CAN-2004-0813 described a flaw allowing anyone with read access to scsi hardware the ability to write to it too, and this was fixed upstream in 2.6.8. However since then a number of extra commits have taken place to fix firmware cdrom issues -- see http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=300162 These may affect RHEL4.
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2006-0101.html