-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2010.0736
             Important: kernel-rt security and bug fix update
                              18 August 2010

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           kernel-rt
Publisher:         Red Hat
Operating System:  Red Hat Enterprise Linux Server 5
Impact/Access:     Execute Arbitrary Code/Commands -- Remote with User Interaction
                   Increased Privileges            -- Existing Account            
                   Denial of Service               -- Remote with User Interaction
                   Denial of Service               -- Existing Account            
                   Access Confidential Data        -- Console/Physical            
Resolution:        Patch/Upgrade
CVE Names:         CVE-2010-2521 CVE-2010-2248 CVE-2010-2240
                   CVE-2010-1643 CVE-2010-1437 CVE-2010-1173
                   CVE-2010-1162 CVE-2010-1088 CVE-2010-1087
                   CVE-2010-1086 CVE-2010-1084 CVE-2010-1083
                   CVE-2009-4138 CVE-2008-7256 

Reference:         ESB-2010.0720
                   ESB-2010.0693
                   ESB-2010.0586
                   ESB-2010.0537
                   ESB-2010.0420
                   ESB-2010.0416
                   ESB-2010.0058

Original Bulletin: 
   https://rhn.redhat.com/errata/RHSA-2010-0631.html

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: kernel-rt security and bug fix update
Advisory ID:       RHSA-2010:0631-01
Product:           Red Hat Enterprise MRG for RHEL-5
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2010-0631.html
Issue date:        2010-08-17
CVE Names:         CVE-2008-7256 CVE-2009-4138 CVE-2010-1083 
                   CVE-2010-1084 CVE-2010-1086 CVE-2010-1087 
                   CVE-2010-1088 CVE-2010-1162 CVE-2010-1173 
                   CVE-2010-1437 CVE-2010-1643 CVE-2010-2240 
                   CVE-2010-2248 CVE-2010-2521 
=====================================================================

1. Summary:

Updated kernel-rt packages that fix multiple security issues and several
bugs are now available for Red Hat Enterprise MRG 1.2.

The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

2. Relevant releases/architectures:

MRG Realtime for RHEL 5 Server - i386, noarch, x86_64

3. Description:

These packages contain the Linux kernel, the core of any Linux operating
system.

Security fixes:

* unsafe sprintf() use in the Bluetooth implementation. Creating a large
number of Bluetooth L2CAP, SCO, or RFCOMM sockets could result in arbitrary
memory pages being overwritten, allowing a local, unprivileged user to
cause a denial of service or escalate their privileges. (CVE-2010-1084,
Important)

* a flaw in the Unidirectional Lightweight Encapsulation implementation,
allowing a remote attacker to send a specially-crafted ISO MPEG-2 Transport
Stream frame to a target system, resulting in a denial of service.
(CVE-2010-1086, Important)

* NULL pointer dereference in nfs_wb_page_cancel(), allowing a local user
on a system that has an NFS-mounted file system to cause a denial of
service or escalate their privileges on that system. (CVE-2010-1087,
Important)

* flaw in sctp_process_unk_param(), allowing a remote attacker to send a
specially-crafted SCTP packet to an SCTP listening port on a target system,
causing a denial of service. (CVE-2010-1173, Important)

* race condition between finding a keyring by name and destroying a freed
keyring in the key management facility, allowing a local, unprivileged
user to cause a denial of service or escalate their privileges.
(CVE-2010-1437, Important)

* systems using the kernel NFS server to export a shared memory file system
and that have the sysctl overcommit_memory variable set to never overcommit
(a value of 2; by default, it is set to 0), may experience a NULL pointer
dereference, allowing a local, unprivileged user to cause a denial of
service or escalate their privileges. (CVE-2008-7256, CVE-2010-1643,
Important)

* when an application has a stack overflow, the stack could silently
overwrite another memory mapped area instead of a segmentation fault
occurring, which could lead to local privilege escalation on 64-bit
systems. This issue is fixed with an implementation of a stack guard
feature. (CVE-2010-2240, Important)

* flaw in CIFSSMBWrite() could allow a remote attacker to send a
specially-crafted SMB response packet to a target CIFS client, resulting in
a denial of service. (CVE-2010-2248, Important)

