Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2007.0825 -- [RedHat] Important: kernel security update 23 October 2007 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Kernel Publisher: Red Hat Operating System: Red Hat Enterprise Linux 5 Impact: Denial of Service Increased Privileges Access Confidential Data Inappropriate Access Access: Remote/Unauthenticated Existing Account CVE Names: CVE-2007-4574 CVE-2007-4308 CVE-2007-4133 CVE-2007-3850 CVE-2007-3848 CVE-2007-3731 CVE-2007-3513 CVE-2007-3380 CVE-2007-3105 Ref: ESB-2007.0621 ESB-2007.0663 ESB-2007.0733 ESB-2007.0744 Original Bulletin: https://rhn.redhat.com/errata/RHSA-2007-0940.html - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Important: kernel security update Advisory ID: RHSA-2007:0940-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0940.html Issue date: 2007-10-22 Updated on: 2007-10-22 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-3105 CVE-2007-3380 CVE-2007-3513 CVE-2007-3731 CVE-2007-3848 CVE-2007-3850 CVE-2007-4308 CVE-2007-4133 CVE-2007-4574 - - --------------------------------------------------------------------- 1. Summary: Updated kernel packages that fix various security issues in the Red Hat Enterprise Linux 5 kernel are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, noarch, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, noarch, ppc, s390x, x86_64 3. Problem description: The Linux kernel handles the basic functions of the operating system. These new kernel packages contain fixes for the following security issues: * A flaw was found in the backported stack unwinder fixes in Red Hat Enterprise Linux 5. On AMD64 and Intel 64 platforms, a local user could trigger this flaw and cause a denial of service. (CVE-2007-4574, Important) * A flaw was found in the handling of process death signals. This allowed a local user to send arbitrary signals to the suid-process executed by that user. A successful exploitation of this flaw depends on the structure of the suid-program and its signal handling. (CVE-2007-3848, Important) * A flaw was found in the Distributed Lock Manager (DLM) in the cluster manager. This allowed a remote user who is able to connect to the DLM port to cause a denial of service. (CVE-2007-3380, Important) * A flaw was found in the aacraid SCSI driver. This allowed a local user to make ioctl calls to the driver which should otherwise be restricted to privileged users. (CVE-2007-4308, Moderate) * A flaw was found in the prio_tree handling of the hugetlb support that allowed a local user to cause a denial of service. This only affected kernels with hugetlb support. (CVE-2007-4133, Moderate) * A flaw was found in the eHCA driver on PowerPC architectures that allowed a local user to access 60k of physical address space. This address space could contain sensitive information. (CVE-2007-3850, Moderate) * A flaw was found in ptrace support that allowed a local user to cause a denial of service via a NULL pointer dereference. (CVE-2007-3731, Moderate) * A flaw was found in the usblcd driver that allowed a local user to cause a denial of service by writing data to the device node. To exploit this issue, write access to the device node was needed. (CVE-2007-3513, Moderate) * A flaw was found in the random number generator implementation that allowed a local user to cause a denial of service or possibly gain privileges. If the root user raised the default wakeup threshold over the size of the output pool, this flaw could be exploited. (CVE-2007-3105, Low) In addition to the security issues described above, several bug fixes preventing