Executive Summary

Summary
Title Updated kernel packages available for Red Hat Enterprise Linux 4 Update 1
Informations
Name RHSA-2005:420 First vendor Publication 2005-06-08
Vendor RedHat Last vendor Modification 2005-06-08
Severity (Vendor) N/A Revision 01

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:C)
Cvss Base Score 7.8 Attack Range Network
Cvss Impact Score 6.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

Updated kernel packages are now available as part of ongoing support and maintenance of Red Hat Enterprise Linux version 4. This is the first regular update.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - i386, ia64, noarch, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, noarch, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, noarch, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, noarch, x86_64

3. Problem description:

The Linux kernel handles the basic functions of the operating system.

This is the first regular kernel update to Red Hat Enterprise Linux 4.

A flaw affecting the auditing code was discovered. On Itanium architectures a local user could use this flaw to cause a denial of service (crash). This issue is rated as having important security impact (CAN-2005-0136).

A flaw was discovered in the servicing of a raw device ioctl. A local user who has access to raw devices could use this flaw to write to kernel memory and cause a denial of service or potentially gain privileges. This issue is rated as having moderate security impact (CAN-2005-1264).

New features introduced by this update include: - - Fixed TCP BIC congestion handling. - - Diskdump support for more controllers (megaraid, SATA) - - Device mapper multipath support - - AMD64 dual core support. - - Intel ICH7 hardware support.

There were many bug fixes in various parts of the kernel. The ongoing effort to resolve these problems has resulted in a marked improvement in the reliability and scalability of Red Hat Enterprise Linux 4.

The following device drivers have been upgraded to new versions:
ata_piix -------- 1.03
bonding --------- 2.6.1
e1000 ----------- 5.6.10.1-k2-NAPI
e100 ------------ 3.3.6-k2-NAPI
ibmveth --------- 1.03
libata ---------- 1.02 to 1.10
lpfc ------------ 0:8.0.16 to 0:8.0.16.6_x2
megaraid_mbox --- 2.20.4.0 to 2.20.4.5
megaraid_mm ----- 2.20.2.0-rh1 to 2.20.2.5
sata_nv --------- 0.03 to 0.6
sata_promise ---- 1.00 to 1.01
sata_sil -------- 0.8
sata_sis -------- 0.5
sata_svw -------- 1.05
sata_sx4 -------- 0.7
sata_via -------- 1.0
sata_vsc -------- 1.0
tg3 ------------- 3.22-rh
ipw2100 --------- 1.0.3
ipw2200 --------- 1.0.0

All Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

4. Solution:

Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

5. Bug IDs fixed (http://bugzilla.redhat.com/):

133590 - PTRACE_ATTACH race with real parent's wait calls can produced bogus wait returns 134338 - Intolerable Disk I/O Performance under 64-bit VM: fix I/O buffers 137154 - "waitid(POSIX Interface)" cannot run properly. 138563 - [PATCH] RHEL4 U1: EFI GPT: reduce alternate header probing 140083 - lx-choptp19 crashed running 2.4.21-20.EL.BZ131027.hotfixhugemem 140383 - BLKFLSBUF ioctl can cause other reads 140472 - x86, x86_64 and IA64 scsi inquiry command hangs in wait_for_completion 141983 - RHEL4 U2: DBS: quiet warning messages from cpufreq.c 142167 - [RHEL4][Diskdump] smp_call_function issue 142464 - [PATCH] "RPC: garbage, exit EIO" when using NFSv3 with Kerberos 5 143073 - traced process cannot be killed 143472 - hugetlb mmap failed in compatibility mode in em64t 143907 - ext2 and device dm-0 byond 2Terabyte causes /var/log/messages file size to crash system 144741 - RHEL4 U1: ICH7 Support patch 145424 - problems with ipsec from rhel3 to rhel4 146067 - [PATCH] Channel bonding driver configured in 802.3 ad mode causes kernel panic when shutdwon 146089 - 20050115 ptrace/kill and ptrace/dump race fixes 146703 - NLM (NFSv3) problems when mounting with "sec=krb5" 146797 - SCTP memory consumption and system freezes 146911 - Thread suspension via async signal fails on rhel4-rc2 147832 - oom-killer triggered during Red Hat Cert 150110 - chipset identifier for zx2 150151 - Lockd callbacks to NFS clients fail completely 151284 - mmap of file over NFS corrupts data 152101 - host panics when mounting nfs4 volumes 152102 - host loses connection to nfs server when the server is solaris 152557 - 20050117 Oopsable NFS locking 154221 - Thread exits siliently via __RESTORE_ALL exeception for iret 154639 - kernel thread current->mm dereference in grab_swap_token causes oops 154972 - unexplained SIGSEGV death in SIGSEGV signal handler 155283 - CAN-2005-0136 ptrace corner cases on ia64 155765 - oops on 2.6.9-5.0.5.ELsmp 156875 - libata - master supports lba48 but slave does not 157450 - CAN-2005-1263 Linux kernel ELF core dump privilege elevation

