April 2005
Red Hat - Two Security Advisories: 1. Moderate: logwatch security update [RHSA-2005:364-01] - 2. Important: kernel security update [RHSA-2005:366-01]
ID: 00338
Ref: 312/2005
Date: 20 April 2005:17:09:56
Version: 1
Title: Red Hat - Two Security Advisories: 1. Moderate: logwatch security update [RHSA-2005:364-01] - 2. Important: kernel security update [RHSA-2005:366-01]
Abstract: 1. An updated logwatch package that fixes a denial of service issue is now available. - 2. Updated kernel packages that fix several security issues are now available for Red Hat Enterprise Linux 4.
Vendors affected: Red Hat
Operating systems affected: Red Hat
Applications affected: Red Hat
Title
=====
Red Hat - Two Security Advisories
1. Moderate: logwatch security update [RHSA-2005:364-01]
2. Important: kernel security update [RHSA-2005:366-01]
Detail
======
Security Advisory summaries:
1. An updated logwatch package that fixes a denial of service issue is now
available.
2. Updated kernel packages that fix several security issues are now available
for Red Hat Enterprise Linux 4.
Security Advisory content follows:
1.
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - ---------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Moderate: logwatch security update
Advisory ID: RHSA-2005:364-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2005-364.html
Issue date: 2005-04-19
Updated on: 2005-04-19
Product: Red Hat Enterprise Linux
Keywords: logwatch
CVE Names: CAN-2005-1061
- - ---------------------------------------------------------------------
1. Summary:
An updated logwatch package that fixes a denial of service issue is now
available.
This update has been rated as having moderate security impact by the
Red Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - noarch
Red Hat Linux Advanced Workstation 2.1 - noarch
Red Hat Enterprise Linux ES version 2.1 - noarch
Red Hat Enterprise Linux WS version 2.1 - noarch
3. Problem description:
LogWatch is a customizable log analysis system. LogWatch parses
through your system's logs for a given period of time and creates a
report analyzing areas that you specify, in as much detail as you
require.
A bug was found in the logwatch secure script. If an attacker is able to
inject an arbitrary string into the /var/log/secure file, it is possible to
prevent logwatch from detecting malicious activity. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2005-1061 to this issue.
All users of logwatch are advised to upgrade to this updated
package, which contain backported fixes for this issue.
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains
the
desired RPMs.
Please note that this update is also available via Red Hat Network. Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:
up2date
This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.
5. Bug IDs fixed (http://bugzilla.redhat.com/):
137502 - CAN-2005-1061 logwatch log processing regular expression DoS
6. RPMs required:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/logwatch-2.6-2.EL2.src.rpm
251d0fde1a715d1bb0fbbba7f7285493 logwatch-2.6-2.EL2.src.rpm
noarch:
b112e89085531f4b37ea8c2b2b40ad6e logwatch-2.6-2.EL2.noarch.rpm
Red Hat Linux Advanced Workstation 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/logwatch-2.6-2.EL2.src.rpm
251d0fde1a715d1bb0fbbba7f7285493 logwatch-2.6-2.EL2.src.rpm
noarch:
b112e89085531f4b37ea8c2b2b40ad6e logwatch-2.6-2.EL2.noarch.rpm
Red Hat Enterprise Linux ES version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/logwatch-2.6-2.EL2.src.rpm
251d0fde1a715d1bb0fbbba7f7285493 logwatch-2.6-2.EL2.src.rpm
noarch:
b112e89085531f4b37ea8c2b2b40ad6e logwatch-2.6-2.EL2.noarch.rpm
Red Hat Enterprise Linux WS version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/logwatch-2.6-2.EL2.src.rpm
251d0fde1a715d1bb0fbbba7f7285493 logwatch-2.6-2.EL2.src.rpm
noarch:
b112e89085531f4b37ea8c2b2b40ad6e logwatch-2.6-2.EL2.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1061
8. Contact:
The Red Hat security contact is . More contact
details at https://www.redhat.com/security/team/contact/
Copyright 2005 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQFCZVTmXlSAg2UNWIIRAtGVAKCBPMw2ZPaN7RV8xOj6dIMKGDJVQQCgt8MA
Z1TW4fErUFpZ+nKaCHVbWcE=
=Tlur
- -----END PGP SIGNATURE-----
2.
