Advisories: April 11, 2005

Fedora Core

Fedora Update Notification
FEDORA-2005-313
2005-04-11

Product : Fedora Core 3
Name : kernel
Version : 2.6.11
Release : 1.14_FC3
Summary : The Linux kernel (the core of the Linux operating
system)

Description :
The kernel package contains the Linux kernel (vmlinuz), the core of
any Linux operating system. The kernel handles the basic functions
of the operating system: memory allocation, process allocation,
device input and output, etc.

This update rebases the kernel to the latest upstream stable
release, which fixes a number of security issues. Notably: –
CAN-2005-0210 : dst leak
– CAN-2005-0384 : ppp dos
– CAN-2005-0531 : Sign handling issues.
– CAN-2005-0400 : EXT2 information leak.
– CAN-2005-0449 : Remote oops.
– CAN-2005-0736 : Epoll overflow
– CAN-2005-0749 : ELF loader may kfree wrong memory.
– CAN-2005-0750 : Missing range checking in bluetooth
– CAN-2005-0767 : drm race in radeon
– CAN-2005-0815 : Corrupt isofs images could cause oops

Additionally, a large number of improvements have come from the
2.6.10 -> 2.6.11 transition.

This update requires you are running the latest udev package,
and also (if you are using SELinux) the latest selinux policy
packages.

Thu Apr 7 2005 Dave Jones <davej@redhat.com>
- Update to 2.6.11.7
- Set CFQ as default elevator again.
Tue Apr 5 2005 Dave Jones <davej@redhat.com>
- Disable slab debug.
- Re-add the pwc driver. (#152593)
Wed Mar 30 2005 Dave Jones <davej@redhat.com>
- x86_64: Only free PMDs and PUDs after other CPUs have been
  flushed
Sat Mar 26 2005 Dave Jones <davej@redhat.com>
- Update to 2.6.11.6
Tue Mar 22 2005 Dave Jones <davej@redhat.com>
- Fix up several calls to memset with swapped arguments.
Sat Mar 19 2005 Dave Jones <davej@redhat.com>
- Update to 2.6.11.5
Fri Mar 18 2005 Dave Jones <davej@redhat.com>
- Kjournald oops race. (#146344)
Tue Mar 15 2005 Dave Jones <davej@redhat.com>
- Update to 2.6.11.4
Thu Mar 10 2005 Dave Jones <davej@redhat.com>
- Update to 2.6.11.2
- Reenable advansys driver for x86
Fri Mar 4 2005 Dave Jones <davej@redhat.com>
- Fix up ACPI vs keyboard controller problem.
- Fix up Altivec usage on PPC/PPC64.
Fri Mar 4 2005 Dave Jones <davej@redhat.com>
- Finger the programs that try to read from /dev/mem.
- Improve spinlock debugging a little.
Wed Mar 2 2005 Dave Jones <davej@redhat.com>
- 2.6.11

This update can be downloaded from:

http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/

d0b678c185daabc58241bc43d785cdfd
SRPMS/kernel-2.6.11-1.14_FC3.src.rpm
6fa5527e6cd9bda5672b8c994d4e10b8
x86_64/kernel-2.6.11-1.14_FC3.x86_64.rpm
1f2742b6a3c0ca60087fb16adb9dc624
x86_64/kernel-smp-2.6.11-1.14_FC3.x86_64.rpm
ae6e7f41cd578e7e559a64a2c380351d
x86_64/debug/kernel-debuginfo-2.6.11-1.14_FC3.x86_64.rpm
e26c7fe37faba562b59ad303a3206a9c
x86_64/kernel-doc-2.6.11-1.14_FC3.noarch.rpm
b44d799286b3d66a6e2f736c95c0ae87
i386/kernel-2.6.11-1.14_FC3.i586.rpm
55bb6d57855699ddbbd458a065869bba
i386/kernel-smp-2.6.11-1.14_FC3.i586.rpm
14263ebfb286ef9db0a198dd56a23dcb
i386/debug/kernel-debuginfo-2.6.11-1.14_FC3.i586.rpm
b47066757d55cb37756d1b70541bc149
i386/kernel-2.6.11-1.14_FC3.i686.rpm
335f1a54ecb63adca6789bbe707fa056
i386/kernel-smp-2.6.11-1.14_FC3.i686.rpm
8bc3daa419ea629bcf6f73f884d4f997
i386/debug/kernel-debuginfo-2.6.11-1.14_FC3.i686.rpm
e26c7fe37faba562b59ad303a3206a9c
i386/kernel-doc-2.6.11-1.14_FC3.noarch.rpm

