Synopsis: Updated 2.4 kernel fixes privilege escalation
Advisory ID: RHSA-2003:389-01
Issue date: 2003-12-01
Updated on: 2003-12-01
Product: Red Hat Enterprise Linux
Keywords: privesc
Cross references:
Obsoletes: RHSA-2003:239
CVE Names:
CAN-2003-0961
- ---------------------------------------------------------------------
1. Topic:
Updated kernel packages are now available that fix a security
vulnerability allowing local users to gain root privileges.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - athlon, i386, i686
Red Hat Enterprise Linux ES version 2.1 - athlon, i386, i686
Red Hat Enterprise Linux WS version 2.1 - athlon, i386, i686
3. Problem description:
The Linux kernel handles the basic functions of the operating system.
A flaw in bounds checking in the do_brk() function in the Linux kernel
versions 2.4.22 and previous can allow a local attacker to gain root
privileges. This issue is known to be exploitable; an exploit has been
seen in the wild that takes advantage of this vulnerability. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2003-0961 to this issue.
All users of Red Hat Enterprise Linux 2.1 are advised to upgrade to these
errata packages, which contain a backported security patch that corrects
this vulnerability.
Users of Red Hat Enterprise Linux 3 should upgrade to the kernel packages
provided by RHBA-2003:308 (released on 30 October 2003), which already
contained a patch correcting this issue.
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
To use Red Hat Network to upgrade the kernel, launch the Red Hat Update
Agent with the following command:
up2date
This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system. Note that you need to select the
kernel explicitly if you are using the default configuration of up2date.
To install kernel packages manually, use "rpm -ivh <package>" and
modify system settings to boot the kernel you have installed. To
do this, edit /boot/grub/grub.conf and change the default entry to
"default=0" (or, if you have chosen to use LILO as your boot loader,
edit /etc/lilo.conf and run lilo)
Do not use "rpm -Uvh" as that will remove your running kernel binaries
from your system. You may use "rpm -e" to remove old kernels after
determining that the new kernel functions properly on your system.
5. Bug IDs fixed (
http://bugzilla.redhat.com/bugzilla for more info):
111240 -
CAN-2003-0961 local privilege escalation via do_brk()
6. RPMs required:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/kernel-2.4.9-e.30.src.rpm
athlon:
Available from Red Hat Network: kernel-2.4.9-e.30.athlon.rpm
Available from Red Hat Network: kernel-smp-2.4.9-e.30.athlon.rpm
i386:
Available from Red Hat Network: kernel-source-2.4.9-e.30.i386.rpm
Available from Red Hat Network: kernel-doc-2.4.9-e.30.i386.rpm
Available from Red Hat Network: kernel-headers-2.4.9-e.30.i386.rpm
Available from Red Hat Network: kernel-BOOT-2.4.9-e.30.i386.rpm
i686:
Available from Red Hat Network: kernel-2.4.9-e.30.i686.rpm
Available from Red Hat Network: kernel-smp-2.4.9-e.30.i686.rpm
Available from Red Hat Network: kernel-summit-2.4.9-e.30.i686.rpm
Available from Red Hat Network: kernel-enterprise-2.4.9-e.30.i686.rpm
Available from Red Hat Network: kernel-debug-2.4.9-e.30.i686.rpm
Red Hat Enterprise Linux ES version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/kernel-2.4.9-e.30.src.rpm
athlon:
Available from Red Hat Network: kernel-2.4.9-e.30.athlon.rpm
Available from Red Hat Network: kernel-smp-2.4.9-e.30.athlon.rpm
i386:
Available from Red Hat Network: kernel-source-2.4.9-e.30.i386.rpm
Available from Red Hat Network: kernel-doc-2.4.9-e.30.i386.rpm
Available from Red Hat Network: kernel-headers-2.4.9-e.30.i386.rpm
Available from Red Hat Network: kernel-BOOT-2.4.9-e.30.i386.rpm
i686:
Available from Red Hat Network: kernel-2.4.9-e.30.i686.rpm
Available from Red Hat Network: kernel-smp-2.4.9-e.30.i686.rpm
Available from Red Hat Network: kernel-debug-2.4.9-e.30.i686.rpm
Red Hat Enterprise Linux WS version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/kernel-2.4.9-e.30.src.rpm
athlon:
Available from Red Hat Network: kernel-2.4.9-e.30.athlon.rpm
