copyright | disclaimer | privacy | contact  
Australia's Leading Computer Emergency Response Team
 
Search this site

 
On this site

 > HOME
 > About AusCERT
 > Membership
 > Contact Us
 > PKI Services
 > Publications
 > Sec. Bulletins
 > Conferences
 > News & Media
 > Services
 > Web Log
 > Site Map
 > Site Help
 > Member login





 

ESB-2007.0523 -- [Linux][RedHat] -- Moderate: kernel security and bug fix update

Date: 12 July 2007

Click here for printable version
Click here for PGP verifiable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                     ESB-2007.0523 -- [Linux][RedHat]
               Moderate: kernel security and bug fix update
                               12 July 2007

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              Red Hat Enterprise Linux Desktop (v. 5 client)
                      RHEL Desktop Workstation (v. 5 client)
                      Red Hat Enterprise Linux (v. 5 server)
Publisher:            Red Hat
Operating System:     Red Hat Enterprise Linux 5
Impact:               Denial of Service
Access:               Existing Account
CVE Names:            CVE-2007-3107

Original Bulletin:    https://rhn.redhat.com/errata/RHSA-2007-0595.html

Comment: This advisory references vulnerabilities in the Linux kernel that
         also affect distributions other than RedHat. It is recommended
         that administrators running Linux check for an updated version of
         the kernel for their system.

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - ---------------------------------------------------------------------
                   Red Hat Security Advisory

Synopsis:          Moderate: kernel security and bug fix update
Advisory ID:       RHSA-2007:0595-01
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2007-0595.html
Issue date:        2007-07-10
Updated on:        2007-07-10
Product:           Red Hat Enterprise Linux
CVE Names:         CVE-2007-3107 
- - ---------------------------------------------------------------------

1. Summary:

Updated kernel packages that fix a security issue and a bug in the Red Hat
Enterprise Linux 5 kernel are now available.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 5 client) - i386, noarch, x86_64
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, noarch, ppc, s390x, x86_64

3. Problem description:

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain a fix for the following security issue:

* a flaw in the signal handling on PowerPC-based systems that allowed a
local user to cause a denial of service (floating point corruption).
(CVE-2007-3107, Moderate).

In addition to the security issue described above, a fix for the following
have been included:

* a bug that can lead to data corruption with ServerWorks IDE controllers.

Red Hat Enterprise Linux 5 users are advised to upgrade to these packages,
which contain backported patches to correct these issues.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.  

This update is available via Red Hat Network.  Details on how to use 
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

5. Bug IDs fixed (http://bugzilla.redhat.com/):

245580 - CVE-2007-3107 Data buffer miscompare on PowerPC when running HTX

6. RPMs required:

Red Hat Enterprise Linux Desktop (v. 5 client):

SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/kernel-2.6.18-8.1.8.el5.src.rpm
ccbe8192d28c5643e24f0d59dd3ffd67  kernel-2.6.18-8.1.8.el5.src.rpm

i386:
3e58eb32058190282456b5fd50d1d0a9  kernel-2.6.18-8.1.8.el5.i686.rpm
e86c8a399ec8e9c61cd3a06ef5fcc72c  kernel-PAE-2.6.18-8.1.8.el5.i686.rpm
ad4b5792668259e84cdcdac8700d3f7b  kernel-PAE-debuginfo-2.6.18-8.1.8.el5.i686.rpm
a63c1acd8cb25932ceae804174878454  kernel-debuginfo-2.6.18-8.1.8.el5.i686.rpm
c6d441ea98dc19ad0d2e4519ce37fad6  kernel-debuginfo-common-2.6.18-8.1.8.el5.i686.rpm
369b98eb100f0fea6080e04dc56b28ba  kernel-headers-2.6.18-8.1.8.el5.i386.rpm
a6acf16511257758eabd2befb5498b53  kernel-xen-2.6.18-8.1.8.el5.i686.rpm
c6c1bea1dfc733eb00c11d900fc1d095  kernel-xen-debuginfo-2.6.18-8.1.8.el5.i686.rpm

noarch:
7399c28871d391fccb59014103bdefe4  kernel-doc-2.6.18-8.1.8.el5.noarch.rpm

x86_64:
030ea917650057deafe66c292d7ab56d  kernel-2.6.18-8.1.8.el5.x86_64.rpm
f856112851f7e639715388313e5fbe74  kernel-debuginfo-2.6.18-8.1.8.el5.x86_64.rpm
e935ebd99d2308b02c296653816eed07  kernel-debuginfo-common-2.6.18-8.1.8.el5.x86_64.rpm
abb52e09d47b6810e595d400530a7610  kernel-headers-2.6.18-8.1.8.el5.x86_64.rpm
aa4d7fb67b3578c13ee304bcbb54c304  kernel-xen-2.6.18-8.1.8.el5.x86_64.rpm
4f9ff59c4d4d4b314d38c8f7ab245636  kernel-xen-debuginfo-2.6.18-8.1.8.el5.x86_64.rpm