This update can also be installed with the Update Agent; you can
launch the Update Agent with the ‘up2date’ command.

Gentoo Linux

Gentoo Linux Security Advisory [UPDATE] GLSA 200503-35:02

http://security.gentoo.org/

Severity: High
Title: Smarty: Template vulnerability
Date: March 30, 2005
Updated: April 09, 2005
Bugs: #86488
ID: 200503-35:02

Update

New ways of bypassing Smarty’s “Template security” were found
and fixed in Smarty. Users making use of that feature are
encouraged to upgrade to version 2.6.9.

The updated sections appear below.

Affected packages

     Package         /  Vulnerable  /                       Unaffected

  1  dev-php/smarty       < 2.6.9                             >= 2.6.9

Description

A vulnerability has been discovered within the regex_replace
modifier of the Smarty templates when allowing access to untrusted
users. Furthermore, it was possible to call functions from {if}
statements and {math} functions.

Resolution

All Smarty users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=dev-php/smarty-2.6.9"

Availability

This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200503-35.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.

License

The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0

Gentoo Linux Security Advisory GLSA 200504-08

http://security.gentoo.org/

Severity: Low
Title: phpMyAdmin: Cross-site scripting vulnerability
Date: April 11, 2005
Bugs: #87952
ID: 200504-08

Synopsis

phpMyAdmin is vulnerable to a cross-site scripting attack.

Background

phpMyAdmin is a tool written in PHP intended to handle the
administration of MySQL databases from a web-browser.

Affected packages

     Package            /   Vulnerable   /                  Unaffected

  1  dev-db/phpmyadmin      < 2.6.2_rc1                   >= 2.6.2_rc1

Description

Oriol Torrent Santiago has discovered that phpMyAdmin fails to
validate input to the “convcharset” variable, rendering it
vulnerable to cross-site scripting attacks.

Impact

By sending a specially-crafted request, an attacker can inject
and execute malicious script code, potentially compromising the
victim’s browser.

Workaround

There is no known workaround at this time.

Resolution

All phpMyAdmin users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=dev-db/phpmyadmin-2.6.2_rc1"

References

[ 1 ] PMASA-2005-3

http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-3

Availability

This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200504-08.xml

Concerns?

License

The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0

Ubuntu Linux

Ubuntu Security Notice USN-110-1 April 11, 2005
linux-source-2.6.8.1 vulnerabilities
CAN-2005-0867, CAN-2005-0937

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty Warthog)

The following packages are affected:

linux-image-2.6.8.1-5-386
linux-image-2.6.8.1-5-686
linux-image-2.6.8.1-5-686-smp
linux-image-2.6.8.1-5-amd64-generic
linux-image-2.6.8.1-5-amd64-k8
linux-image-2.6.8.1-5-amd64-k8-smp
linux-image-2.6.8.1-5-amd64-xeon
linux-image-2.6.8.1-5-k7
linux-image-2.6.8.1-5-k7-smp
linux-image-2.6.8.1-5-power3
linux-image-2.6.8.1-5-power3-smp
linux-image-2.6.8.1-5-power4
linux-image-2.6.8.1-5-power4-smp
linux-image-2.6.8.1-5-powerpc
linux-image-2.6.8.1-5-powerpc-smp
linux-patch-debian-2.6.8.1
linux-source-2.6.8.1

The problem can be corrected by upgrading the affected package
to version 2.6.8.1-16.14. You need to reboot the computer after
doing a standard system upgrade to effect the necessary
changes.

