-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                         ESB-2007.0825 -- [RedHat]
                     Important: kernel security update
                              23 October 2007

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              Kernel
Publisher:            Red Hat
Operating System:     Red Hat Enterprise Linux 5
Impact:               Denial of Service
                      Increased Privileges
                      Access Confidential Data
                      Inappropriate Access
Access:               Remote/Unauthenticated
                      Existing Account
CVE Names:            CVE-2007-4574 CVE-2007-4308 CVE-2007-4133
                      CVE-2007-3850 CVE-2007-3848 CVE-2007-3731
                      CVE-2007-3513 CVE-2007-3380 CVE-2007-3105

Ref:                  ESB-2007.0621
                      ESB-2007.0663
                      ESB-2007.0733
                      ESB-2007.0744

Original Bulletin:    https://rhn.redhat.com/errata/RHSA-2007-0940.html

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - ---------------------------------------------------------------------
                   Red Hat Security Advisory

Synopsis:          Important: kernel security update
Advisory ID:       RHSA-2007:0940-01
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2007-0940.html
Issue date:        2007-10-22
Updated on:        2007-10-22
Product:           Red Hat Enterprise Linux
CVE Names:         CVE-2007-3105 CVE-2007-3380 CVE-2007-3513 
                   CVE-2007-3731 CVE-2007-3848 CVE-2007-3850 
                   CVE-2007-4308 CVE-2007-4133 CVE-2007-4574 
- - ---------------------------------------------------------------------

1. Summary:

Updated kernel packages that fix various security issues in the Red Hat
Enterprise Linux 5 kernel are now available.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 5 client) - i386, noarch, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, noarch, ppc, s390x, x86_64

3. Problem description:

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the following security issues:

* A flaw was found in the backported stack unwinder fixes in Red Hat
Enterprise Linux 5.  On AMD64 and Intel 64 platforms, a local user could
trigger this flaw and cause a denial of service. (CVE-2007-4574, Important)

* A flaw was found in the handling of process death signals. This allowed a
local user to send arbitrary signals to the suid-process executed by that
user. A successful exploitation of this flaw depends on the structure of
the suid-program and its signal handling. (CVE-2007-3848, Important)

* A flaw was found in the Distributed Lock Manager (DLM) in the cluster
manager. This allowed a remote user who is able to connect to the DLM port
to cause a denial of service. (CVE-2007-3380, Important)

* A flaw was found in the aacraid SCSI driver. This allowed a local user to
make ioctl calls to the driver which should otherwise be restricted to
privileged users. (CVE-2007-4308, Moderate)

* A flaw was found in the prio_tree handling of the hugetlb support that
allowed a local user to cause a denial of service. This only affected
kernels with hugetlb support. (CVE-2007-4133, Moderate)

* A flaw was found in the eHCA driver on PowerPC architectures that allowed
a local user to access 60k of physical address space. This address space
could contain sensitive information. (CVE-2007-3850, Moderate)

* A flaw was found in ptrace support that allowed a local user to cause a
denial of service via a NULL pointer dereference. (CVE-2007-3731, Moderate)

* A flaw was found in the usblcd driver that allowed a local user to cause
a denial
of service by writing data to the device node. To exploit this issue, write
access to the device node was needed. (CVE-2007-3513, Moderate)

* A flaw was found in the random number generator implementation that
allowed a local user to cause a denial of service or possibly gain
privileges. If the root user raised the default wakeup threshold over the
size of the output pool, this flaw could be exploited. (CVE-2007-3105, Low)

In addition to the security issues described above, several bug fixes
preventing possible system crashes and data corruption were also included.

Red Hat Enterprise Linux 5 users are advised to upgrade to these packages,
which contain backported patches to resolve these issues.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.  

This update is available via Red Hat Network.  Details on how to use 
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

5. Bug IDs fixed (http://bugzilla.redhat.com/):

245922 - CVE-2007-3380 A TCP connection to DLM port blocks DLM operations
247728 - CVE-2007-3513 Locally triggerable memory consumption in usblcd
248324 - CVE-2007-3731 NULL pointer dereference triggered by ptrace
248325 - CVE-2007-3105 Bound check ordering issue in random driver
250972 - CVE-2007-3848 Privilege escalation via PR_SET_PDEATHSIG
252309 - CVE-2007-4308 Missing ioctl() permission checks in aacraid driver
253926 - CVE-2007-4133 prio_tree unit kernel panic
298141 - CVE-2007-4574 EM64T local DoS
308811 - CVE-2007-3850 kernel LTC31426-4k page mapping support for userspace in 64k kernels

6. RPMs required:

Red Hat Enterprise Linux Desktop (v. 5 client):

SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/kernel-2.6.18-8.1.15.el5.src.rpm
96e7f738ecce94568d5bb134189c326c  kernel-2.6.18-8.1.15.el5.src.rpm

i386:
f862f2df0259807e71880bd71b7d459c  kernel-2.6.18-8.1.15.el5.i686.rpm
04fa118c137a7ed248e9c906df961528  kernel-PAE-2.6.18-8.1.15.el5.i686.rpm
04e2f8b037a27ab6f4943d496339079a  kernel-PAE-debuginfo-2.6.18-8.1.15.el5.i686.rpm
a2850422391d9909877543b3aca1c16b  kernel-PAE-devel-2.6.18-8.1.15.el5.i686.rpm
c94b1a5980aa9183b2563ee97af1ec39  kernel-debuginfo-2.6.18-8.1.15.el5.i686.rpm
796744b00942d2ff7aaec2a0519e1c18  kernel-debuginfo-common-2.6.18-8.1.15.el5.i686.rpm
fe3e7757c2a305387104d1d3a23eaff4  kernel-devel-2.6.18-8.1.15.el5.i686.rpm
e2d502422d61345c2b5e14397358eccc  kernel-headers-2.6.18-8.1.15.el5.i386.rpm
ea4b753172c08f45e0d67ac8bdd60bf8  kernel-xen-2.6.18-8.1.15.el5.i686.rpm
7310e6056cfacd977b6e9a6e4dbdeaa3  kernel-xen-debuginfo-2.6.18-8.1.15.el5.i686.rpm
9c709312d55ca786d01302618aa50309  kernel-xen-devel-2.6.18-8.1.15.el5.i686.rpm

noarch:
82503886fa27faada673b4c5b51f5e91  kernel-doc-2.6.18-8.1.15.el5.noarch.rpm

x86_64:
47227f2902ab9ed3e2bf56836cf3f8c8  kernel-2.6.18-8.1.15.el5.x86_64.rpm
a7923c0f2724d9c7f844f98cdc6bc4c6  kernel-debuginfo-2.6.18-8.1.15.el5.x86_64.rpm
936c2ebb45de91e38ec406dbd4ea1552  kernel-debuginfo-common-2.6.18-8.1.15.el5.x86_64.rpm
de0ab04f9ece35d22230277e57ac4163  kernel-devel-2.6.18-8.1.15.el5.x86_64.rpm
7b14e095feb0be96ed4335c99aeff961  kernel-headers-2.6.18-8.1.15.el5.x86_64.rpm
97d1aac9db45b83ef9ab05ccfa6e41d9  kernel-xen-2.6.18-8.1.15.el5.x86_64.rpm
70908a1f7e420369a81fb2c6772bb94d  kernel-xen-debuginfo-2.6.18-8.1.15.el5.x86_64.rpm
e1356a3b6a13306a0da4da273b78c8de  kernel-xen-devel-2.6.18-8.1.15.el5.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/kernel-2.6.18-8.1.15.el5.src.rpm
96e7f738ecce94568d5bb134189c326c  kernel-2.6.18-8.1.15.el5.src.rpm

i386:
f862f2df0259807e71880bd71b7d459c  kernel-2.6.18-8.1.15.el5.i686.rpm
04fa118c137a7ed248e9c906df961528  kernel-PAE-2.6.18-8.1.15.el5.i686.rpm
04e2f8b037a27ab6f4943d496339079a  kernel-PAE-debuginfo-2.6.18-8.1.15.el5.i686.rpm
a2850422391d9909877543b3aca1c16b  kernel-PAE-devel-2.6.18-8.1.15.el5.i686.rpm
c94b1a5980aa9183b2563ee97af1ec39  kernel-debuginfo-2.6.18-8.1.15.el5.i686.rpm
796744b00942d2ff7aaec2a0519e1c18  kernel-debuginfo-common-2.6.18-8.1.15.el5.i686.rpm
fe3e7757c2a305387104d1d3a23eaff4  kernel-devel-2.6.18-8.1.15.el5.i686.rpm
e2d502422d61345c2b5e14397358eccc  kernel-headers-2.6.18-8.1.15.el5.i386.rpm
ea4b753172c08f45e0d67ac8bdd60bf8  kernel-xen-2.6.18-8.1.15.el5.i686.rpm
7310e6056cfacd977b6e9a6e4dbdeaa3  kernel-xen-debuginfo-2.6.18-8.1.15.el5.i686.rpm
9c709312d55ca786d01302618aa50309  kernel-xen-devel-2.6.18-8.1.15.el5.i686.rpm

