MDKSA-2004:066 - Updated kernel packages fix multiple vulnerabilities
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandrakelinux Security Update Advisory
_______________________________________________________________________
Package name: kernel
Advisory ID: MDKSA-2004:066
Date: July 6th, 2004
Affected versions: 10.0, 9.1, 9.2, Corporate Server 2.1,
Multi Network Firewall 8.2
______________________________________________________________________
Problem Description:
A number of vulnerabilities were discovered in the Linux kernel that
are corrected with this update:
Multiple vulnerabilities were found by the Sparse source checker that
could allow local users to elevate privileges or gain access to
kernel memory (CAN-2004-0495).
Missing Discretionary Access Controls (DAC) checks in the chown(2)
system call could allow an attacker with a local account to change the
group ownership of arbitrary files, which could lead to root privileges
on affected systems (CAN-2004-0497).
An information leak vulnerability that affects only ia64 systems was
fixed (CAN-2004-0565).
Insecure permissions on /proc/scsi/qla2300/HbaApiNode could allow a
local user to cause a DoS on the system; this only affects
Mandrakelinux 9.2 and below (CAN-2004-0587).
A vulnerability that could crash the kernel has also been fixed. This
crash, however, can only be exploited via root (in br_if.c).
The provided packages are patched to fix these vulnerabilities. All
users are encouraged to upgrade to these updated kernels.
To update your kernel, please follow the directions located at:
http://www.mandrakesoft.com/security/kernelupdate
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0495
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0497
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0565
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0587
______________________________________________________________________
Updated Packages:
Mandrakelinux 10.0:
2b4f032eac98401d07eafda98074f9af 10.0/RPMS/kernel-2.4.25.7mdk-1-1mdk.i586.rpm
95cb29d40450ece7ce1d2f6f4ef7665c 10.0/RPMS/kernel-2.6.3.15mdk-1-1mdk.i586.rpm
3d192857073c56d6a127be2d8e41e101
10.0/RPMS/kernel-enterprise-2.4.25.7mdk-1-1mdk.i586.rpm
d09e7f019ad827899427999cfaa671b3
10.0/RPMS/kernel-enterprise-2.6.3.15mdk-1-1mdk.i586.rpm
d4c1e1f9dbf1adeafac3e552117d315a
10.0/RPMS/kernel-i686-up-4GB-2.4.25.7mdk-1-1mdk.i586.rpm
4ffb83dfe7137807ea70bcd507efa3db
10.0/RPMS/kernel-i686-up-4GB-2.6.3.15mdk-1-1mdk.i586.rpm
f670496874b602901f7b13168ef57d5b
10.0/RPMS/kernel-p3-smp-64GB-2.4.25.7mdk-1-1mdk.i586.rpm
a9ae70d3ebdc1619005c923349d8ef47
10.0/RPMS/kernel-p3-smp-64GB-2.6.3.15mdk-1-1mdk.i586.rpm
0f26d7b81bcf494daf8b6d1c504ff2f9
10.0/RPMS/kernel-secure-2.6.3.15mdk-1-1mdk.i586.rpm
