Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2007.0825 -- [RedHat]
Important: kernel security update
23 October 2007
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Kernel
Publisher: Red Hat
Operating System: Red Hat Enterprise Linux 5
Impact: Denial of Service
Increased Privileges
Access Confidential Data
Inappropriate Access
Access: Remote/Unauthenticated
Existing Account
CVE Names: CVE-2007-4574 CVE-2007-4308 CVE-2007-4133
CVE-2007-3850 CVE-2007-3848 CVE-2007-3731
CVE-2007-3513 CVE-2007-3380 CVE-2007-3105
Ref: ESB-2007.0621
ESB-2007.0663
ESB-2007.0733
ESB-2007.0744
Original Bulletin: https://rhn.redhat.com/errata/RHSA-2007-0940.html
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - ---------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Important: kernel security update
Advisory ID: RHSA-2007:0940-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0940.html
Issue date: 2007-10-22
Updated on: 2007-10-22
Product: Red Hat Enterprise Linux
CVE Names: CVE-2007-3105 CVE-2007-3380 CVE-2007-3513
CVE-2007-3731 CVE-2007-3848 CVE-2007-3850
CVE-2007-4308 CVE-2007-4133 CVE-2007-4574
- - ---------------------------------------------------------------------
1. Summary:
Updated kernel packages that fix various security issues in the Red Hat
Enterprise Linux 5 kernel are now available.
This update has been rated as having important security impact by the Red
Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, noarch, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, noarch, ppc, s390x, x86_64
3. Problem description:
The Linux kernel handles the basic functions of the operating system.
These new kernel packages contain fixes for the following security issues:
* A flaw was found in the backported stack unwinder fixes in Red Hat
Enterprise Linux 5. On AMD64 and Intel 64 platforms, a local user could
trigger this flaw and cause a denial of service. (CVE-2007-4574, Important)
* A flaw was found in the handling of process death signals. This allowed a
local user to send arbitrary signals to the suid-process executed by that
user. A successful exploitation of this flaw depends on the structure of
the suid-program and its signal handling. (CVE-2007-3848, Important)
* A flaw was found in the Distributed Lock Manager (DLM) in the cluster
manager. This allowed a remote user who is able to connect to the DLM port
to cause a denial of service. (CVE-2007-3380, Important)
* A flaw was found in the aacraid SCSI driver. This allowed a local user to
make ioctl calls to the driver which should otherwise be restricted to
privileged users. (CVE-2007-4308, Moderate)
* A flaw was found in the prio_tree handling of the hugetlb support that
allowed a local user to cause a denial of service. This only affected
kernels with hugetlb support. (CVE-2007-4133, Moderate)
* A flaw was found in the eHCA driver on PowerPC architectures that allowed
a local user to access 60k of physical address space. This address space
could contain sensitive information. (CVE-2007-3850, Moderate)
* A flaw was found in ptrace support that allowed a local user to cause a
denial of service via a NULL pointer dereference. (CVE-2007-3731, Moderate)
* A flaw was found in the usblcd driver that allowed a local user to cause
a denial
of service by writing data to the device node. To exploit this issue, write
access to the device node was needed. (CVE-2007-3513, Moderate)
* A flaw was found in the random number generator implementation that
allowed a local user to cause a denial of service or possibly gain
privileges. If the root user raised the default wakeup threshold over the
size of the output pool, this flaw could be exploited. (CVE-2007-3105, Low)
In addition to the security issues described above, several bug fixes
preventing possible system crashes and data corruption were also included.
Red Hat Enterprise Linux 5 users are advised to upgrade to these packages,
which contain backported patches to resolve these issues.
4. Solution:
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.