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2005-420.html

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-20 Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10037
 
Oval ID: oval:org.mitre.oval:def:10037
Title: Some futex functions in futex.c for Linux kernel 2.6.x perform get_user calls while holding the mmap_sem semaphore, which could allow local users to cause a deadlock condition in do_page_fault by triggering get_user faults while another thread is executing mmap or other functions.
Description: Some futex functions in futex.c for Linux kernel 2.6.x perform get_user calls while holding the mmap_sem semaphore, which could allow local users to cause a deadlock condition in do_page_fault by triggering get_user faults while another thread is executing mmap or other functions.
Family: unix Class: vulnerability
Reference(s): CVE-2005-0937
Version: 5
Platform(s): Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:10264
 
Oval ID: oval:org.mitre.oval:def:10264
Title: Raw character devices (raw.c) in the Linux kernel 2.6.x call the wrong function before passing an ioctl to the block device, which crosses security boundaries by making kernel address space accessible from user space, a similar vulnerability to CVE-2005-1589.
Description: Raw character devices (raw.c) in the Linux kernel 2.6.x call the wrong function before passing an ioctl to the block device, which crosses security boundaries by making kernel address space accessible from user space, a similar vulnerability to CVE-2005-1589.
Family: unix Class: vulnerability
Reference(s): CVE-2005-1264
Version: 5
Platform(s): Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:10909
 
Oval ID: oval:org.mitre.oval:def:10909
Title: The elf_core_dump function in binfmt_elf.c for Linux kernel 2.x.x to 2.2.27-rc2, 2.4.x to 2.4.31-pre1, and 2.6.x to 2.6.12-rc4 allows local users to execute arbitrary code via an ELF binary that, in certain conditions involving the create_elf_tables function, causes a negative length argument to pass a signed integer comparison, leading to a buffer overflow.
Description: The elf_core_dump function in binfmt_elf.c for Linux kernel 2.x.x to 2.2.27-rc2, 2.4.x to 2.4.31-pre1, and 2.6.x to 2.6.12-rc4 allows local users to execute arbitrary code via an ELF binary that, in certain conditions involving the create_elf_tables function, causes a negative length argument to pass a signed integer comparison, leading to a buffer overflow.
Family: unix Class: vulnerability
Reference(s): CVE-2005-1263
Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:1122
 
Oval ID: oval:org.mitre.oval:def:1122
Title: Linux Kernel elf_core_dump() Buffer Overflow
Description: The elf_core_dump function in binfmt_elf.c for Linux kernel 2.x.x to 2.2.27-rc2, 2.4.x to 2.4.31-pre1, and 2.6.x to 2.6.12-rc4 allows local users to execute arbitrary code via an ELF binary that, in certain conditions involving the create_elf_tables function, causes a negative length argument to pass a signed integer comparison, leading to a buffer overflow.
Family: unix Class: vulnerability
Reference(s): CVE-2005-1263
Version: 1
Platform(s): Red Hat Enterprise Linux 3
Product(s): Linux kernel
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11473
 
Oval ID: oval:org.mitre.oval:def:11473
Title: fs/exec.c in Linux 2.6, when one thread is tracing another thread that shares the same memory map, might allow local users to cause a denial of service (deadlock) by forcing a core dump when the traced thread is in the TASK_TRACED state.
Description: fs/exec.c in Linux 2.6, when one thread is tracing another thread that shares the same memory map, might allow local users to cause a denial of service (deadlock) by forcing a core dump when the traced thread is in the TASK_TRACED state.
Family: unix Class: vulnerability
Reference(s): CVE-2005-3107
Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11628
 