possible system crashes and data corruption were also included. Red Hat Enterprise Linux 5 users are advised to upgrade to these packages, which contain backported patches to resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 245922 - CVE-2007-3380 A TCP connection to DLM port blocks DLM operations 247728 - CVE-2007-3513 Locally triggerable memory consumption in usblcd 248324 - CVE-2007-3731 NULL pointer dereference triggered by ptrace 248325 - CVE-2007-3105 Bound check ordering issue in random driver 250972 - CVE-2007-3848 Privilege escalation via PR_SET_PDEATHSIG 252309 - CVE-2007-4308 Missing ioctl() permission checks in aacraid driver 253926 - CVE-2007-4133 prio_tree unit kernel panic 298141 - CVE-2007-4574 EM64T local DoS 308811 - CVE-2007-3850 kernel LTC31426-4k page mapping support for userspace in 64k kernels 6. RPMs required: Red Hat Enterprise Linux Desktop (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/kernel-2.6.18-8.1.15.el5.src.rpm 96e7f738ecce94568d5bb134189c326c kernel-2.6.18-8.1.15.el5.src.rpm i386: f862f2df0259807e71880bd71b7d459c kernel-2.6.18-8.1.15.el5.i686.rpm 04fa118c137a7ed248e9c906df961528 kernel-PAE-2.6.18-8.1.15.el5.i686.rpm 04e2f8b037a27ab6f4943d496339079a kernel-PAE-debuginfo-2.6.18-8.1.15.el5.i686.rpm a2850422391d9909877543b3aca1c16b kernel-PAE-devel-2.6.18-8.1.15.el5.i686.rpm c94b1a5980aa9183b2563ee97af1ec39 kernel-debuginfo-2.6.18-8.1.15.el5.i686.rpm 796744b00942d2ff7aaec2a0519e1c18 kernel-debuginfo-common-2.6.18-8.1.15.el5.i686.rpm fe3e7757c2a305387104d1d3a23eaff4 kernel-devel-2.6.18-8.1.15.el5.i686.rpm e2d502422d61345c2b5e14397358eccc kernel-headers-2.6.18-8.1.15.el5.i386.rpm ea4b753172c08f45e0d67ac8bdd60bf8 kernel-xen-2.6.18-8.1.15.el5.i686.rpm 7310e6056cfacd977b6e9a6e4dbdeaa3 kernel-xen-debuginfo-2.6.18-8.1.15.el5.i686.rpm 9c709312d55ca786d01302618aa50309 kernel-xen-devel-2.6.18-8.1.15.el5.i686.rpm noarch: 82503886fa27faada673b4c5b51f5e91 kernel-doc-2.6.18-8.1.15.el5.noarch.rpm x86_64: 47227f2902ab9ed3e2bf56836cf3f8c8 kernel-2.6.18-8.1.15.el5.x86_64.rpm a7923c0f2724d9c7f844f98cdc6bc4c6 kernel-debuginfo-2.6.18-8.1.15.el5.x86_64.rpm 936c2ebb45de91e38ec406dbd4ea1552 kernel-debuginfo-common-2.6.18-8.1.15.el5.x86_64.rpm de0ab04f9ece35d22230277e57ac4163 kernel-devel-2.6.18-8.1.15.el5.x86_64.rpm 7b14e095feb0be96ed4335c99aeff961 kernel-headers-2.6.18-8.1.15.el5.x86_64.rpm 97d1aac9db45b83ef9ab05ccfa6e41d9 kernel-xen-2.6.18-8.1.15.el5.x86_64.rpm 70908a1f7e420369a81fb2c6772bb94d kernel-xen-debuginfo-2.6.18-8.1.15.el5.x86_64.rpm e1356a3b6a13306a0da4da273b78c8de kernel-xen-devel-2.6.18-8.1.15.el5.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/kernel-2.6.18-8.1.15.el5.src.rpm 96e7f738ecce94568d5bb134189c326c kernel-2.6.18-8.1.15.el5.src.rpm i386: f862f2df0259807e71880bd71b7d459c kernel-2.6.18-8.1.15.el5.i686.rpm 04fa118c137a7ed248e9c906df961528 kernel-PAE-2.6.18-8.1.15.el5.i686.rpm 04e2f8b037a27ab6f4943d496339079a kernel-PAE-debuginfo-2.6.18-8.1.15.el5.i686.rpm a2850422391d9909877543b3aca1c16b kernel-PAE-devel-2.6.18-8.1.15.el5.i686.rpm c94b1a5980aa9183b2563ee97af1ec39 kernel-debuginfo-2.6.18-8.1.15.el5.i686.rpm 796744b00942d2ff7aaec2a0519e1c18 kernel-debuginfo-common-2.6.18-8.1.15.el5.i686.rpm fe3e7757c2a305387104d1d3a23eaff4 kernel-devel-2.6.18-8.1.15.el5.i686.rpm e2d502422d61345c2b5e14397358eccc kernel-headers-2.6.18-8.1.15.el5.i386.rpm ea4b753172c08f45e0d67ac8bdd60bf8 kernel-xen-2.6.18-8.1.15.el5.i686.rpm 7310e6056cfacd977b6e9a6e4dbdeaa3 kernel-xen-debuginfo-2.6.18-8.1.15.el5.i686.rpm 9c709312d55ca786d01302618aa50309 kernel-xen-devel-2.6.18-8.1.15.el5.i686.rpm ia64: d359d0330e7b6804af362af1eb1adc7d