f96ffa47105a59539718c16e57b486b4
10.0/RPMS/kernel-smp-2.4.25.7mdk-1-1mdk.i586.rpm
5a7c46d2b64b5b2ae46afd8cb4bb1693
10.0/RPMS/kernel-smp-2.6.3.15mdk-1-1mdk.i586.rpm
6258f525a125218c1dc6f9999635128b 10.0/RPMS/kernel-source-2.4.25-7mdk.i586.rpm
c38b512b3718af69573eade51502594a 10.0/RPMS/kernel-source-2.6.3-15mdk.i586.rpm
27bf35e93c0aec84dea7762de782aa29
10.0/RPMS/kernel-source-stripped-2.6.3-15mdk.i586.rpm
7ed66f57e1cbe739ffeb7f49bb11cd9d 10.0/SRPMS/kernel-2.4.25.7mdk-1-1mdk.src.rpm
e9a9b123ad012193b898502061ce9142 10.0/SRPMS/kernel-2.6.3.15mdk-1-1mdk.src.rpm
Mandrakelinux 10.0/AMD64:
f11b7e974278c65ffa8fca17dd8aa6ab
amd64/10.0/RPMS/kernel-2.4.25.7mdk-1-1mdk.amd64.rpm
a3766fba4e3585b58b225a1ad4074c15
amd64/10.0/RPMS/kernel-2.6.3.15mdk-1-1mdk.amd64.rpm
1bd06ca53e533df3ebdc7f50f8624d2f
amd64/10.0/RPMS/kernel-secure-2.6.3.15mdk-1-1mdk.amd64.rpm
51eafefe2c478eea424b71b8cf3d0a16
amd64/10.0/RPMS/kernel-smp-2.4.25.7mdk-1-1mdk.amd64.rpm
9feef2ad875f587c147db614c84fbb63
amd64/10.0/RPMS/kernel-smp-2.6.3.15mdk-1-1mdk.amd64.rpm
d5c4b184c1b532c06779fa86de66b33f
amd64/10.0/RPMS/kernel-source-2.4.25-7mdk.amd64.rpm
ba5c1bc15a6add38b3ec6546bfedc05a
amd64/10.0/RPMS/kernel-source-2.6.3-15mdk.amd64.rpm
a37be2d5adfa68591f562c6ff21944ff
amd64/10.0/RPMS/kernel-source-stripped-2.6.3-15mdk.amd64.rpm
7ed66f57e1cbe739ffeb7f49bb11cd9d
amd64/10.0/SRPMS/kernel-2.4.25.7mdk-1-1mdk.src.rpm
e9a9b123ad012193b898502061ce9142
amd64/10.0/SRPMS/kernel-2.6.3.15mdk-1-1mdk.src.rpm
Corporate Server 2.1:
83356d3d59fc9c3eda2a6b4067bdf2fd
corporate/2.1/RPMS/kernel-2.4.19.43mdk-1-1mdk.i586.rpm
121f35f57e2ceeec57ab2d0980cbc28d
corporate/2.1/RPMS/kernel-enterprise-2.4.19.43mdk-1-1mdk.i586.rpm
dcceb4bff676f680eab0df27c8f26b28
corporate/2.1/RPMS/kernel-secure-2.4.19.43mdk-1-1mdk.i586.rpm
e437582a1169bed3055453a3be3bda96
corporate/2.1/RPMS/kernel-smp-2.4.19.43mdk-1-1mdk.i586.rpm
6da195350aa9d3a4c444b22a2b6e898c
corporate/2.1/RPMS/kernel-source-2.4.19-43mdk.i586.rpm
df2ed2545e0ffd48b948f83e100f5c3f
corporate/2.1/SRPMS/kernel-2.4.19.43mdk-1-1mdk.src.rpm
Corporate Server 2.1/x86_64:
7d08956c3333a19563563204c11cc6de
x86_64/corporate/2.1/RPMS/kernel-2.4.19.43mdk-1-1mdk.x86_64.rpm
dd1dd8e068f4427f2aee3ae85c3ab704
x86_64/corporate/2.1/RPMS/kernel-secure-2.4.19.43mdk-1-1mdk.x86_64.rpm
5b5d1d7f5f6ee10fc1111db09a77aab7
x86_64/corporate/2.1/RPMS/kernel-smp-2.4.19.43mdk-1-1mdk.x86_64.rpm
b29c1cbdae79046d761d02d019bb2c2e
x86_64/corporate/2.1/RPMS/kernel-source-2.4.19-43mdk.x86_64.rpm
df2ed2545e0ffd48b948f83e100f5c3f
x86_64/corporate/2.1/SRPMS/kernel-2.4.19.43mdk-1-1mdk.src.rpm
Mandrakelinux 9.1:
4d534dd6b769ae19b8588998c91bf1d4
9.1/RPMS/kernel-2.4.21.0.32mdk-1-1mdk.i586.rpm
d66495f924e23f9b94b6e183d9666864
9.1/RPMS/kernel-enterprise-2.4.21.0.32mdk-1-1mdk.i586.rpm