Available from Red Hat Network: kernel-smp-2.4.9-e.30.athlon.rpm
i386:
Available from Red Hat Network: kernel-source-2.4.9-e.30.i386.rpm
Available from Red Hat Network: kernel-doc-2.4.9-e.30.i386.rpm
Available from Red Hat Network: kernel-headers-2.4.9-e.30.i386.rpm
Available from Red Hat Network: kernel-BOOT-2.4.9-e.30.i386.rpm
i686:
Available from Red Hat Network: kernel-2.4.9-e.30.i686.rpm
Available from Red Hat Network: kernel-smp-2.4.9-e.30.i686.rpm
Available from Red Hat Network: kernel-enterprise-2.4.9-e.30.i686.rpm
Available from Red Hat Network: kernel-debug-2.4.9-e.30.i686.rpm
7. Verification:
MD5 sum Package Name
- --------------------------------------------------------------------------
b0bb52adc438e7207f28df4b493de7be 2.1AS/en/os/SRPMS/kernel-2.4.9-e.30.src.rpm
c6542ef9f02de56de1d1220422c35909 2.1AS/en/os/athlon/kernel-2.4.9-e.30.athlon.rpm
9285eb5b7d956f6a5e764df0fe36c64a 2.1AS/en/os/athlon/kernel-smp-2.4.9-e.30.athlon.rpm
dc5ec3f444c8876b523b09f5d6ee1779 2.1AS/en/os/i386/kernel-BOOT-2.4.9-e.30.i386.rpm
28906601062f7c01fd8d5ec453aac847 2.1AS/en/os/i386/kernel-doc-2.4.9-e.30.i386.rpm
41888a0d8aea1efce885c04ad748f78e 2.1AS/en/os/i386/kernel-headers-2.4.9-e.30.i386.rpm
fd87169b0aa4f1f148ffe33850e514bc 2.1AS/en/os/i386/kernel-source-2.4.9-e.30.i386.rpm
218f9542d5c7f8893e4275038f02c55a 2.1AS/en/os/i686/kernel-2.4.9-e.30.i686.rpm
986ebc83a1dfe1353981c77295a289b3 2.1AS/en/os/i686/kernel-debug-2.4.9-e.30.i686.rpm
7bf0c126d4a331fd1f0f5312631d0802 2.1AS/en/os/i686/kernel-enterprise-2.4.9-e.30.i686.rpm
67b7a9d0ef037afb55a71258d85b476a 2.1AS/en/os/i686/kernel-smp-2.4.9-e.30.i686.rpm
b9d7aec22835535ebbc39215f0a46480 2.1AS/en/os/i686/kernel-summit-2.4.9-e.30.i686.rpm
b0bb52adc438e7207f28df4b493de7be 2.1ES/en/os/SRPMS/kernel-2.4.9-e.30.src.rpm
c6542ef9f02de56de1d1220422c35909 2.1ES/en/os/athlon/kernel-2.4.9-e.30.athlon.rpm
9285eb5b7d956f6a5e764df0fe36c64a 2.1ES/en/os/athlon/kernel-smp-2.4.9-e.30.athlon.rpm
dc5ec3f444c8876b523b09f5d6ee1779 2.1ES/en/os/i386/kernel-BOOT-2.4.9-e.30.i386.rpm
28906601062f7c01fd8d5ec453aac847 2.1ES/en/os/i386/kernel-doc-2.4.9-e.30.i386.rpm
41888a0d8aea1efce885c04ad748f78e 2.1ES/en/os/i386/kernel-headers-2.4.9-e.30.i386.rpm
fd87169b0aa4f1f148ffe33850e514bc 2.1ES/en/os/i386/kernel-source-2.4.9-e.30.i386.rpm
218f9542d5c7f8893e4275038f02c55a 2.1ES/en/os/i686/kernel-2.4.9-e.30.i686.rpm
986ebc83a1dfe1353981c77295a289b3 2.1ES/en/os/i686/kernel-debug-2.4.9-e.30.i686.rpm
67b7a9d0ef037afb55a71258d85b476a 2.1ES/en/os/i686/kernel-smp-2.4.9-e.30.i686.rpm
b0bb52adc438e7207f28df4b493de7be 2.1WS/en/os/SRPMS/kernel-2.4.9-e.30.src.rpm
c6542ef9f02de56de1d1220422c35909 2.1WS/en/os/athlon/kernel-2.4.9-e.30.athlon.rpm
9285eb5b7d956f6a5e764df0fe36c64a 2.1WS/en/os/athlon/kernel-smp-2.4.9-e.30.athlon.rpm
dc5ec3f444c8876b523b09f5d6ee1779 2.1WS/en/os/i386/kernel-BOOT-2.4.9-e.30.i386.rpm
28906601062f7c01fd8d5ec453aac847 2.1WS/en/os/i386/kernel-doc-2.4.9-e.30.i386.rpm
41888a0d8aea1efce885c04ad748f78e 2.1WS/en/os/i386/kernel-headers-2.4.9-e.30.i386.rpm
fd87169b0aa4f1f148ffe33850e514bc 2.1WS/en/os/i386/kernel-source-2.4.9-e.30.i386.rpm
218f9542d5c7f8893e4275038f02c55a 2.1WS/en/os/i686/kernel-2.4.9-e.30.i686.rpm
986ebc83a1dfe1353981c77295a289b3 2.1WS/en/os/i686/kernel-debug-2.4.9-e.30.i686.rpm
7bf0c126d4a331fd1f0f5312631d0802 2.1WS/en/os/i686/kernel-enterprise-2.4.9-e.30.i686.rpm
67b7a9d0ef037afb55a71258d85b476a 2.1WS/en/os/i686/kernel-smp-2.4.9-e.30.i686.rpm
These packages are GPG signed by Red Hat for security. Our key is
available from https://www.redhat.com/security/keys.html
You can verify each package with the following command:
rpm --checksig -v <filename>
If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
md5sum <filename>
8. References:
http://rhn.redhat.com/errata/RHBA-2003-308.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=
CAN-2003-0961
9. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/solutions/security/news/contact.html
Copyright 2003 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
iD8DBQE/y5R1XlSAg2UNWIIRAg/jAKC0/eXf76BuERbMl3fIaRDDBVbyTgCdHQhJ
rY90hA/dcAGHjYw9SEA/VCA=
=t8v0
-----END PGP SIGNATURE-----