RHEL Desktop Workstation (v. 5 client):

SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/kernel-2.6.18-8.1.8.el5.src.rpm
ccbe8192d28c5643e24f0d59dd3ffd67  kernel-2.6.18-8.1.8.el5.src.rpm

i386:
ad4b5792668259e84cdcdac8700d3f7b  kernel-PAE-debuginfo-2.6.18-8.1.8.el5.i686.rpm
0c9e09e0836b39880581e3abdec33c39  kernel-PAE-devel-2.6.18-8.1.8.el5.i686.rpm
a63c1acd8cb25932ceae804174878454  kernel-debuginfo-2.6.18-8.1.8.el5.i686.rpm
c6d441ea98dc19ad0d2e4519ce37fad6  kernel-debuginfo-common-2.6.18-8.1.8.el5.i686.rpm
64c31079a5643fd9327edcfe8e191469  kernel-devel-2.6.18-8.1.8.el5.i686.rpm
c6c1bea1dfc733eb00c11d900fc1d095  kernel-xen-debuginfo-2.6.18-8.1.8.el5.i686.rpm
5b4b876f17154fa1fd744a8db5dc4eea  kernel-xen-devel-2.6.18-8.1.8.el5.i686.rpm

x86_64:
f856112851f7e639715388313e5fbe74  kernel-debuginfo-2.6.18-8.1.8.el5.x86_64.rpm
e935ebd99d2308b02c296653816eed07  kernel-debuginfo-common-2.6.18-8.1.8.el5.x86_64.rpm
081997d16bf02e9ea9ed70644cb09676  kernel-devel-2.6.18-8.1.8.el5.x86_64.rpm
4f9ff59c4d4d4b314d38c8f7ab245636  kernel-xen-debuginfo-2.6.18-8.1.8.el5.x86_64.rpm
7a6a9de800775c5b96051bf207a96ea5  kernel-xen-devel-2.6.18-8.1.8.el5.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/kernel-2.6.18-8.1.8.el5.src.rpm
ccbe8192d28c5643e24f0d59dd3ffd67  kernel-2.6.18-8.1.8.el5.src.rpm

i386:
3e58eb32058190282456b5fd50d1d0a9  kernel-2.6.18-8.1.8.el5.i686.rpm
e86c8a399ec8e9c61cd3a06ef5fcc72c  kernel-PAE-2.6.18-8.1.8.el5.i686.rpm
ad4b5792668259e84cdcdac8700d3f7b  kernel-PAE-debuginfo-2.6.18-8.1.8.el5.i686.rpm
0c9e09e0836b39880581e3abdec33c39  kernel-PAE-devel-2.6.18-8.1.8.el5.i686.rpm
a63c1acd8cb25932ceae804174878454  kernel-debuginfo-2.6.18-8.1.8.el5.i686.rpm
c6d441ea98dc19ad0d2e4519ce37fad6  kernel-debuginfo-common-2.6.18-8.1.8.el5.i686.rpm
64c31079a5643fd9327edcfe8e191469  kernel-devel-2.6.18-8.1.8.el5.i686.rpm
369b98eb100f0fea6080e04dc56b28ba  kernel-headers-2.6.18-8.1.8.el5.i386.rpm
a6acf16511257758eabd2befb5498b53  kernel-xen-2.6.18-8.1.8.el5.i686.rpm
c6c1bea1dfc733eb00c11d900fc1d095  kernel-xen-debuginfo-2.6.18-8.1.8.el5.i686.rpm
5b4b876f17154fa1fd744a8db5dc4eea  kernel-xen-devel-2.6.18-8.1.8.el5.i686.rpm