Oval ID: oval:org.mitre.oval:def:11628
Title: The Linux kernel before 2.6.11 on the Itanium IA64 platform has certain "ptrace corner cases" that allow local users to cause a denial of service (crash) via crafted syscalls, possibly related to MCA/INIT, a different vulnerability than CVE-2005-1761.
Description: The Linux kernel before 2.6.11 on the Itanium IA64 platform has certain "ptrace corner cases" that allow local users to cause a denial of service (crash) via crafted syscalls, possibly related to MCA/INIT, a different vulnerability than CVE-2005-1761.
Family: unix Class: vulnerability
Reference(s): CVE-2005-0136
Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11855
 
Oval ID: oval:org.mitre.oval:def:11855
Title: The directory-services functionality in the scheduler in CUPS 1.1.17 and 1.1.22 allows remote attackers to cause a denial of service (cupsd daemon outage or crash) via manipulations of the timing of CUPS browse packets, related to a "pointer use-after-delete flaw."
Description: Netfilter in Linux kernel 2.6.8.1 allows remote attackers to cause a denial of service (kernel crash) via crafted IP packet fragments.
Family: unix Class: vulnerability
Reference(s): CVE-2005-0209
Version: 5
Platform(s): Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Os 229

OpenVAS Exploits

Date Description
2009-10-10 Name : SLES9: Security update for kernel
File : nvt/sles9p5009598.nasl
2009-10-10 Name : SLES9: Security update for Linux kernel
File : nvt/sles9p5011171.nasl
2008-01-17 Name : Debian Security Advisory DSA 922-1 (kernel-source-2.4.27)
File : nvt/deb_922_1.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
19929 Linux Kernel Traced Thread Common Memory Map Local DoS

17235 Linux Kernel on Itanium Unspecified Auditing Code Local DoS

16609 Linux Kernel raw Device ioctl_by_bdev() Function Kernel Memory Corruption

The Linux Kernel contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered when input to the raw Device ioctl_by_bdev() function is not validated correctly. This flaw may lead to execution of arbitrary code with kernel level privileges and a loss of Integrity.
16424 Linux Kernel ELF Core Dump Privilege Escalation

15188 Linux Kernel futex Function Local DoS

14965 Linux Kernel Netfliter IP Packet Fragment DoS

Nessus® Vulnerability Scanner

Date Description
2006-10-14 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-922.nasl - Type : ACT_GATHER_INFO
2006-08-04 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2006-0437.nasl - Type : ACT_GATHER_INFO
2006-07-21 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2006-0437.nasl - Type : ACT_GATHER_INFO
2006-07-05 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2005-420.nasl - Type : ACT_GATHER_INFO
2006-07-05 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2005-366.nasl - Type : ACT_GATHER_INFO
2006-07-03 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2005-472.nasl - Type : ACT_GATHER_INFO
2006-07-03 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2005-663.nasl - Type : ACT_GATHER_INFO
2006-01-15 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-95-1.nasl - Type : ACT_GATHER_INFO
2006-01-15 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-199-1.nasl - Type : ACT_GATHER_INFO
2006-01-15 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-131-1.nasl - Type : ACT_GATHER_INFO
2006-01-15 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-110-1.nasl - Type : ACT_GATHER_INFO
2005-10-05 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2005-663.nasl - Type : ACT_GATHER_INFO
2005-08-30 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2005-529.nasl - Type : ACT_GATHER_INFO
2005-07-01 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2005-111.nasl - Type : ACT_GATHER_INFO
2005-07-01 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2005-110.nasl - Type : ACT_GATHER_INFO
2005-06-10 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2005-420.nasl - Type : ACT_GATHER_INFO
2005-06-10 Name : The remote host is missing a vendor-supplied security patch
File : suse_SA_2005_029.nasl - Type : ACT_GATHER_INFO
2005-05-28 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2005-472.nasl - Type : ACT_GATHER_INFO
2005-05-28 Name : The remote Fedora Core host is missing a security update.
File : fedora_2005-392.nasl - Type : ACT_GATHER_INFO
2005-04-19 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2005-366.nasl - Type : ACT_GATHER_INFO
2005-03-25 Name : The remote host is missing a vendor-supplied security patch
File : suse_SA_2005_018.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
Date Informations
2014-02-17 11:49:22
  • Multiple Updates
2013-05-11 12:23:03
  • Multiple Updates