[Full-Disclosure] [FLSA-2004:1804] Updated kernel resolves security vulnerabilities

From: Dominic Hargreaves (dom_at_earth.li)
Date: 10/18/04

  • Next message: Ron DuFresne: "Re: [Full-Disclosure] Re: Any update on SSH brute force attempts?" 
    To: bugtraq@securityfocus.com, full-disclosure@lists.netsys.com
Date: Mon, 18 Oct 2004 10:40:36 +0100

    -----------------------------------------------------------------------
                   Fedora Legacy Update Advisory

    Synopsis: Updated kernel resolves security vulnerabilities
    Advisory ID: FLSA:1804
    Issue date: 2004-10-18
    Product: Red Hat Linux
    Keywords: Security
    Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=1804
    CVE Names: CAN-2004-0619, CAN-2004-0497, CAN-2004-0587,
                       CAN-2004-0658, CAN-2004-0415, CAN-2004-0427,
                       CAN-2004-0495, CAN-2004-0535, CAN-2004-0554,
                       CAN-2004-0228, CAN-2004-0178, CAN-2004-0181,
                       CAN-2004-0394, CAN-2004-0003, CAN-2004-0109,
                       CAN-2004-0133
    -----------------------------------------------------------------------

    ---------------------------------------------------------------------
    1. Topic:

    Updated kernel packages that fix security vulnerabilities which may
    allow local users to gain root privileges are now available. These
    packages also resolve other minor issues.

    2. Relevent releases/architectures:

    Red Hat Linux 7.3 - i386, i586, i686, athlon
    Red Hat Linux 9 - i386, i586, i686, athlon

    3. Problem description:

    The Linux kernel handles the basic functions of the operating system.

    iDefense reported a buffer overflow flaw in the ISO9660 filesystem code.
    An attacker could create a malicious filesystem in such a way that they
    could gain root privileges if that filesystem is mounted. The Common
    Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
    CAN-2004-0109 to this issue. This issue is addressed in the Red Hat 7.3
    packages referenced in this advisory, having been previously fixed for Red
    Hat 9.

    These packages also contain an updated fix with additional checks for
    issues in the R128 Direct Render Infrastructure. The Common
    Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
    CAN-2004-0003 to this issue. This issue was addressed in the Red Hat 7.3
    packages referenced in this advisory, having been previously fixed for Red
    Hat 9.

    A bug in the SoundBlaster 16 code which did not properly handle certain
    sample sizes has been fixed. This flaw could be used by local users to
    crash a system. The Common Vulnerabilities and Exposures project
    (cve.mitre.org) has assigned the name CAN-2004-0178 to this issue.

    Paul Starzetz discovered flaws in the Linux kernel when handling file
    offset pointers. These consist of invalid conversions of 64 to 32-bit file
    offset pointers and possible race conditions. A local unprivileged user
    could make use of these flaws to access large portions of kernel memory.
    The Common Vulnerabilities and Exposures project (cve.mitre.org) has
    assigned the name CAN-2004-0415 to this issue.

    During an audit of the Linux kernel, SUSE discovered a flaw that allowed
    a user to make unauthorized changes to the group ID of files in certain
    circumstances. In the 2.4 kernel, as shipped with Red Hat Enterprise
    Linux, the only way this could happen is through the kernel nfs server. A
    user on a system that mounted a remote file system from a vulnerable
    machine may be able to make unauthorized changes to the group ID of
    exported files. The Common Vulnerabilities and Exposures project
    (cve.mitre.org) has assigned the name CAN-2004-0497 to this issue.

    A flaw was found in Linux kernel versions 2.4 and 2.6 for x86 and x86_64
    that allowed local users to cause a denial of service (system crash) by
    triggering a signal handler with a certain sequence of fsave and frstor
    instructions. The Common Vulnerabilities and Exposures project
    (cve.mitre.org) has assigned the name CAN-2004-0554 to this issue.