* buffer overflow flaws in the kernel's implementation of the server-side
XDR for NFSv4 could allow an attacker on the local network to send a
specially-crafted large compound request to the NFSv4 server, possibly
resulting in a denial of service or code execution. (CVE-2010-2521,
Important)

* NULL pointer dereference in the firewire-ohci driver used for OHCI
compliant IEEE 1394 controllers could allow a local, unprivileged user with
access to /dev/fw* files to issue certain IOCTL calls, causing a denial of
service or privilege escalation. The FireWire modules are blacklisted by
default. If enabled, only root has access to the files noted above by
default. (CVE-2009-4138, Moderate)

* flaw in the link_path_walk() function. Using the file descriptor
returned by open() with the O_NOFOLLOW flag on a subordinate NFS-mounted
file system, could result in a NULL pointer dereference, causing a denial
of service or privilege escalation. (CVE-2010-1088, Moderate)

* memory leak in release_one_tty() could allow a local, unprivileged user
to cause a denial of service. (CVE-2010-1162, Moderate)

* information leak in the USB implementation. Certain USB errors could
result in an uninitialized kernel buffer being sent to user-space. An
attacker with physical access to a target system could use this flaw to
cause an information leak. (CVE-2010-1083, Low)

Red Hat would like to thank Neil Brown for reporting CVE-2010-1084; Ang Way
Chuang for reporting CVE-2010-1086; Jukka Taimisto and Olli Jarva of
Codenomicon Ltd, Nokia Siemens Networks, and Wind River on behalf of their
customer, for responsibly reporting CVE-2010-1173; the X.Org security team
for reporting CVE-2010-2240, with upstream acknowledging Rafal Wojtczuk as
the original reporter; and Marcus Meissner for reporting CVE-2010-1083.

4. Solution:

Users should upgrade to these updated packages, which contain
backported patches to correct these issues and fix the bugs noted in
the Kernel Security Update document, linked to in the References. The
system must be rebooted for this update to take effect.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

To install kernel packages manually, use "rpm -ivh [package]". Do not
use "rpm -Uvh" as that will remove the running kernel binaries from
your system. You may use "rpm -e" to remove old kernels after
determining that the new kernel functions properly on your system.

5. Bugs fixed (http://bugzilla.redhat.com/):

547236 - CVE-2009-4138 kernel: firewire: ohci: handle receive packets with a data length of zero
555671 - MRG -146/-147 kernels have older broadcom drivers compared with RHEL5.4
562075 - kernel: vfs: add MNT_NOFOLLOW flag to umount(2) [mrg-1]
566624 - CVE-2010-1083 kernel: information leak via userspace USB interface
567184 - CVE-2010-1087 kernel: NFS: Fix an Oops when truncating a file
567813 - CVE-2010-1088 kernel: fix LOOKUP_FOLLOW on automount "symlinks"
569237 - CVE-2010-1086 kernel: dvb-core: DoS bug in ULE decapsulation code
576018 - CVE-2010-1084 kernel: bluetooth: potential bad memory access with sysfs files
582076 - CVE-2010-1162 kernel: tty: release_one_tty() forgets to put pids
584645 - CVE-2010-1173 kernel: sctp: crash due to malformed SCTPChunkInit packet
585094 - CVE-2010-1437 kernel: keyrings: find_keyring_by_name() can gain the freed keyring
594630 - kernel: security: testing the wrong variable in create_by_name() [mrg-1]
595970 - CVE-2008-7256 CVE-2010-1643 kernel: nfsd: fix vm overcommit crash
601210 - Fusion MPT misc device (ioctl) driver  too verbose in message/fusion/mptctl.c::mptctl_ioctl()
606611 - CVE-2010-2240 kernel: mm: keep a guard page below a grow-down stack segment
608583 - CVE-2010-2248 kernel: cifs: Fix a kernel BUG with remote OS/2 server
612028 - CVE-2010-2521 kernel: nfsd4: bug in read_buf

6. Package List:

MRG Realtime for RHEL 5 Server:

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/RHEMRG/SRPMS/kernel-rt-2.6.24.7-161.el5rt.src.rpm

i386:
kernel-rt-2.6.24.7-161.el5rt.i686.rpm
kernel-rt-debug-2.6.24.7-161.el5rt.i686.rpm
kernel-rt-debug-debuginfo-2.6.24.7-161.el5rt.i686.rpm
kernel-rt-debug-devel-2.6.24.7-161.el5rt.i686.rpm
kernel-rt-debuginfo-2.6.24.7-161.el5rt.i686.rpm
kernel-rt-debuginfo-common-2.6.24.7-161.el5rt.i686.rpm
kernel-rt-devel-2.6.24.7-161.el5rt.i686.rpm
kernel-rt-trace-2.6.24.7-161.el5rt.i686.rpm
kernel-rt-trace-debuginfo-2.6.24.7-161.el5rt.i686.rpm
kernel-rt-trace-devel-2.6.24.7-161.el5rt.i686.rpm
kernel-rt-vanilla-2.6.24.7-161.el5rt.i686.rpm
kernel-rt-vanilla-debuginfo-2.6.24.7-161.el5rt.i686.rpm
kernel-rt-vanilla-devel-2.6.24.7-161.el5rt.i686.rpm

noarch:
kernel-rt-doc-2.6.24.7-161.el5rt.noarch.rpm
kernel-rt-firmware-2.6.24.7-161.el5rt.noarch.rpm

x86_64:
kernel-rt-2.6.24.7-161.el5rt.x86_64.rpm
kernel-rt-debug-2.6.24.7-161.el5rt.x86_64.rpm
kernel-rt-debug-debuginfo-2.6.24.7-161.el5rt.x86_64.rpm
kernel-rt-debug-devel-2.6.24.7-161.el5rt.x86_64.rpm
kernel-rt-debuginfo-2.6.24.7-161.el5rt.x86_64.rpm
kernel-rt-debuginfo-common-2.6.24.7-161.el5rt.x86_64.rpm
kernel-rt-devel-2.6.24.7-161.el5rt.x86_64.rpm
kernel-rt-trace-2.6.24.7-161.el5rt.x86_64.rpm
kernel-rt-trace-debuginfo-2.6.24.7-161.el5rt.x86_64.rpm
kernel-rt-trace-devel-2.6.24.7-161.el5rt.x86_64.rpm
kernel-rt-vanilla-2.6.24.7-161.el5rt.x86_64.rpm
kernel-rt-vanilla-debuginfo-2.6.24.7-161.el5rt.x86_64.rpm
kernel-rt-vanilla-devel-2.6.24.7-161.el5rt.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2008-7256.html
https://www.redhat.com/security/data/cve/CVE-2009-4138.html
https://www.redhat.com/security/data/cve/CVE-2010-1083.html
https://www.redhat.com/security/data/cve/CVE-2010-1084.html
https://www.redhat.com/security/data/cve/CVE-2010-1086.html
https://www.redhat.com/security/data/cve/CVE-2010-1087.html
https://www.redhat.com/security/data/cve/CVE-2010-1088.html
https://www.redhat.com/security/data/cve/CVE-2010-1162.html
https://www.redhat.com/security/data/cve/CVE-2010-1173.html
https://www.redhat.com/security/data/cve/CVE-2010-1437.html
https://www.redhat.com/security/data/cve/CVE-2010-1643.html
https://www.redhat.com/security/data/cve/CVE-2010-2240.html
https://www.redhat.com/security/data/cve/CVE-2010-2248.html
https://www.redhat.com/security/data/cve/CVE-2010-2521.html
http://www.redhat.com/security/updates/classification/#important
http://www.redhat.com/docs/en-US/errata/RHSA-2010-0631/Kernel_Security_Update/index.html
https://access.redhat.com/kb/docs/DOC-31052

8. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2010 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFMarMbXlSAg2UNWIIRAggfAKC0sYKQtjtDN+1Ejjuu2IUS8EMR/gCdGxFj
Jkg8YiOC+2sBVv8FQuZDo+k=
=w/rL
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iD8DBQFMa0zh/iFOrG6YcBERAvQZAKChgSb3DlNBGMy2nzTYlP1urX5hIQCgtke+
5Zpejnc6K042UdWWG0r8Z+g=
=Ikma
-----END PGP SIGNATURE-----