ad71a4097e345b5f381256ca57856d77
9.1/RPMS/kernel-secure-2.4.21.0.32mdk-1-1mdk.i586.rpm
11f0dd9e897ed0af0132c61a6c24adbf
9.1/RPMS/kernel-smp-2.4.21.0.32mdk-1-1mdk.i586.rpm
04304a3ef3bbc65992beb83ac7c9d04c
9.1/RPMS/kernel-source-2.4.21-0.32mdk.i586.rpm
4de812dfb6644135aa75aa914498094b
9.1/SRPMS/kernel-2.4.21.0.32mdk-1-1mdk.src.rpm
Mandrakelinux 9.1/PPC:
fc9534d9142992e56a075ee243b7f189
ppc/9.1/RPMS/kernel-2.4.21.0.32mdk-1-1mdk.ppc.rpm
f26552364a069eb4385363b39d555d83
ppc/9.1/RPMS/kernel-enterprise-2.4.21.0.32mdk-1-1mdk.ppc.rpm
6db0dc121bbfa32ffe91ae6500f664bb
ppc/9.1/RPMS/kernel-smp-2.4.21.0.32mdk-1-1mdk.ppc.rpm
5362c0d73a661b4dabad829e4ce77d44
ppc/9.1/RPMS/kernel-source-2.4.21-0.32mdk.ppc.rpm
4de812dfb6644135aa75aa914498094b
ppc/9.1/SRPMS/kernel-2.4.21.0.32mdk-1-1mdk.src.rpm
Mandrakelinux 9.2:
f7237eed138721f255a8ece6d667072b 9.2/RPMS/kernel-2.4.22.36mdk-1-1mdk.i586.rpm
84b143307427d5910ed36b4364ac7c75
9.2/RPMS/kernel-enterprise-2.4.22.36mdk-1-1mdk.i586.rpm
5e9a07e3c94387708e5c673191d50328
9.2/RPMS/kernel-i686-up-4GB-2.4.22.36mdk-1-1mdk.i586.rpm
527573844c4b7b5379729d7355be5489
9.2/RPMS/kernel-p3-smp-64GB-2.4.22.36mdk-1-1mdk.i586.rpm
529040ea4a1bfd1eeffff652afd0bcbd
9.2/RPMS/kernel-secure-2.4.22.36mdk-1-1mdk.i586.rpm
4fc382e9c81d31ee9b6ae3ee1797f1b8
9.2/RPMS/kernel-smp-2.4.22.36mdk-1-1mdk.i586.rpm
5562b47d703e33d5dac8160e2769e40b 9.2/RPMS/kernel-source-2.4.22-36mdk.i586.rpm
93c3db190867658405c95a67474a45d0 9.2/SRPMS/kernel-2.4.22.36mdk-1-1mdk.src.rpm
Mandrakelinux 9.2/AMD64:
504cb78e82e612aac5f6c2edc339bf60
amd64/9.2/RPMS/kernel-2.4.22.36mdk-1-1mdk.amd64.rpm
067be357da0e10bc3e1ef810a48e14d1
amd64/9.2/RPMS/kernel-secure-2.4.22.36mdk-1-1mdk.amd64.rpm
e002776adfe0060e76939dce3739dea4
amd64/9.2/RPMS/kernel-smp-2.4.22.36mdk-1-1mdk.amd64.rpm
196c2f192a9096dae46be9b17b018d72
amd64/9.2/RPMS/kernel-source-2.4.22-36mdk.amd64.rpm
93c3db190867658405c95a67474a45d0
amd64/9.2/SRPMS/kernel-2.4.22.36mdk-1-1mdk.src.rpm
Multi Network Firewall 8.2:
aa94e49f2e6cbf59097fd469ccf5d8b9
mnf8.2/RPMS/kernel-secure-2.4.19.43mdk-1-1mdk.i586.rpm
df2ed2545e0ffd48b948f83e100f5c3f
mnf8.2/SRPMS/kernel-2.4.19.43mdk-1-1mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandrakesoft for security. You can obtain
the GPG public key of the Mandrakelinux Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandrakelinux at:
http://www.mandrakesoft.com/security/advisories
If you want to report vulnerabilities, please contact
security_linux-mandrake.com
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Linux Mandrake Security Team
<security linux-mandrake.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
iD8DBQFA63vAmqjQ0CJFipgRAv1VAKDUo1Xd9rHBkhXzs5f3UI6I2NCSuACgtHrO
D8izAYgGqpW6VGg861hr6EY=
=F3b2
-----END PGP SIGNATURE-----