-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT 
- --------------------------------------------------------------------------

PACKAGE   : kernel
SUMMARY   : Fixes for kernel vulnerabilities
DATE      : 2004-07-15 11:28:00
ID        : CLA-2004:846
RELEVANT
RELEASES  : 8, 9

- -------------------------------------------------------------------------

DESCRIPTION
 The Linux kernel is responsible for handling the basic functions of
 the GNU/Linux operating system.
 
 This announcement fixes the following vulnerabilities:
 
 1. Vicam USB driver denial of service (CAN-2004-0075[1])
 
 The Linux kernel Vicam USB driver used an insecure method for copying
 data from userspace instead of using the copy_from_user function. A
 local attacker could exploit this vulnerability[1] to possibly cause
 a denial of service.
 
 2. OSS denial of service (CAN-2004-0178[2])
 
 The OSS code for the Sound Blaster driver in Linux 2.4.x does not
 properly handle certain sample sizes, which allows local users to
 cause a denial of service.
 
 3. ISO-9660 buffer overflow vulnerability[3] (CAN-2004-0109[4])
 
 The Linux kernel performs no length checking on symbolic links stored
 on an ISO9660 file system, allowing a malformed CD to cause an
 arbitrary length overflow in kernel memory.
 
 4. R128 DRI local privileges escalation (CAN-2004-0003[5])
 
 Alan Cox found a vulnerability in the R128 DRI driver which could
 potentially lead an attacker to gain unauthorized privileges.
 
 5. do_fork memory leak (CAN-2004-0427[6])
 
 John Byrne found[7] an issue in the do_fork function under certain
 conditions would not free allocated memory, possibly causing a denial
 of service.
 
 6. Infoleak on filesystems (CAN-2004-0133[8], CAN-2004-0177[9])
 
 Solar Designer noticed that the ext3[8] code in Linux 2.4.x does not
 properly initialize journal descriptor blocks, which causes an
 information leak. In-memory data is written to the device for an ext3
 file system, which would allow privileged users to obtain portions of
 kernel memory by reading the raw device. Chris noticed that it
 affected JFS too.
 
 7. Buffer overflow at panic state (CAN-2004-0394[10])
 
 The Linux kernel 2.4.x has a buffer overflow in the panic() function,
 which, at this time, is believed to not be exploitable due to the way
 panic() works.
 
 8. Sparse bugs (CAN-2004-0495[11])
 
 This announcement adds missing parts of the sparse corrections done
 to the Linux kernel in our previous announcement[12].


SOLUTION
 It is recommended that all Conectiva Linux users upgrade the kernel
 package.
 
 IMPORTANT: exercise caution and preparation when upgrading the
 kernel, since it will require a reboot after the new packages are
 installed. In particular, Conectiva Linux 9 will most likely require
 an initrd file (which is automatically created in the /boot directory
 after the new packages are installed). Generic kernel update
 instructions can be obtained in the manuals and in our updates
 page[13]. More detailed instructions are also available in Portuguese
 at our Moin[14] page.
 
 
 REFERÊNCIAS:
 1.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0075
 2.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0178
 3.http://www.idefense.com/application/poi/display?id=101&type=vulnerabilities&flashstatus=true
 4.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0109
 5.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0003
 6.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0427
 7.http://marc.theaimsgroup.com/?l=linux-kernel&m=108139073506983&w=2
 8.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0133
 9.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0177
 10.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0394
 11.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0495
 12.http://distro2.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000845&idioma=en
 13.https://moin.conectiva.com.br/UpdatingKernelPackages
 14.http://www.conectiva.com.br/suporte/pr/sistema.kernel.atualizar.html


UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/8/SRPMS/kernel-2.4.19-1U80_24cl.src.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/devfsd-2.4.19-1U80_24cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/kernel-2.4.19-1U80_24cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/kernel-2.4.19-1U80_24cl.i586.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/kernel-2.4.19-1U80_24cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/kernel-BOOT-2.4.19-1U80_24cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/kernel-doc-2.4.19-1U80_24cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/kernel-enterprise-2.4.19-1U80_24cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/kernel-headers-2.4.19-1U80_24cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/kernel-rbc-2.4.19-1U80_24cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/kernel-smp-2.4.19-1U80_24cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/kernel-smp-2.4.19-1U80_24cl.i586.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/kernel-smp-2.4.19-1U80_24cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/kernel-source-2.4.19-1U80_24cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/SRPMS/kernel24-2.4.21-31301U90_18cl.src.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/devfsd-2.4.21-31301U90_18cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-2.4.21-31301U90_18cl.athlon.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-2.4.21-31301U90_18cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-2.4.21-31301U90_18cl.i586.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-2.4.21-31301U90_18cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-2.4.21-31301U90_18cl.pentium4.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-BOOT-2.4.21-31301U90_18cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-doc-2.4.21-31301U90_18cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-enterprise-2.4.21-31301U90_18cl.athlon.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-enterprise-2.4.21-31301U90_18cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-enterprise-2.4.21-31301U90_18cl.pentium4.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-headers-2.4.21-31301U90_18cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-rbc-2.4.21-31301U90_18cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-smp-2.4.21-31301U90_18cl.athlon.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-smp-2.4.21-31301U90_18cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-smp-2.4.21-31301U90_18cl.i586.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-smp-2.4.21-31301U90_18cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-smp-2.4.21-31301U90_18cl.pentium4.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-source-2.4.21-31301U90_18cl.i386.rpm


ADDITIONAL INSTRUCTIONS
 The apt tool can be used to perform RPM packages upgrades:

 - run:                 apt-get update
 - after that, execute: apt-get upgrade

 Detailed instructions regarding the use of apt and upgrade examples 
 can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en

- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at 
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en

- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en

- -------------------------------------------------------------------------
Copyright (c) 2004 Conectiva Inc.
http://www.conectiva.com

- -------------------------------------------------------------------------
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQFA9pZ042jd0JmAcZARArqYAKCwhq4aYaHLHDVvYtQJ6MvShc95tgCcDG6I
Sy3tgLsGuQ3X87pse+DfJq8=
=Klea
-----END PGP SIGNATURE-----


______________________________________________________________________
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br