ia64:
700f83613226861d1a92e57860a112f0  kernel-2.6.18-8.1.8.el5.ia64.rpm
b516ba567326dbf332c6189916ee3eb5  kernel-debuginfo-2.6.18-8.1.8.el5.ia64.rpm
ba871b9b8b873a4c0e79884ba12c3c23  kernel-debuginfo-common-2.6.18-8.1.8.el5.ia64.rpm
e052a3ab0c0cd9eaee269410319bf760  kernel-devel-2.6.18-8.1.8.el5.ia64.rpm
c0fe8cb785e4f81994e941968f182771  kernel-headers-2.6.18-8.1.8.el5.ia64.rpm
7d3d52bf96815398149f56bb14fb6ce5  kernel-xen-2.6.18-8.1.8.el5.ia64.rpm
cfaf07086c6499a6280ceeb0aacc5edb  kernel-xen-debuginfo-2.6.18-8.1.8.el5.ia64.rpm
9a88436ef78a5c7b3daeeaf1602a0f9c  kernel-xen-devel-2.6.18-8.1.8.el5.ia64.rpm

noarch:
7399c28871d391fccb59014103bdefe4  kernel-doc-2.6.18-8.1.8.el5.noarch.rpm

ppc:
c9141104da9444d3f45acad60ad5d1c4  kernel-2.6.18-8.1.8.el5.ppc64.rpm
932be3eb9459b3ae30144521a5e512fe  kernel-debuginfo-2.6.18-8.1.8.el5.ppc64.rpm
27f8fca5de1e7efe8d92c557f4394b71  kernel-debuginfo-common-2.6.18-8.1.8.el5.ppc64.rpm
4d0413de0b40d0eeec27ab192b28aff0  kernel-devel-2.6.18-8.1.8.el5.ppc64.rpm
8b4ad434207dce9f47074e207c11a3be  kernel-headers-2.6.18-8.1.8.el5.ppc.rpm
f75b27870021e1472f936ca89d2e4a3c  kernel-headers-2.6.18-8.1.8.el5.ppc64.rpm
0ebf821ec8c1da7c455dbfb2ae6e1d8b  kernel-kdump-2.6.18-8.1.8.el5.ppc64.rpm
9f5da404db772ad524dc007bc5b6dddf  kernel-kdump-debuginfo-2.6.18-8.1.8.el5.ppc64.rpm
bd6eb05a3964db319c6434c7b128c76e  kernel-kdump-devel-2.6.18-8.1.8.el5.ppc64.rpm

s390x:
52b735abcc9ece904b64dc64d43e2d4a  kernel-2.6.18-8.1.8.el5.s390x.rpm
b6eca7d81e3b4797cc887ca1ba70ac6b  kernel-debuginfo-2.6.18-8.1.8.el5.s390x.rpm
b9e1591ae65451849cfaf913e522f23b  kernel-debuginfo-common-2.6.18-8.1.8.el5.s390x.rpm
2670a4156ec41e85c8b1fed153856cce  kernel-devel-2.6.18-8.1.8.el5.s390x.rpm
fb7e7eadd1ca1cb7587c20b159c8ffe2  kernel-headers-2.6.18-8.1.8.el5.s390x.rpm

x86_64:
030ea917650057deafe66c292d7ab56d  kernel-2.6.18-8.1.8.el5.x86_64.rpm
f856112851f7e639715388313e5fbe74  kernel-debuginfo-2.6.18-8.1.8.el5.x86_64.rpm
e935ebd99d2308b02c296653816eed07  kernel-debuginfo-common-2.6.18-8.1.8.el5.x86_64.rpm
081997d16bf02e9ea9ed70644cb09676  kernel-devel-2.6.18-8.1.8.el5.x86_64.rpm
abb52e09d47b6810e595d400530a7610  kernel-headers-2.6.18-8.1.8.el5.x86_64.rpm
aa4d7fb67b3578c13ee304bcbb54c304  kernel-xen-2.6.18-8.1.8.el5.x86_64.rpm
4f9ff59c4d4d4b314d38c8f7ab245636  kernel-xen-debuginfo-2.6.18-8.1.8.el5.x86_64.rpm
7a6a9de800775c5b96051bf207a96ea5  kernel-xen-devel-2.6.18-8.1.8.el5.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3107
http://www.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2007 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFGkwhRXlSAg2UNWIIRAqj1AJ0XWeSnRaIIjbmuzAXVN5AWB2KvxQCfS/Hi
8VoGTup3asELm/WqbaKiWGE=
=7pDg
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRpWoTSh9+71yA2DNAQI4qAP/V/Ax6v1mOCpzSGWKYV/FaQk73CgwF44O
RuhIlSlV8Sw8pBedDsp63jnTrxYDh/FpCVKihHz3W9/NizC1Vh3zLAY/CgdfF6Ow
UFLztfc1O6eHf1gFHliNC056Aee5TkzBsXdwlXPpOrjnlbCw52xejMkr574gyOCi
VFwhTYWVTz8=
=tFVL
-----END PGP SIGNATURE-----