This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188
5. Bug IDs fixed (http://bugzilla.redhat.com/):
245922 - CVE-2007-3380 A TCP connection to DLM port blocks DLM operations
247728 - CVE-2007-3513 Locally triggerable memory consumption in usblcd
248324 - CVE-2007-3731 NULL pointer dereference triggered by ptrace
248325 - CVE-2007-3105 Bound check ordering issue in random driver
250972 - CVE-2007-3848 Privilege escalation via PR_SET_PDEATHSIG
252309 - CVE-2007-4308 Missing ioctl() permission checks in aacraid driver
253926 - CVE-2007-4133 prio_tree unit kernel panic
298141 - CVE-2007-4574 EM64T local DoS
308811 - CVE-2007-3850 kernel LTC31426-4k page mapping support for userspace in 64k kernels
6. RPMs required:
Red Hat Enterprise Linux Desktop (v. 5 client):
SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/kernel-2.6.18-8.1.15.el5.src.rpm
96e7f738ecce94568d5bb134189c326c kernel-2.6.18-8.1.15.el5.src.rpm
i386:
f862f2df0259807e71880bd71b7d459c kernel-2.6.18-8.1.15.el5.i686.rpm
04fa118c137a7ed248e9c906df961528 kernel-PAE-2.6.18-8.1.15.el5.i686.rpm
04e2f8b037a27ab6f4943d496339079a kernel-PAE-debuginfo-2.6.18-8.1.15.el5.i686.rpm
a2850422391d9909877543b3aca1c16b kernel-PAE-devel-2.6.18-8.1.15.el5.i686.rpm
c94b1a5980aa9183b2563ee97af1ec39 kernel-debuginfo-2.6.18-8.1.15.el5.i686.rpm
796744b00942d2ff7aaec2a0519e1c18 kernel-debuginfo-common-2.6.18-8.1.15.el5.i686.rpm
fe3e7757c2a305387104d1d3a23eaff4 kernel-devel-2.6.18-8.1.15.el5.i686.rpm
e2d502422d61345c2b5e14397358eccc kernel-headers-2.6.18-8.1.15.el5.i386.rpm
ea4b753172c08f45e0d67ac8bdd60bf8 kernel-xen-2.6.18-8.1.15.el5.i686.rpm
7310e6056cfacd977b6e9a6e4dbdeaa3 kernel-xen-debuginfo-2.6.18-8.1.15.el5.i686.rpm
9c709312d55ca786d01302618aa50309 kernel-xen-devel-2.6.18-8.1.15.el5.i686.rpm
noarch:
82503886fa27faada673b4c5b51f5e91 kernel-doc-2.6.18-8.1.15.el5.noarch.rpm
x86_64:
47227f2902ab9ed3e2bf56836cf3f8c8 kernel-2.6.18-8.1.15.el5.x86_64.rpm
a7923c0f2724d9c7f844f98cdc6bc4c6 kernel-debuginfo-2.6.18-8.1.15.el5.x86_64.rpm
936c2ebb45de91e38ec406dbd4ea1552 kernel-debuginfo-common-2.6.18-8.1.15.el5.x86_64.rpm
de0ab04f9ece35d22230277e57ac4163 kernel-devel-2.6.18-8.1.15.el5.x86_64.rpm
7b14e095feb0be96ed4335c99aeff961 kernel-headers-2.6.18-8.1.15.el5.x86_64.rpm
97d1aac9db45b83ef9ab05ccfa6e41d9 kernel-xen-2.6.18-8.1.15.el5.x86_64.rpm
70908a1f7e420369a81fb2c6772bb94d kernel-xen-debuginfo-2.6.18-8.1.15.el5.x86_64.rpm
e1356a3b6a13306a0da4da273b78c8de kernel-xen-devel-2.6.18-8.1.15.el5.x86_64.rpm
Red Hat Enterprise Linux (v. 5 server):
SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/kernel-2.6.18-8.1.15.el5.src.rpm
96e7f738ecce94568d5bb134189c326c kernel-2.6.18-8.1.15.el5.src.rpm
i386:
f862f2df0259807e71880bd71b7d459c kernel-2.6.18-8.1.15.el5.i686.rpm
04fa118c137a7ed248e9c906df961528 kernel-PAE-2.6.18-8.1.15.el5.i686.rpm
04e2f8b037a27ab6f4943d496339079a kernel-PAE-debuginfo-2.6.18-8.1.15.el5.i686.rpm
a2850422391d9909877543b3aca1c16b kernel-PAE-devel-2.6.18-8.1.15.el5.i686.rpm
c94b1a5980aa9183b2563ee97af1ec39 kernel-debuginfo-2.6.18-8.1.15.el5.i686.rpm
796744b00942d2ff7aaec2a0519e1c18 kernel-debuginfo-common-2.6.18-8.1.15.el5.i686.rpm
fe3e7757c2a305387104d1d3a23eaff4 kernel-devel-2.6.18-8.1.15.el5.i686.rpm
e2d502422d61345c2b5e14397358eccc kernel-headers-2.6.18-8.1.15.el5.i386.rpm
ea4b753172c08f45e0d67ac8bdd60bf8 kernel-xen-2.6.18-8.1.15.el5.i686.rpm
7310e6056cfacd977b6e9a6e4dbdeaa3 kernel-xen-debuginfo-2.6.18-8.1.15.el5.i686.rpm
9c709312d55ca786d01302618aa50309 kernel-xen-devel-2.6.18-8.1.15.el5.i686.rpm
ia64:
d359d0330e7b6804af362af1eb1adc7d kernel-2.6.18-8.1.15.el5.ia64.rpm
