The specific version of ClamAV that the system is running is reportedly affected by the following vulnerabilities:

- ClamAV contains an unspecified off-by-one flaw in the htmlnorm functionality that may allow an attacker to cause an out-of-bounds write. No further details have been provided.

- ClamAV contains an out-of-bounds read flaw in the autoit functionality. This may allow a context-dependent attacker to crash the program or potentially disclose memory contents.

- ClamAV contains an out-of-bounds dereference issue that is triggered during the parsing of mbox files. This may allow a context-dependent attacker to have an unspecified impact.

- ClamAV contains a flaw that is triggered during the handling of a specially crafted 7z file. This may allow a context-dependent attacker to cause a memory overlay and crash the program, which can leave the system vulnerable to other attacks.

Cisco ClamAV contains a flaw that is triggered when handling the scan of a specially crafted document. This may allow a remote attacker to cause the Advance Malware Protection (AMP) process to restart.

Perl contains an overflow condition in the VDir::MapPathA() function. The issue is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
Technical Information: Note: Programming language vulnerability. This code is used in a wide variety of software and the issue may manifest in a number of different ways. Depending on the implementation, it varies if this vulnerability requires local access or may be exploited remotely.

The remote Cisco Adaptive Security Appliance (ASA) is missing a vendor-supplied security patch. It is, therefore, affected by a remote code execution vulnerability due to an overflow condition in the Internet Key Exchange (IKE) implementation. An unauthenticated, remote attacker can exploit this, via a specially crafted UDP packet, to cause a denial of service or the execution of arbitrary code. Note that only systems configured in routed firewall mode and single / multiple context mode are affected.

A vulnerability in the code responsible for the self-updating feature of Cisco AnyConnect Secure Mobility Client for Linux and the Cisco AnyConnect Secure Mobility Client for Mac OS X could allow an authenticated, local attacker to execute an arbitrary executable file of its choosing with privileges equivalent to the Linux or Mac OS X root account.

The vulnerability is due to lack of checks in the code for the path and filename of the file being installed. An attacker could exploit this vulnerability by invoking this functionality with a crafted installation file. A successful exploit could allow the attacker to execute commands on the underlying Linux or Mac OS X host with privileges equivalent to the root account.

ISC dhclient did not strip or escape certain shell meta-characters in responses from the dhcp server (like hostname) before passing the responses on to dhclient-script. Depending on the script and OS, this can result in execution of exploit code on the client.

Based on the system log, this system is running a WhatsUp Network Monitor.

The LCE observed a log which indicates this system is a Sonicwall firewall.

Based on the system log, this system is running Cyberark.

A vulnerability in Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to execute an arbitrary executable file with privileges equivalent to the Microsoft Windows operating system SYSTEM account.

The vulnerability is due to lack of checks in the code for the path to the downloader application and associated DLLs. An attacker could exploit this vulnerability by executing the downloader application from outside its expected location and providing a set of crafted DLLs. A successful exploit could allow the attacker to execute commands on the underlying Microsoft Windows host with privileges equivalent to the SYSTEM account.

Functional code that exploits this vulnerability is publicly available.

A vulnerability in the connection establishment process of Cisco AnyConnect Secure Mobility Client could allow an unauthenticated, remote attacker to write or overwrite files in the active user's context.

The vulnerability is due to insufficient input validation. An unauthenticated, remote attacker could exploit this vulnerability by persuading a user to connect to a malicious head-end system. The malicious head-end system could be used to pass back crafted configuration attributes, which the attacker could leverage to execute a directory traversal attack. A successful exploit could allow the attacker to write or overwrite any file in the active user's context. The location or file must be writable by the user running the AnyConnect client.

A vulnerability in the kernel extension for Mac OS X of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker to cause a denial of service (DoS) condition.

The vulnerability is due to insufficient bounds checking. An attacker could exploit this vulnerability by crafting a piece of contiguous data in memory that is read by the client software. An exploit could allow the attacker to cause an OS X kernel panic.

A vulnerability in Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to install and execute an arbitrary executable file with privileges equivalent to the Microsoft Windows operating system SYSTEM account.

The vulnerability is due to a lack of checks in the code for the path and filename of the file that is to be installed. An attacker could exploit this vulnerability by creating a specially modified INF file. An exploit could allow the attacker to execute commands on the underlying Microsoft Windows host with privileges equivalent to the SYSTEM account.

The remote host is running a version of VirtualBox which is vulnerable to an out-of-bounds memory access flaw, which can cause a crash or execution of arbitrary code on the host.

The remote host is running a version of kvm which is vulnerable to an out-of-bounds memory access flaw, which can cause a crash or execution of arbitrary code on the host.

The remote host is running a version of qemu-kvm-rhev which is vulnerable to an out-of-bounds memory access flaw, which can cause a crash or execution of arbitrary code on the host.

The remote host is running a version of qemu-kvm which is vulnerable to an out-of-bounds memory access flaw, which can cause a crash or execution of arbitrary code on the host.

The remote host is running a version of xen which is vulnerable to an out-of-bounds memory access flaw, which can cause a crash or execution of arbitrary code on the host.

Updated kernel packages are now available as part of ongoing support
and maintenance of Red Hat Enterprise Linux version 3. This is the
fifth regular update.

The Linux kernel handles the basic functions of the operating system.

This is the fifth regular kernel update to Red Hat Enterprise Linux 3.

