The OpenNET Project
 
Search (keywords):  SOFT ARTICLES TIPS & TRICKS SECURITY
LINKS NEWS MAN DOCUMENTATION


[RHSA-2003:056-08] Updated kernel-utils packages fix setuid vulnerability


<< Previous INDEX Search src Set bookmark Go to bookmark Next >>
Date: Fri, 7 Feb 2003 13:16 -0500
From: [email protected]
To: [email protected], [email protected]
Subject: [RHSA-2003:056-08] Updated kernel-utils packages fix setuid vulnerability

---------------------------------------------------------------------
                   Red Hat, Inc. Red Hat Security Advisory

Synopsis:          Updated kernel-utils packages fix setuid vulnerability
Advisory ID:       RHSA-2003:056-08
Issue date:        2003-02-07
Updated on:        2003-02-07
Product:           Red Hat Linux
Ключевые слова: , , , , , , , , , uml, user, mode, linux,  (найти похожие документы)
Cross references:=20=20 Obsoletes:=20=20=20=20=20=20=20=20=20 CVE Names: CAN-2003-0019 --------------------------------------------------------------------- 1. Topic: An updated kernel-utils package is available that removes the setuid bits incorrectly assigned to the uml_net binary. 2. Relevant releases/architectures: Red Hat Linux 8.0 - i386 3. Problem description: The kernel-utils package contains several utilities that can be used to control the kernel or machine hardware. In Red Hat Linux 8.0 this package contains user mode linux (UML) utilities. The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was incorrectly shipped setuid root. This could allow local users to control certain network interfaces, add and remove arp entries and routes, and put interfaces in and out of promiscuous mode. All users of the kernel-utils package should update to these packages that contain a version of uml_net that is not setuid root.=20=20 Alternatively, as a work-around to this vulnerability issue the following command as root: chmod -s /usr/bin/uml_net Red Hat would like to thank Johnny Robertson for alerting us to this issue. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] Note that this update is also available via Red Hat Network. Many people find this to be an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. Note that you must select kernel-utils explicitly on default configurations of up2date. 5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info): 83685 - uml_net executable allows users to do bad things 6. RPMs required: Red Hat Linux 8.0: SRPMS: ftp://updates.redhat.com/8.0/en/os/SRPMS/kernel-utils-2.4-8.28.src.rpm i386: ftp://updates.redhat.com/8.0/en/os/i386/kernel-utils-2.4-8.28.i386.rpm 7. Verification: MD5 sum Package Name -------------------------------------------------------------------------- 6eac85b6523b2931db7d039b37b6a2e8 8.0/en/os/SRPMS/kernel-utils-2.4-8.28.src.= rpm 40a718a6037b55941a289fa6adc5f0f5 8.0/en/os/i386/kernel-utils-2.4-8.28.i386.= rpm These packages are GPG signed by Red Hat, Inc. for security. Our key is available at http://www.redhat.com/about/contact/pgpkey.html You can verify each package with the following command: =20=20=20=20 rpm --checksig -v <filename> If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: =20=20=20=20 md5sum <filename> 8. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCAN-2003-0019 9. Contact: The Red Hat security contact is <[email protected]>. More contact details at http://www.redhat.com/solutions/security/news/contact.html Copyright 2003 Red Hat, Inc.

<< Previous INDEX Search src Set bookmark Go to bookmark Next >>



Партнёры:
PostgresPro
Inferno Solutions
Hosting by Hoster.ru
Хостинг:

Закладки на сайте
Проследить за страницей
Created 1996-2024 by Maxim Chirkov
Добавить, Поддержать, Вебмастеру