kernel-2.6.18-8.1.15.el5.ia64.rpm ef7242edeab0b6b4e819931012a9ac77 kernel-debuginfo-2.6.18-8.1.15.el5.ia64.rpm 70d97793b3913609d98a56716d788fa8 kernel-debuginfo-common-2.6.18-8.1.15.el5.ia64.rpm 3376e3721a0409159040aa448d2e7c63 kernel-devel-2.6.18-8.1.15.el5.ia64.rpm 9b176d5a29ee2f4ddfded0e6317b5260 kernel-headers-2.6.18-8.1.15.el5.ia64.rpm d48babc1ecb538673533d2c00017773f kernel-xen-2.6.18-8.1.15.el5.ia64.rpm 7d095696578e0b8c6da43885a7f0b119 kernel-xen-debuginfo-2.6.18-8.1.15.el5.ia64.rpm e65b46be5519d6e9cda212a2f52cbc51 kernel-xen-devel-2.6.18-8.1.15.el5.ia64.rpm noarch: 82503886fa27faada673b4c5b51f5e91 kernel-doc-2.6.18-8.1.15.el5.noarch.rpm ppc: 075c973a5187cfc363b4039743c851a1 kernel-2.6.18-8.1.15.el5.ppc64.rpm dcdec27094c2c3ad8ac98ad549f7e2b9 kernel-debuginfo-2.6.18-8.1.15.el5.ppc64.rpm b3146028b8afb016a14629f203341a66 kernel-debuginfo-common-2.6.18-8.1.15.el5.ppc64.rpm 28cb4c0282755727b1d0960b188816a6 kernel-devel-2.6.18-8.1.15.el5.ppc64.rpm 7b52271f10576a5649ae85050732ad62 kernel-headers-2.6.18-8.1.15.el5.ppc.rpm b66c688e3bae66044baa5f8d987d5606 kernel-headers-2.6.18-8.1.15.el5.ppc64.rpm 2d6a3bed623a2ae016793e99c283dfea kernel-kdump-2.6.18-8.1.15.el5.ppc64.rpm 8ba60265e125f856c813cafcf1587a56 kernel-kdump-debuginfo-2.6.18-8.1.15.el5.ppc64.rpm d5d1dd7a6b076f01338430fc45570192 kernel-kdump-devel-2.6.18-8.1.15.el5.ppc64.rpm s390x: e0982a8fa0d9e315cb3b7dc7efcacfde kernel-2.6.18-8.1.15.el5.s390x.rpm 38f795e7b02840409e2afceaf6659211 kernel-debuginfo-2.6.18-8.1.15.el5.s390x.rpm ff1b32db3d923a14e969eed741c22e88 kernel-debuginfo-common-2.6.18-8.1.15.el5.s390x.rpm e0fd341c4267569f79589ed67d151d92 kernel-devel-2.6.18-8.1.15.el5.s390x.rpm d616fd9a1ecac69f961977ee2e3d0288 kernel-headers-2.6.18-8.1.15.el5.s390x.rpm x86_64: 47227f2902ab9ed3e2bf56836cf3f8c8 kernel-2.6.18-8.1.15.el5.x86_64.rpm a7923c0f2724d9c7f844f98cdc6bc4c6 kernel-debuginfo-2.6.18-8.1.15.el5.x86_64.rpm 936c2ebb45de91e38ec406dbd4ea1552 kernel-debuginfo-common-2.6.18-8.1.15.el5.x86_64.rpm de0ab04f9ece35d22230277e57ac4163 kernel-devel-2.6.18-8.1.15.el5.x86_64.rpm 7b14e095feb0be96ed4335c99aeff961 kernel-headers-2.6.18-8.1.15.el5.x86_64.rpm 97d1aac9db45b83ef9ab05ccfa6e41d9 kernel-xen-2.6.18-8.1.15.el5.x86_64.rpm 70908a1f7e420369a81fb2c6772bb94d kernel-xen-debuginfo-2.6.18-8.1.15.el5.x86_64.rpm e1356a3b6a13306a0da4da273b78c8de kernel-xen-devel-2.6.18-8.1.15.el5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3105 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3380 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3513 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3731 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3848 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3850 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4308 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4133 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4574 http://www.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHHIEFXlSAg2UNWIIRAqflAJ9WjecqY68XP5N3RPfKKC2vwR4tyACfVJF/ apZqUd5xaSNM+TO7elKMh8M= =Z0n2 - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 If you believe that your computer system has been compromised or attacked in any way, we encourage you to let us know by completing the secure National IT Incident Reporting Form at: http://www.auscert.org.au/render.html?it=3192 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQCVAwUBRx1SYCh9+71yA2DNAQLkrgQAndGFCu0XqrGOPzL6BbOau/B5mOxf18M/ FIWMPzfHv4IHo/8r21jXMlu0ZXCLcdlqtacjwlAGNRxlX6BlLqnxU46mGPmSLyVU eva4++6IeCbCgFije55zAPG+TKMD+gtvyBvUZ5he8T9ztNgFjm0nyuMaYrHAVMzE ju4Lcm/CNX4= =Ks0P -----END PGP SIGNATURE-----