    Enhancements were committed to the 2.6 kernel by Al Viro which enabled the
    Sparse source code checking tool to check for a certain class of kernel
    bugs. A subset of these fixes also applies to various drivers in the 2.4
    kernel. These flaws could lead to privilege escalation or access to kernel
    memory. The Common Vulnerabilities and Exposures project (cve.mitre.org)
    has assigned the name CAN-2004-0495 to these issues.

    Integer overflow in the Linux Broadcom 5820 cryptonet driver allows local
    users to cause a denial of service (crash) and possibly execute arbitrary
    code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has
    assigned the name CAN-2004-0619 to this issue. This driver has been removed
    from this release.

    Integer overflow in the IEEE 1394 (Firewire) driver allows local users to
    cause a denial of service (crash) and possibly execute arbitrary code.
    The Common Vulnerabilities and Exposures project (cve.mitre.org) has
    assigned the name CAN-2004-0658 to this issue.

    The do_fork function in Linux 2.4.x before 2.4.26 had a bug which could
    trigger a memory leak leading to a denial of service. The Common
    Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
    name CAN-2004-0427 to this issue.

    An integer signedness error in the cpufreq proc handle allowed local users
    to gain privileges. The Common Vulnerabilities and Exposures project
    (cve.mitre.org) has assigned the name CAN-2004-0228 to this issue.

    The JFS file system code in Linux 2.4.x had an information leak in which
    in-memory data is written to the device for the JFS file system, which
    allowed local users to obtain sensitive information by reading the raw
    device. The Common Vulnerabilities and Exposures project (cve.mitre.org)
    has assigned the name CAN-2004-0181 to this issue.

    The XFS file system code in Linux 2.4.x had an information leak in which
    in-memory data is written to the device for the XFS file system, which
    allowed local users to obtain sensitive information by reading the raw
    device. The Common Vulnerabilities and Exposures project (cve.mitre.org)
    has assigned the name CAN-2004-0133 to this issue.

    In addition, these packages correct further minor issues:

    An bug in the e1000 network driver. This bug could be used by local users
    to leak small amounts of kernel memory (CAN-2004-0535).

    Inappropriate permissions on /proc/scsi/qla2300/HbaApiNode (CAN-2004-0587).

    Potential buffer overflow in the panic() function (CAN-2004-0394).

    All users are advised to upgrade to these errata packages, which contain
    backported security patches that correct these issues.

    Fedora Legacy would like to thank all those who reported the various
    issues discussed here.

    4. Solution:

    Before applying this update, make sure all previously released errata
    relevant to your system have been applied.

    To install kernel packages manually, use "rpm -ivh <package>" and
    modify system settings to boot the kernel you have installed. To
    do this, edit /boot/grub/grub.conf and change the default entry to
    "default=0" (or, if you have chosen to use LILO as your boot loader,
    edit /etc/lilo.conf and run lilo)

    Please note that this update is also available via yum and apt. Many
    people find this an easier way to apply updates. To use yum issue:

    yum update

    or to use apt:

    apt-get update; apt-get upgrade

    This will start an interactive process that will result in the
    appropriate RPMs being upgraded on your system. This assumes that you
    have yum or apt-get configured for obtaining Fedora Legacy content.
    Please visit http://www.fedoralegacy.org/download for directions on how
    to configure yum and apt-get.

    Note that this may not automatically pull the new kernel in if you have
    configured apt/yum to ignore kernels. If so, follow the manual instructions
    above.

    5. Bug IDs fixed:

    https://bugzilla.fedora.us/show_bug.cgi?id=1804 -
    CAN-2004-0619,0497,0587,0658,0415 Kernel fixes
    https://bugzilla.fedora.us/show_bug.cgi?id=1484 -
    various security - related fixes for the kernel

    6. RPMs required:

    Red Hat Linux 7.3:

    SRPM:
    http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/kernel-2.4.20-37.7.legacy.src.rpm

    i386:
    http://download.fedoralegacy.org/redhat/7.3/updates/i386/kernel-2.4.20-37.7.legacy.i386.rpm
    http://download.fedoralegacy.org/redhat/7.3/updates/i386/kernel-BOOT-2.4.20-37.7.legacy.i386.rpm
    http://download.fedoralegacy.org/redhat/7.3/updates/i386/kernel-doc-2.4.20-37.7.legacy.i386.rpm
    http://download.fedoralegacy.org/redhat/7.3/updates/i386/kernel-source-2.4.20-37.7.legacy.i386.rpm

    i568:
    http://download.fedoralegacy.org/redhat/7.3/updates/i386/kernel-2.4.20-37.7.legacy.i586.rpm
    http://download.fedoralegacy.org/redhat/7.3/updates/i386/kernel-smp-2.4.20-37.7.legacy.i586.rpm

    i686:
    http://download.fedoralegacy.org/redhat/7.3/updates/i386/kernel-2.4.20-37.7.legacy.i686.rpm
    http://download.fedoralegacy.org/redhat/7.3/updates/i386/kernel-bigmem-2.4.20-37.7.legacy.i686.rpm
    http://download.fedoralegacy.org/redhat/7.3/updates/i386/kernel-smp-2.4.20-37.7.legacy.i686.rpm

    athlon:
    http://download.fedoralegacy.org/redhat/7.3/updates/i386/kernel-2.4.20-37.7.legacy.athlon.rpm
    http://download.fedoralegacy.org/redhat/7.3/updates/i386/kernel-smp-2.4.20-37.7.legacy.athlon.rpm

    Red Hat Linux 9:

    SRPM:
    http://download.fedoralegacy.org/redhat/9/updates/SRPMS/kernel-2.4.20-37.9.legacy.src.rpm

    i386:
    http://download.fedoralegacy.org/redhat/9/updates/i386/kernel-2.4.20-37.9.legacy.i386.rpm
    http://download.fedoralegacy.org/redhat/9/updates/i386/kernel-BOOT-2.4.20-39.7.legacy.i386.rpm
    http://download.fedoralegacy.org/redhat/9/updates/i386/kernel-doc-2.4.20-39.7.legacy.i386.rpm
    http://download.fedoralegacy.org/redhat/9/updates/i386/kernel-source-2.4.20-39.7.legacy.i386.rpm

    i586:
    http://download.fedoralegacy.org/redhat/9/updates/i386/kernel-2.4.20-37.9.legacy.i586.rpm
    http://download.fedoralegacy.org/redhat/9/updates/i386/kernel-smp-2.4.20-37.9.legacy.i586.rpm

    i686:
    http://download.fedoralegacy.org/redhat/9/updates/i386/kernel-2.4.20-37.9.legacy.i686.rpm
    http://download.fedoralegacy.org/redhat/9/updates/i386/kernel-bigmem-2.4.20-37.9.legacy.i686.rpm
    http://download.fedoralegacy.org/redhat/9/updates/i386/kernel-smp-2.4.20-37.9.legacy.i686.rpm

    athlon:
    http://download.fedoralegacy.org/redhat/9/updates/i386/kernel-2.4.20-37.9.legacy.athlon.rpm
    http://download.fedoralegacy.org/redhat/9/updates/i386/kernel-smp-2.4.20-37.9.legacy.athlon.rpm

    7. Verification:

    SHA1 sum Package Name
    ---------------------------------------------------------------------------