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - ---------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Important: kernel security update
Advisory ID: RHSA-2005:366-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2005-366.html
Issue date: 2005-04-19
Updated on: 2005-04-19
Product: Red Hat Enterprise Linux
Keywords: nahant kernel errata
CVE Names: CAN-2005-0135 CAN-2005-0207 CAN-2005-0209 CAN-2005-0384
CAN-2005-0400 CAN-2005-0449 CAN-2005-0529 CAN-2005-0530
CAN-2005-0531 CAN-2005-0736 CAN-2005-0749 CAN-2005-0750
CAN-2005-0767 CAN-2005-0815 CAN-2005-0839 CAN-2005-0867
CAN-2005-0977 CAN-2005-1041
- - ---------------------------------------------------------------------
1. Summary:
Updated kernel packages that fix several security issues are now available
for Red Hat Enterprise Linux 4.
This update has been rated as having important security impact by the Red
Hat Security Response Team.
The Linux kernel handles the basic functions of the operating system.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS version 4 - i386, ia64, noarch, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, noarch, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, noarch, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, noarch, x86_64
3. Problem description:
A flaw in the fib_seq_start function was discovered. A local user could use
this flaw to cause a denial of service (system crash) via /proc/net/route.
(CAN-2005-1041)
A flaw in the tmpfs file system was discovered. A local user could use this
flaw to cause a denial of service (system crash). (CAN-2005-0977)
An integer overflow flaw was found when writing to a sysfs file. A local
user could use this flaw to overwrite kernel memory, causing a denial of
service (system crash) or arbitrary code execution. (CAN-2005-0867)
Keith Owens reported a flaw in the Itanium unw_unwind_to_user function. A
local user could use this flaw to cause a denial of service (system crash)
on Itanium architectures. (CAN-2005-0135)
A flaw in the NFS client O_DIRECT error case handling was discovered. A
local user could use this flaw to cause a denial of service (system crash).
(CAN-2005-0207)
A flaw in fragment forwarding was discovered that affected the netfilter
subsystem for certain network interface cards. A remote attacker could send
a set of bad fragments and cause a denial of service (system crash). Acenic
and SunGEM network interfaces were the only adapters affected, which are in
widespread use. (CAN-2005-0209)
A flaw was discovered in the Linux PPP driver. On systems allowing remote
users to connect to a server using ppp, a remote client could cause a
denial of service (system crash). (CAN-2005-0384)
A flaw was discovered in the ext2 file system code. When a new directory is
created, the ext2 block written to disk is not initialized, which could
lead to an information leak if a disk image is made available to
unprivileged users. (CAN-2005-0400)
A flaw in fragment queuing was discovered that affected the Linux kernel
netfilter subsystem. On systems configured to filter or process network
packets (e.g. firewalling), a remote attacker could send a carefully
crafted set of fragmented packets to a machine and cause a denial of
service (system crash). In order to sucessfully exploit this flaw, the
attacker would need to know or guess some aspects of the firewall ruleset
on the target system. (CAN-2005-0449)
A number of flaws were found in the Linux 2.6 kernel. A local user could
use these flaws to read kernel memory or cause a denial of service (crash).
(CAN-2005-0529, CAN-2005-0530, CAN-2005-0531)
An integer overflow in sys_epoll_wait in eventpoll.c was discovered. A
local user could use this flaw to overwrite low kernel memory. This memory
is usually unused, not usually resulting in a security consequence.
(CAN-2005-0736)
A flaw when freeing a pointer in load_elf_library was discovered. A local
user could potentially use this flaw to cause a denial of service (crash).
