AW/en/os/ia64/kernel-2.4.18-e.31.ia64.rpm 4e578976d53cfd049cf72b3c5e072ae7 2.1AW/en/os/ia64/kernel-doc-2.4.18-e.31.ia64.rpm d83d298a453b3d5c132c24a290b4ea7a 2.1AW/en/os/ia64/kernel-smp-2.4.18-e.31.ia64.rpm 8abaf7731b2447b3232bda41123a4638 2.1AW/en/os/ia64/kernel-source-2.4.18-e.31.ia64.rpm These packages are GPG signed by Red Hat for security. Our key is available at http://www.redhat.com/solutions/security/news/publickey/ You can verify each package with the following command: rpm --checksig -v <filename> If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: md5sum <filename> 8. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0127 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0244 9. Contact: The Red Hat security contact is <security@redhat.com>. More contact details at http://www.redhat.com/solutions/security/news/contact/ Copyright 2003 Red Hat, Inc. - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to use any or all of this information is the responsibility of each user or organisation, and should be done so in accordance with site policies and procedures. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 If you believe that your system has been compromised, contact AusCERT or your representative in FIRST (Forum of Incident Response and Security Teams). Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv Comment: http://www.auscert.org.au/render.html?it=1967 iQCVAwUBPtdnjCh9+71yA2DNAQHfoAP6AkrvSNM8VTJugsqg7ygxNjqENZSgSEHK xq4qN84xVpX+XAuKFky3IBz9bWENXJ7l/UXKcmGlxvjUcxp1gWNCDsa6/7qJGY4w gUgS9A2+mOYFw5wR4qYyFpnQ2UdavUqg8KjujV7tr6fJH9j15aHh+pvOkE0ZYGrO GeuY9U0ycU4= =SP+G -----END PGP SIGNATURE-----