Details follow:

Alexander Nyberg discovered an integer overflow in the
sysfs_write_file() function. A local attacker could exploit this to
crash the kernel or possibly even execute arbitrary code with root
privileges by writing to an user-writable file in /sys under
certain low-memory conditions. However, there are very few cases
where a user-writeable sysfs file actually exists.
(CAN-2005-0867)

Olof Johansson discovered a Denial of Service vulnerability in
the futex functions, which provide semaphores for exclusive locking
of resources. A local attacker could possibly exploit this to cause
a kernel deadlock. (CAN-2005-0937)

In addition this update fixes two race conditions in the ext3
and jfs file system drivers, which could lead to a kernel crash
under certain (unusual) conditions. However, these cannot easily be
triggered by users, thus they are not security sensitive. (http://linux.bkbits.net:8080/linux-2.5/gnupatch@4248d87aETPJX79hVXl4owAUwu2SmQ,

http://linux.bkbits.net:8080/linux-2.6/cset@1.2181.46.242)

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/l/linux-source-2.6.8.1/linux-source-2.6.8.1_2.6.8.1-16.14.diff.gz

Size/MD5: 3144256 0a80b5605fa16e50adf234c833e6bb68

http://security.ubuntu.com/ubuntu/pool/main/l/linux-source-2.6.8.1/linux-source-2.6.8.1_2.6.8.1-16.14.dsc

Size/MD5: 2121 6ad2c18460ca29e1a55106beca3c9c14

http://security.ubuntu.com/ubuntu/pool/main/l/linux-source-2.6.8.1/linux-source-2.6.8.1_2.6.8.1.orig.tar.gz

Size/MD5: 44728688 79730a3ad4773ba65fab65515369df84

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/l/linux-source-2.6.8.1/linux-doc-2.6.8.1_2.6.8.1-16.14_all.deb

Size/MD5: 6153992 3e521be7b01ba6eab67a17f81185c822

http://security.ubuntu.com/ubuntu/pool/main/l/linux-source-2.6.8.1/linux-patch-debian-2.6.8.1_2.6.8.1-16.14_all.deb

Size/MD5: 1500544 b243f0a773dfe2f62eb382ca4d89b9db

http://security.ubuntu.com/ubuntu/pool/main/l/linux-source-2.6.8.1/linux-source-2.6.8.1_2.6.8.1-16.14_all.deb

Size/MD5: 36720790 0b958d6a7e89602089cb8581f1f73032

http://security.ubuntu.com/ubuntu/pool/main/l/linux-source-2.6.8.1/linux-tree-2.6.8.1_2.6.8.1-16.14_all.deb

Size/MD5: 308474 a03542000c2858203be3d89997c4e45c

amd64 architecture (Athlon64, Opteron, EM64T Xeon)

http://security.ubuntu.com/ubuntu/pool/main/l/linux-source-2.6.8.1/linux-headers-2.6.8.1-5-amd64-generic_2.6.8.1-16.14_amd64.deb

Size/MD5: 247974 bfbbe4b32ead1dde7a8561665cc5999b

http://security.ubuntu.com/ubuntu/pool/main/l/linux-source-2.6.8.1/linux-headers-2.6.8.1-5-amd64-k8-smp_2.6.8.1-16.14_amd64.deb

Size/MD5: 243990 3271780d4b3456de3338dffbaca1eb20

http://security.ubuntu.com/ubuntu/pool/main/l/linux-source-2.6.8.1/linux-headers-2.6.8.1-5-amd64-k8_2.6.8.1-16.14_amd64.deb

Size/MD5: 247200 e6abe01f3199ec0f27eda709ce002df3

http://security.ubuntu.com/ubuntu/pool/main/l/linux-source-2.6.8.1/linux-headers-2.6.8.1-5-amd64-xeon_2.6.8.1-16.14_amd64.deb

Size/MD5: 242362 ed9000e5985839c740e09e0c713ca350

http://security.ubuntu.com/ubuntu/pool/main/l/linux-source-2.6.8.1/linux-headers-2.6.8.1-5_2.6.8.1-16.14_amd64.deb