(CAN-2005-0749)
A flaw was discovered in the bluetooth driver system. On systems where the
bluetooth modules are loaded, a local user could use this flaw to gain
elevated (root) privileges. (CAN-2005-0750)
A race condition was discovered that affected the Radeon DRI driver. A
local user who has DRI privileges on a Radeon graphics card may be able to
use this flaw to gain root privileges. (CAN-2005-0767)
Multiple range checking flaws were discovered in the iso9660 file system
handler. An attacker could create a malicious file system image which would
cause a denial or service or potentially execute arbitrary code if mounted.
(CAN-2005-0815)
A flaw was discovered when setting line discipline on a serial tty. A local
user may be able to use this flaw to inject mouse movements or keystrokes
when another user is logged in. (CAN-2005-0839)
Red Hat Enterprise Linux 4 users are advised to upgrade their kernels
to the packages associated with their machine architectures and
configurations as listed in this erratum.
Please note that a vulnerability addressed by this update (CAN-2005-0449)
required a change to the kernel module ABI which could cause third party
modules to not work. However, Red Hat is currently not aware of any module
that would be affected by this change.
4. Solution:
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
5. Bug IDs fixed (http://bugzilla.redhat.com/):
147468 - CAN-2005-0449 Possible remote Oops/firewall bypass
148868 - CAN-2005-0135 ia64 local DoS
148878 - CAN-2005-0207 nfs client O_DIRECT oops
149466 - CAN-2005-0529 Sign handling issues on v2.6 (CAN-2005-0530 CAN-2005-0531)
149589 - CAN-2005-0209 netfilter SKB problem
151240 - CAN-2005-0384 pppd remote DoS
151249 - CAN-2005-0736 epoll overflow
151902 - CAN-2005-0767 drm race in radeon
152177 - CAN-2005-0750 bluetooth security flaw
152399 - CAN-2005-0400 ext2 mkdir() directory entry random kernel memory leak
152405 - CAN-2005-0815 isofs range checking flaws
152410 - CAN-2005-0749 load_elf_library possible DoS
152417 - CAN-2005-0839 N_MOUSE line discipline flaw
152561 - CAN-2005-0977 tmpfs truncate bug
154219 - CAN-2005-0867 sysfs signedness problem
154551 - CAN-2005-1041 crash while reading /proc/net/route
6. RPMs required:
Red Hat Enterprise Linux AS version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/kernel-2.6.9-5.0.5.EL.src.rpm
5c195d29285c007e9d24c62c83dcb912 kernel-2.6.9-5.0.5.EL.src.rpm
i386:
9664da40e572449a6847e93182a32c3c kernel-2.6.9-5.0.5.EL.i686.rpm
99f0ef2ce199e67f2933e2740f4d64d5 kernel-devel-2.6.9-5.0.5.EL.i686.rpm
ac8ddc9ece5c9d0a5d2d5aa632354b74 kernel-hugemem-2.6.9-5.0.5.EL.i686.rpm
eacb127a2036da6c096bdc7e65d65fc5 kernel-hugemem-devel-2.6.9-5.0.5.EL.i686.rpm
9327533de8bda32cd822a3641a4ba7b4 kernel-smp-2.6.9-5.0.5.EL.i686.rpm
3ddb05a05f268170d0362f88803ca333 kernel-smp-devel-2.6.9-5.0.5.EL.i686.rpm