ia64:
d359d0330e7b6804af362af1eb1adc7d  kernel-2.6.18-8.1.15.el5.ia64.rpm
ef7242edeab0b6b4e819931012a9ac77  kernel-debuginfo-2.6.18-8.1.15.el5.ia64.rpm
70d97793b3913609d98a56716d788fa8  kernel-debuginfo-common-2.6.18-8.1.15.el5.ia64.rpm
3376e3721a0409159040aa448d2e7c63  kernel-devel-2.6.18-8.1.15.el5.ia64.rpm
9b176d5a29ee2f4ddfded0e6317b5260  kernel-headers-2.6.18-8.1.15.el5.ia64.rpm
d48babc1ecb538673533d2c00017773f  kernel-xen-2.6.18-8.1.15.el5.ia64.rpm
7d095696578e0b8c6da43885a7f0b119  kernel-xen-debuginfo-2.6.18-8.1.15.el5.ia64.rpm
e65b46be5519d6e9cda212a2f52cbc51  kernel-xen-devel-2.6.18-8.1.15.el5.ia64.rpm

noarch:
82503886fa27faada673b4c5b51f5e91  kernel-doc-2.6.18-8.1.15.el5.noarch.rpm

ppc:
075c973a5187cfc363b4039743c851a1  kernel-2.6.18-8.1.15.el5.ppc64.rpm
dcdec27094c2c3ad8ac98ad549f7e2b9  kernel-debuginfo-2.6.18-8.1.15.el5.ppc64.rpm
b3146028b8afb016a14629f203341a66  kernel-debuginfo-common-2.6.18-8.1.15.el5.ppc64.rpm
28cb4c0282755727b1d0960b188816a6  kernel-devel-2.6.18-8.1.15.el5.ppc64.rpm
7b52271f10576a5649ae85050732ad62  kernel-headers-2.6.18-8.1.15.el5.ppc.rpm
b66c688e3bae66044baa5f8d987d5606  kernel-headers-2.6.18-8.1.15.el5.ppc64.rpm
2d6a3bed623a2ae016793e99c283dfea  kernel-kdump-2.6.18-8.1.15.el5.ppc64.rpm
8ba60265e125f856c813cafcf1587a56  kernel-kdump-debuginfo-2.6.18-8.1.15.el5.ppc64.rpm
d5d1dd7a6b076f01338430fc45570192  kernel-kdump-devel-2.6.18-8.1.15.el5.ppc64.rpm

s390x:
e0982a8fa0d9e315cb3b7dc7efcacfde  kernel-2.6.18-8.1.15.el5.s390x.rpm
38f795e7b02840409e2afceaf6659211  kernel-debuginfo-2.6.18-8.1.15.el5.s390x.rpm
ff1b32db3d923a14e969eed741c22e88  kernel-debuginfo-common-2.6.18-8.1.15.el5.s390x.rpm
e0fd341c4267569f79589ed67d151d92  kernel-devel-2.6.18-8.1.15.el5.s390x.rpm
d616fd9a1ecac69f961977ee2e3d0288  kernel-headers-2.6.18-8.1.15.el5.s390x.rpm

x86_64:
47227f2902ab9ed3e2bf56836cf3f8c8  kernel-2.6.18-8.1.15.el5.x86_64.rpm
a7923c0f2724d9c7f844f98cdc6bc4c6  kernel-debuginfo-2.6.18-8.1.15.el5.x86_64.rpm
936c2ebb45de91e38ec406dbd4ea1552  kernel-debuginfo-common-2.6.18-8.1.15.el5.x86_64.rpm
de0ab04f9ece35d22230277e57ac4163  kernel-devel-2.6.18-8.1.15.el5.x86_64.rpm
7b14e095feb0be96ed4335c99aeff961  kernel-headers-2.6.18-8.1.15.el5.x86_64.rpm
97d1aac9db45b83ef9ab05ccfa6e41d9  kernel-xen-2.6.18-8.1.15.el5.x86_64.rpm
70908a1f7e420369a81fb2c6772bb94d  kernel-xen-debuginfo-2.6.18-8.1.15.el5.x86_64.rpm
e1356a3b6a13306a0da4da273b78c8de  kernel-xen-devel-2.6.18-8.1.15.el5.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3105
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3380
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3513
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3731
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3848
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3850
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4308
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4133
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4574
http://www.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2007 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFHHIEFXlSAg2UNWIIRAqflAJ9WjecqY68XP5N3RPfKKC2vwR4tyACfVJF/
apZqUd5xaSNM+TO7elKMh8M=
=Z0n2
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRx1SYCh9+71yA2DNAQLkrgQAndGFCu0XqrGOPzL6BbOau/B5mOxf18M/
FIWMPzfHv4IHo/8r21jXMlu0ZXCLcdlqtacjwlAGNRxlX6BlLqnxU46mGPmSLyVU
eva4++6IeCbCgFije55zAPG+TKMD+gtvyBvUZ5he8T9ztNgFjm0nyuMaYrHAVMzE
ju4Lcm/CNX4=
=Ks0P
-----END PGP SIGNATURE-----