Size/MD5: 3179516 b369ff9b759448424a89332ecffd3b9b

http://security.ubuntu.com/ubuntu/pool/main/l/linux-source-2.6.8.1/linux-image-2.6.8.1-5-amd64-generic_2.6.8.1-16.14_amd64.deb

Size/MD5: 14352682 2770849b44244c93be0d3db4cffc89bf

http://security.ubuntu.com/ubuntu/pool/main/l/linux-source-2.6.8.1/linux-image-2.6.8.1-5-amd64-k8-smp_2.6.8.1-16.14_amd64.deb

Size/MD5: 14829082 0e724f14e03b9f1eb1423b38a1ee1dae

http://security.ubuntu.com/ubuntu/pool/main/l/linux-source-2.6.8.1/linu=
x-image-2.6.8.1-5-amd64-k8_2.6.8.1-16.14_amd64.deb

Size/MD5: 14862760 b725acf4facfcf8d3c824a84dbfe41c4

http://security.ubuntu.com/ubuntu/pool/main/l/linux-source-2.6.8.1/linu=
x-image-2.6.8.1-5-amd64-xeon_2.6.8.1-16.14_amd64.deb

Size/MD5: 14686348 7ff1ce90107b9bc2e3e8f743e2115347

i386 architecture (x86 compatible Intel/AMD)

http://security.ubuntu.com/ubuntu/pool/main/l/linux-source-2.6.8.1/linux-headers-2.6.8.1-5-386_2.6.8.1-16.14_i386.deb

Size/MD5: 277370 4d79f89950fffb6712304f1ace572f3e

http://security.ubuntu.com/ubuntu/pool/main/l/linux-source-2.6.8.1/linux-headers-2.6.8.1-5-686-smp_2.6.8.1-16.14_i386.deb

Size/MD5: 272128 288baa96ee39c2b2994068466efc8755

http://security.ubuntu.com/ubuntu/pool/main/l/linux-source-2.6.8.1/linux-headers-2.6.8.1-5-686_2.6.8.1-16.14_i386.deb

Size/MD5: 275436 390c55b2454e5157a6094dd7d6add605

http://security.ubuntu.com/ubuntu/pool/main/l/linux-source-2.6.8.1/linux-headers-2.6.8.1-5-k7-smp_2.6.8.1-16.14_i386.deb

Size/MD5: 272372 a94bcc0a5cd4bdc87b990ff065d9394a

http://security.ubuntu.com/ubuntu/pool/main/l/linux-source-2.6.8.1/linux-headers-2.6.8.1-5-k7_2.6.8.1-16.14_i386.deb

Size/MD5: 275300 7b597c48cf7697fe475ffd7270dd612e

http://security.ubuntu.com/ubuntu/pool/main/l/linux-source-2.6.8.1/linux-headers-2.6.8.1-5_2.6.8.1-16.14_i386.deb

Size/MD5: 3220194 42366e9cd8611a887850c780b9f7b7b9

http://security.ubuntu.com/ubuntu/pool/main/l/linux-source-2.6.8.1/linux-image-2.6.8.1-5-386_2.6.8.1-16.14_i386.deb

Size/MD5: 15495908 98f76b18e2601d1b3d718d48eb7716a0

http://security.ubuntu.com/ubuntu/pool/main/l/linux-source-2.6.8.1/linux-image-2.6.8.1-5-686-smp_2.6.8.1-16.14_i386.deb

Size/MD5: 16345102 4b51792e685948a89accfee813a56d10

http://security.ubuntu.com/ubuntu/pool/main/l/linux-source-2.6.8.1/linux-image-2.6.8.1-5-686_2.6.8.1-16.14_i386.deb

Size/MD5: 16514792 9e54885c125f0140c36e99a00db7f299

http://security.ubuntu.com/ubuntu/pool/main/l/linux-source-2.6.8.1/linux-image-2.6.8.1-5-k7-smp_2.6.8.1-16.14_i386.deb