[UCI-Linux] bugzilla@redhat.com: [RHSA-2003:056-08] Updated kernel-utils packages fix setuid vulnerability

Fri, 07 Feb 2003 12:21:09 -0800

------- Forwarded Message

Received: from outgoing3.securityfocus.com (outgoing3.securityfocus.com [205.206.231.27])
	by draco.acs.uci.edu (8.11.6/8.11.6) with ESMTP id h17IPkv11298
	for <iglesias@draco.acs.uci.edu>; Fri, 7 Feb 2003 10:25:47 -0800
Received: from lists.securityfocus.com (lists.securityfocus.com [205.206.231.19])
	by outgoing3.securityfocus.com (Postfix) with QMQP
	id 01F1FA319A; Fri,  7 Feb 2003 11:23:33 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 15984 invoked from network); 7 Feb 2003 18:14:05 -0000
Message-Id: <200302071816.h17IGIZ01257@porkchop.devel.redhat.com>
Mime-version: 1.0
Content-type: text/plain; charset="iso-8859-1"
Subject: [RHSA-2003:056-08] Updated kernel-utils packages fix setuid vulnerability
From: bugzilla@redhat.com
Date: Fri, 7 Feb 2003 13:16 -0500
To: redhat-watch-list@redhat.com, redhat-announce-list@redhat.com
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by draco.acs.uci.edu id h17IPkv11298
X-Spam-Status: No, hits=1.9 required=5.0
	tests=NO_REAL_NAME,DOUBLE_CAPSWORD,WEIRD_PORT
	version=2.31
X-Spam-Level: *

- ---------------------------------------------------------------------
                   Red Hat, Inc. Red Hat Security Advisory

Synopsis:          Updated kernel-utils packages fix setuid vulnerability
Advisory ID:       RHSA-2003:056-08
Issue date:        2003-02-07
Updated on:        2003-02-07
Product:           Red Hat Linux
Keywords:          uml user mode linux
Cross references:  
Obsoletes:         
CVE Names:         CAN-2003-0019
- ---------------------------------------------------------------------

1. Topic:

An updated kernel-utils package is available that removes the setuid bits
incorrectly assigned to the uml_net binary.

2. Relevant releases/architectures:

Red Hat Linux 8.0 - i386

3. Problem description:

The kernel-utils package contains several utilities that can be used to
control the kernel or machine hardware.  In Red Hat Linux 8.0 this package
contains user mode linux (UML) utilities.

The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was
incorrectly shipped setuid root.  This could allow local users to control
certain network interfaces, add and remove arp entries and routes, and put
interfaces in and out of promiscuous mode.

All users of the kernel-utils package should update to these packages that
contain a version of uml_net that is not setuid root.  

Alternatively, as a work-around to this vulnerability issue the following
command as root:

chmod -s /usr/bin/uml_net

Red Hat would like to thank Johnny Robertson for alerting us to this issue.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

Note that this update is also available via Red Hat Network. Many
people find this to be an easier way to apply updates. To use Red Hat
Network, launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system. Note that you must select
kernel-utils explicitly on default configurations of up2date.

5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):

83685 - uml_net executable allows users to do bad things

6. RPMs required:

Red Hat Linux 8.0:

SRPMS:
ftp://updates.redhat.com/8.0/en/os/SRPMS/kernel-utils-2.4-8.28.src.rpm

i386:
ftp://updates.redhat.com/8.0/en/os/i386/kernel-utils-2.4-8.28.i386.rpm

7. Verification:

MD5 sum                          Package Name
- --------------------------------------------------------------------------
6eac85b6523b2931db7d039b37b6a2e8 8.0/en/os/SRPMS/kernel-utils-2.4-8.28.src.rpm
40a718a6037b55941a289fa6adc5f0f5 8.0/en/os/i386/kernel-utils-2.4-8.28.i386.rpm

These packages are GPG signed by Red Hat, Inc. for security.  Our key
is available at http://www.redhat.com/about/contact/pgpkey.html

You can verify each package with the following command:

    rpm --checksig -v <filename>

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:

    md5sum <filename>

8. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0019

9. Contact:

The Red Hat security contact is <security@redhat.com>.  More contact
details at http://www.redhat.com/solutions/security/news/contact.html

------- End of Forwarded Message