ia64:
3846f3b0cb158cea58d6eadcbbe20e5e kernel-2.6.9-5.0.5.EL.ia64.rpm
8184ecdf261a08faab82207cf5cd0d91 kernel-devel-2.6.9-5.0.5.EL.ia64.rpm
noarch:
405f5d5be5119e38e9eba7fb6c1d5e17 kernel-doc-2.6.9-5.0.5.EL.noarch.rpm
ppc:
432a6e25f7b93513a5c94a29c4e631b9 kernel-2.6.9-5.0.5.EL.ppc64.rpm
2c4b243f0c58cf2042e74fc6537336b0 kernel-2.6.9-5.0.5.EL.ppc64iseries.rpm
3893af8a7c2fff3cadec1ee00a3d4c5e kernel-devel-2.6.9-5.0.5.EL.ppc64.rpm
06c3bc39ae9b33dc37bfbb8a979cb3bd kernel-devel-2.6.9-5.0.5.EL.ppc64iseries.rpm
s390:
0923d70710e70d973d1a700c6094c9f8 kernel-2.6.9-5.0.5.EL.s390.rpm
55a81c1746924b784470866525c08785 kernel-devel-2.6.9-5.0.5.EL.s390.rpm
s390x:
78ee1de0c8d4b1de697593d00f3fb5cb kernel-2.6.9-5.0.5.EL.s390x.rpm
5051be0f2437f99275dbfa9da9955f11 kernel-devel-2.6.9-5.0.5.EL.s390x.rpm
x86_64:
a16892ac78518e7a948c71ca07c7c3d5 kernel-2.6.9-5.0.5.EL.x86_64.rpm
e4f614a057827048bafa5b5f4f8848ba kernel-devel-2.6.9-5.0.5.EL.x86_64.rpm
39eacfa87d106fee7705e335f72722ca kernel-smp-2.6.9-5.0.5.EL.x86_64.rpm
90c6bb332096064e2283e5849d3060fa kernel-smp-devel-2.6.9-5.0.5.EL.x86_64.rpm
Red Hat Enterprise Linux Desktop version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/kernel-2.6.9-5.0.5.EL.src.rpm
5c195d29285c007e9d24c62c83dcb912 kernel-2.6.9-5.0.5.EL.src.rpm
i386:
9664da40e572449a6847e93182a32c3c kernel-2.6.9-5.0.5.EL.i686.rpm
99f0ef2ce199e67f2933e2740f4d64d5 kernel-devel-2.6.9-5.0.5.EL.i686.rpm
ac8ddc9ece5c9d0a5d2d5aa632354b74 kernel-hugemem-2.6.9-5.0.5.EL.i686.rpm
eacb127a2036da6c096bdc7e65d65fc5 kernel-hugemem-devel-2.6.9-5.0.5.EL.i686.rpm
9327533de8bda32cd822a3641a4ba7b4 kernel-smp-2.6.9-5.0.5.EL.i686.rpm
3ddb05a05f268170d0362f88803ca333 kernel-smp-devel-2.6.9-5.0.5.EL.i686.rpm
noarch:
405f5d5be5119e38e9eba7fb6c1d5e17 kernel-doc-2.6.9-5.0.5.EL.noarch.rpm
x86_64:
a16892ac78518e7a948c71ca07c7c3d5 kernel-2.6.9-5.0.5.EL.x86_64.rpm
e4f614a057827048bafa5b5f4f8848ba kernel-devel-2.6.9-5.0.5.EL.x86_64.rpm
39eacfa87d106fee7705e335f72722ca kernel-smp-2.6.9-5.0.5.EL.x86_64.rpm
90c6bb332096064e2283e5849d3060fa kernel-smp-devel-2.6.9-5.0.5.EL.x86_64.rpm
Red Hat Enterprise Linux ES version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/kernel-2.6.9-5.0.5.EL.src.rpm
5c195d29285c007e9d24c62c83dcb912 kernel-2.6.9-5.0.5.EL.src.rpm
i386:
9664da40e572449a6847e93182a32c3c kernel-2.6.9-5.0.5.EL.i686.rpm
99f0ef2ce199e67f2933e2740f4d64d5 kernel-devel-2.6.9-5.0.5.EL.i686.rpm
ac8ddc9ece5c9d0a5d2d5aa632354b74 kernel-hugemem-2.6.9-5.0.5.EL.i686.rpm
eacb127a2036da6c096bdc7e65d65fc5 kernel-hugemem-devel-2.6.9-5.0.5.EL.i686.rpm
9327533de8bda32cd822a3641a4ba7b4 kernel-smp-2.6.9-5.0.5.EL.i686.rpm
3ddb05a05f268170d0362f88803ca333 kernel-smp-devel-2.6.9-5.0.5.EL.i686.rpm
ia64:
3846f3b0cb158cea58d6eadcbbe20e5e kernel-2.6.9-5.0.5.EL.ia64.rpm
8184ecdf261a08faab82207cf5cd0d91 kernel-devel-2.6.9-5.0.5.EL.ia64.rpm