ef7242edeab0b6b4e819931012a9ac77 kernel-debuginfo-2.6.18-8.1.15.el5.ia64.rpm
70d97793b3913609d98a56716d788fa8 kernel-debuginfo-common-2.6.18-8.1.15.el5.ia64.rpm
3376e3721a0409159040aa448d2e7c63 kernel-devel-2.6.18-8.1.15.el5.ia64.rpm
9b176d5a29ee2f4ddfded0e6317b5260 kernel-headers-2.6.18-8.1.15.el5.ia64.rpm
d48babc1ecb538673533d2c00017773f kernel-xen-2.6.18-8.1.15.el5.ia64.rpm
7d095696578e0b8c6da43885a7f0b119 kernel-xen-debuginfo-2.6.18-8.1.15.el5.ia64.rpm
e65b46be5519d6e9cda212a2f52cbc51 kernel-xen-devel-2.6.18-8.1.15.el5.ia64.rpm
noarch:
82503886fa27faada673b4c5b51f5e91 kernel-doc-2.6.18-8.1.15.el5.noarch.rpm
ppc:
075c973a5187cfc363b4039743c851a1 kernel-2.6.18-8.1.15.el5.ppc64.rpm
dcdec27094c2c3ad8ac98ad549f7e2b9 kernel-debuginfo-2.6.18-8.1.15.el5.ppc64.rpm
b3146028b8afb016a14629f203341a66 kernel-debuginfo-common-2.6.18-8.1.15.el5.ppc64.rpm
28cb4c0282755727b1d0960b188816a6 kernel-devel-2.6.18-8.1.15.el5.ppc64.rpm
7b52271f10576a5649ae85050732ad62 kernel-headers-2.6.18-8.1.15.el5.ppc.rpm
b66c688e3bae66044baa5f8d987d5606 kernel-headers-2.6.18-8.1.15.el5.ppc64.rpm
2d6a3bed623a2ae016793e99c283dfea kernel-kdump-2.6.18-8.1.15.el5.ppc64.rpm
8ba60265e125f856c813cafcf1587a56 kernel-kdump-debuginfo-2.6.18-8.1.15.el5.ppc64.rpm
d5d1dd7a6b076f01338430fc45570192 kernel-kdump-devel-2.6.18-8.1.15.el5.ppc64.rpm
s390x:
e0982a8fa0d9e315cb3b7dc7efcacfde kernel-2.6.18-8.1.15.el5.s390x.rpm
38f795e7b02840409e2afceaf6659211 kernel-debuginfo-2.6.18-8.1.15.el5.s390x.rpm
ff1b32db3d923a14e969eed741c22e88 kernel-debuginfo-common-2.6.18-8.1.15.el5.s390x.rpm
e0fd341c4267569f79589ed67d151d92 kernel-devel-2.6.18-8.1.15.el5.s390x.rpm
d616fd9a1ecac69f961977ee2e3d0288 kernel-headers-2.6.18-8.1.15.el5.s390x.rpm
x86_64:
47227f2902ab9ed3e2bf56836cf3f8c8 kernel-2.6.18-8.1.15.el5.x86_64.rpm
a7923c0f2724d9c7f844f98cdc6bc4c6 kernel-debuginfo-2.6.18-8.1.15.el5.x86_64.rpm
936c2ebb45de91e38ec406dbd4ea1552 kernel-debuginfo-common-2.6.18-8.1.15.el5.x86_64.rpm
de0ab04f9ece35d22230277e57ac4163 kernel-devel-2.6.18-8.1.15.el5.x86_64.rpm
7b14e095feb0be96ed4335c99aeff961 kernel-headers-2.6.18-8.1.15.el5.x86_64.rpm
97d1aac9db45b83ef9ab05ccfa6e41d9 kernel-xen-2.6.18-8.1.15.el5.x86_64.rpm
70908a1f7e420369a81fb2c6772bb94d kernel-xen-debuginfo-2.6.18-8.1.15.el5.x86_64.rpm
e1356a3b6a13306a0da4da273b78c8de kernel-xen-devel-2.6.18-8.1.15.el5.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3105
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3380
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3513
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3731
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3848
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3850
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4308
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4133
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4574
http://www.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact/
Copyright 2007 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFHHIEFXlSAg2UNWIIRAqflAJ9WjecqY68XP5N3RPfKKC2vwR4tyACfVJF/
apZqUd5xaSNM+TO7elKMh8M=
=Z0n2
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
If you believe that your computer system has been compromised or attacked in
any way, we encourage you to let us know by completing the secure National IT
Incident Reporting Form at:
http://www.auscert.org.au/render.html?it=3192
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQCVAwUBRx1SYCh9+71yA2DNAQLkrgQAndGFCu0XqrGOPzL6BbOau/B5mOxf18M/
FIWMPzfHv4IHo/8r21jXMlu0ZXCLcdlqtacjwlAGNRxlX6BlLqnxU46mGPmSLyVU
eva4++6IeCbCgFije55zAPG+TKMD+gtvyBvUZ5he8T9ztNgFjm0nyuMaYrHAVMzE
ju4Lcm/CNX4=
=Ks0P
-----END PGP SIGNATURE-----