Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

For bugs related to Red Hat Enterprise Linux 2.1 product line. For Red Hat Enterprise Linux 6 and above, please visit Red Hat JIRA https://issues.redhat.com/secure/CreateIssue!default.jspa?pid=12332745 to report new issues.

Bug 99514

Summary:	Various kernel security issues affect Enterprise Linux kernel
Product:	Red Hat Enterprise Linux 2.1	Reporter:	Mark J. Cox <mjc>
Component:	kernel	Assignee:	Jason Baron <jbaron>
Status:	CLOSED ERRATA	QA Contact:	Brian Brock <bbrock>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	2.1	CC:	knoel, riel
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2003-08-21 17:40:46 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Mark J. Cox 2003-07-21 13:59:10 UTC

A number of issues have recently been fixed in Red Hat Linux:

CAN-2003-0461: /proc/tty/driver/serial reveals the exact character counts
for serial links. This could be used by a local attacker to infer password
lengths and inter-keystroke timings during password entry.

CAN-2003-0462: Paul Starzetz discovered a file read race condition existing
in the execve() system call, which could cause a local crash.

CAN-2003-0476: The execve system call in Linux 2.4.x records the file
descriptor of the executable process in the file table of the calling
process, allowing local users to gain read access to restricted file
descriptors.

CAN-2003-0501: The /proc filesystem in Linux allows local users to obtain
sensitive information by opening various entries in /proc/self before
executing a setuid program. This causes the program to fail to change the
ownership and permissions of already opened entries.

CAN-2003-0550: The STP protocol is known to have no security, which could
allow attackers to alter the bridge topology. STP is now turned off by
default.

CAN-2003-0551: STP input processing was lax in its length checking, which
could lead to a denial of service.

CAN-2003-0552: Jerry Kreuscher discovered that the Forwarding table could
be spoofed by sending forged packets with bogus source addresses the same
as the local host.

Comment 2 Mark J. Cox 2003-08-13 10:29:51 UTC

additionally:

CAN-2003-0619: An integer signedness error in the decode_fh function of
nfs3xdr.c allows remote attackers to cause a denial of service (kernel
panic) via a negative size value within XDR data of an NFSv3 procedure call. 

Errata, RHSA-2003:239 is in progress.

Comment 3 Mark J. Cox 2003-08-13 11:11:48 UTC

Removing CAN-2003-0461 from the list of things that need to be fixed as 
a fix for CAN-2003-0461 is already in all kernels shipped with 2.1 WS and 2.1 ES
and a fix for 2.1AS was introduced by RHSA-2002:263 errata.

Comment 4 Mark J. Cox 2003-08-21 17:40:46 UTC

An errata has been issued which should help the problem described in this bug report. 
This report is therefore being closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files, please follow the link below. You may reopen 
this bug report if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2003-198.html