noarch:
405f5d5be5119e38e9eba7fb6c1d5e17 kernel-doc-2.6.9-5.0.5.EL.noarch.rpm
x86_64:
a16892ac78518e7a948c71ca07c7c3d5 kernel-2.6.9-5.0.5.EL.x86_64.rpm
e4f614a057827048bafa5b5f4f8848ba kernel-devel-2.6.9-5.0.5.EL.x86_64.rpm
39eacfa87d106fee7705e335f72722ca kernel-smp-2.6.9-5.0.5.EL.x86_64.rpm
90c6bb332096064e2283e5849d3060fa kernel-smp-devel-2.6.9-5.0.5.EL.x86_64.rpm
Red Hat Enterprise Linux WS version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/kernel-2.6.9-5.0.5.EL.src.rpm
5c195d29285c007e9d24c62c83dcb912 kernel-2.6.9-5.0.5.EL.src.rpm
i386:
9664da40e572449a6847e93182a32c3c kernel-2.6.9-5.0.5.EL.i686.rpm
99f0ef2ce199e67f2933e2740f4d64d5 kernel-devel-2.6.9-5.0.5.EL.i686.rpm
ac8ddc9ece5c9d0a5d2d5aa632354b74 kernel-hugemem-2.6.9-5.0.5.EL.i686.rpm
eacb127a2036da6c096bdc7e65d65fc5 kernel-hugemem-devel-2.6.9-5.0.5.EL.i686.rpm
9327533de8bda32cd822a3641a4ba7b4 kernel-smp-2.6.9-5.0.5.EL.i686.rpm
3ddb05a05f268170d0362f88803ca333 kernel-smp-devel-2.6.9-5.0.5.EL.i686.rpm
ia64:
3846f3b0cb158cea58d6eadcbbe20e5e kernel-2.6.9-5.0.5.EL.ia64.rpm
8184ecdf261a08faab82207cf5cd0d91 kernel-devel-2.6.9-5.0.5.EL.ia64.rpm
noarch:
405f5d5be5119e38e9eba7fb6c1d5e17 kernel-doc-2.6.9-5.0.5.EL.noarch.rpm
x86_64:
a16892ac78518e7a948c71ca07c7c3d5 kernel-2.6.9-5.0.5.EL.x86_64.rpm
e4f614a057827048bafa5b5f4f8848ba kernel-devel-2.6.9-5.0.5.EL.x86_64.rpm
39eacfa87d106fee7705e335f72722ca kernel-smp-2.6.9-5.0.5.EL.x86_64.rpm
90c6bb332096064e2283e5849d3060fa kernel-smp-devel-2.6.9-5.0.5.EL.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0135
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0207
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0209
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0384
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0400
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0449
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0529
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0530
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0531
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0736
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0749
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0750
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0767
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0815
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0839
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0867
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0977
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1041
8. Contact:
The Red Hat security contact is . More contact
details at https://www.redhat.com/security/team/contact/
Copyright 2005 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQFCZVUKXlSAg2UNWIIRAgmNAJ4+Smnt5XzkD4dOT5yxaDnbggqRCgCfT7jT
/gjkXBWugwIbNAiQaX19kNs=
=C/T6
- -----END PGP SIGNATURE-----