    d5122c56d20371d25921a789f20b4a429f0ed0ee 7.3/updates/SRPMS/kernel-2.4.20-37.7.legacy.src.rpm
    8a1c65a280190c3fc5102bb5a37db4a6d38dc38c 7.3/updates/i386/kernel-2.4.20-37.7.legacy.athlon.rpm
    b7a9696838f7c981fa9dc7f016c626f068d77f32 7.3/updates/i386/kernel-2.4.20-37.7.legacy.i386.rpm
    b01d2fc73b95e89a67b9490b7f7c4261be0b2d92 7.3/updates/i386/kernel-2.4.20-37.7.legacy.i586.rpm
    2c64ea0f6f088eeb2a47eed62f20fce086695f1f 7.3/updates/i386/kernel-2.4.20-37.7.legacy.i686.rpm
    e76f2bbdb94c0baa2d8c81df33f1f001b4eb6515 7.3/updates/i386/kernel-bigmem-2.4.20-37.7.legacy.i686.rpm
    302b9f0ae8e4b8dc975b0243ada68287508d85e9 7.3/updates/i386/kernel-BOOT-2.4.20-37.7.legacy.i386.rpm
    c63c54ec6da4d10a21cd768d9596edb463dab3f3 7.3/updates/i386/kernel-doc-2.4.20-37.7.legacy.i386.rpm
    ca0abce4704e89972b4d55edc615d1ac77c9038a 7.3/updates/i386/kernel-smp-2.4.20-37.7.legacy.athlon.rpm
    e151c2fe55bfb2ecc802ccbc82b176b6e6e32e27 7.3/updates/i386/kernel-smp-2.4.20-37.7.legacy.i586.rpm
    8cddf2b85c8e0aa6442d111a4190c2b2ebc65d45 7.3/updates/i386/kernel-smp-2.4.20-37.7.legacy.i686.rpm
    40595f8d08b8b631742cfb891168a96de36364f0 7.3/updates/i386/kernel-source-2.4.20-37.7.legacy.i386.rpm
    4fdcc24dba64ef30ce49b170f6bbd3be98a129d8 9/updates/SRPMS/kernel-2.4.20-37.9.legacy.src.rpm
    f93b63bc5a40f24351a2d7855aaa66aacf6b1349 9/updates/i386/kernel-2.4.20-37.9.legacy.athlon.rpm
    15c94e731201db0ad89b41d9b2c35e7f85d6f517 9/updates/i386/kernel-2.4.20-37.9.legacy.i386.rpm
    5ee67818d1902c1e7ef919e1986c4c6f5cb58b6c 9/updates/i386/kernel-2.4.20-37.9.legacy.i586.rpm
    4a61fc7fd41a7d35cfcc25178ec5cb659ed3f6fe 9/updates/i386/kernel-2.4.20-37.9.legacy.i686.rpm
    790eef91cb194f60ab6c9ec5b0c4f08365b02022 9/updates/i386/kernel-bigmem-2.4.20-37.9.legacy.i686.rpm
    dd464f337d30580cd60b279d3b28f1ff972b718c 9/updates/i386/kernel-BOOT-2.4.20-37.9.legacy.i386.rpm
    6283845b3af07cf065902f3e75312a3ef7b5c90a 9/updates/i386/kernel-doc-2.4.20-37.9.legacy.i386.rpm
    25f86ab0bb3cfb9e1cf03e71af16c3d58e3db12b 9/updates/i386/kernel-smp-2.4.20-37.9.legacy.athlon.rpm
    c3f2461bd36aba58139e3cb29e34ecf9e97f6daf 9/updates/i386/kernel-smp-2.4.20-37.9.legacy.i586.rpm
    d03acba749f539607b3068670d8d2b12e7a98c02 9/updates/i386/kernel-smp-2.4.20-37.9.legacy.i686.rpm
    65079b01af9d60ca90b6650690634aa5d0c79cfa 9/updates/i386/kernel-source-2.4.20-37.9.legacy.i386.rpm

    These packages are GPG signed by Fedora Legacy for security. Our key is
    available from http://www.fedoralegacy.org/about/security.php

    You can verify each package with the following command:

        rpm --checksig -v <filename>

    If you only wish to verify that each package has not been corrupted or
    tampered with, examine only the sha1sum with the following command:

        sha1sum <filename>

    8. References:

    https://bugzilla.fedora.us/show_bug.cgi?id=1484
    https://bugzilla.fedora.us/show_bug.cgi?id=1804

    9. Contact:

    The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More
    project details at http://www.fedoralegacy.org

    10. Special Notes:

    If you use lilo, you will have to edit your lilo.conf file and shorten
    the label of this kernel. The label is too long for lilo, but not for
    grub.

    This update removes support for the Broadcom 5820 cryptonet hardware. If
    you need support for this device, you will need to make special
    arrangements before applying this update.

    ------------------------------------------------------------------------

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Ron DuFresne: "Re: [Full-Disclosure] Re: Any update on SSH brute force attempts?"

    Relevant Pages