New features introduced by this update include :

  - support for 2-TB partitions on block devices - support
    for new disk, network, and USB devices - support for
    clustered APIC mode on AMD64 NUMA systems - netdump
    support on AMD64, Intel EM64T, Itanium, and ppc64
    systems - diskdump support on sym53c8xx and SATA
    piix/promise adapters - NMI switch support on AMD64 and
    Intel EM64T systems

There were many bug fixes in various parts of the kernel. The ongoing
effort to resolve these problems has resulted in a marked improvement
in the reliability and scalability of Red Hat Enterprise Linux 3.

Some key areas affected by these fixes include the kernel's
networking, SATA, TTY, and USB subsystems, as well as the
architecture-dependent handling under the ia64, ppc64, and x86_64
directories. Scalability improvements were made primarily in the
memory management and file system areas.

A flaw in offset handling in the xattr file system code backported to
Red Hat Enterprise Linux 3 was fixed. On 64-bit systems, a user who
can access an ext3 extended-attribute-enabled file system could cause
a denial of service (system crash). This issue is rated as having a
moderate security impact (CVE-2005-0757).

The following device drivers have been upgraded to new versions :

3c59x ------ LK1.1.18 3w-9xxx ---- 2.24.00.011fw (new in Update 5)
3w-xxxx ---- 1.02.00.037 8139too ---- (upstream 2.4.29) b44 --------
0.95 cciss ------ v2.4.54.RH1 e100 ------- 3.3.6-k2 e1000 ------
5.6.10.1-k2 lpfcdfc ---- 1.0.13 (new in Update 5) tg3 -------- 3.22RH

Note: The kernel-unsupported package contains various drivers and
modules that are unsupported and therefore might contain security
problems that have not been addressed.

All Red Hat Enterprise Linux 3 users are advised to upgrade their
kernels to the packages associated with their machine architectures
and configurations as listed in this erratum.

Updated kernel packages that fix several security issues in the Red
Hat Enterprise Linux 3 kernel are now available.

This security advisory has been rated as having important security
impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

The following security issues were fixed :

The Vicam USB driver did not use the copy_from_user function to access
userspace, crossing security boundaries. (CVE-2004-0075)

The ext3 and jfs code did not properly initialize journal descriptor
blocks. A privileged local user could read portions of kernel memory.
(CVE-2004-0177)

The terminal layer did not properly lock line discipline changes or
pending IO. An unprivileged local user could read portions of kernel
memory, or cause a denial of service (system crash). (CVE-2004-0814)

A race condition was discovered. Local users could use this flaw to
read the environment variables of another process that is still
spawning via /proc/.../cmdline. (CVE-2004-1058)

A flaw in the execve() syscall handling was discovered, allowing a
local user to read setuid ELF binaries that should otherwise be
protected by standard permissions. (CVE-2004-1073). Red Hat originally
reported this as being fixed by RHSA-2004:549, but the associated fix
was missing from that update.

Keith Owens reported a flaw in the Itanium unw_unwind_to_user()
function. A local user could use this flaw to cause a denial of
service (system crash) on the Itanium architecture. (CVE-2005-0135)

A missing Itanium syscall table entry could allow an unprivileged
local user to cause a denial of service (system crash) on the Itanium
architecture. (CVE-2005-0137)

A flaw affecting the OUTS instruction on the AMD64 and Intel EM64T
architectures was discovered. A local user could use this flaw to
access privileged IO ports. (CVE-2005-0204)

A flaw was discovered in the Linux PPP driver. On systems allowing
remote users to connect to a server using ppp, a remote client could
cause a denial of service (system crash). (CVE-2005-0384)

A flaw in the Red Hat backport of NPTL to Red Hat Enterprise Linux 3
was discovered that left a pointer to a freed tty structure. A local
user could potentially use this flaw to cause a denial of service
(system crash) or possibly gain read or write access to ttys that
should normally be prevented. (CVE-2005-0403)

A flaw in fragment queuing was discovered affecting the netfilter
subsystem. On systems configured to filter or process network packets
(for example those configured to do firewalling), a remote attacker
could send a carefully crafted set of fragmented packets to a machine
and cause a denial of service (system crash). In order to sucessfully
exploit this flaw, the attacker would need to know (or guess) some
aspects of the firewall ruleset in place on the target system to be
able to craft the right fragmented packets. (CVE-2005-0449)

Missing validation of an epoll_wait() system call parameter could
allow a local user to cause a denial of service (system crash) on the
IBM S/390 and zSeries architectures. (CVE-2005-0736)

A flaw when freeing a pointer in load_elf_library was discovered. A
local user could potentially use this flaw to cause a denial of
service (system crash). (CVE-2005-0749)

A flaw was discovered in the bluetooth driver system. On system where
the bluetooth modules are loaded, a local user could use this flaw to
gain elevated (root) privileges. (CVE-2005-0750)

In addition to the security issues listed above, there was an
important fix made to the handling of the msync() system call for a
particular case in which the call could return without queuing
modified mmap()'ed data for file system update. (BZ 147969)

Note: The kernel-unsupported package contains various drivers and
modules that are unsupported and therefore might contain security
problems that have not been addressed.

Red Hat Enterprise Linux 3 users are advised to upgrade their kernels
to the packages associated with their machine
architectures/configurations

Please note that the fix for CVE-2005-0449 required changing the
external symbol linkages (kernel module ABI) for the ip_defrag() and
ip_ct_gather_frags() functions. Any third-party module using either of
these would also need to be fixed.

Updated kernel packages are now available as part of ongoing support
and maintenance of Red Hat Enterprise Linux version 2.1. This is the
seventh regular update.

This security advisory has been rated as having important security
impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

This is the seventh regular kernel update to Red Hat Enterprise Linux
2.1

The following security updates were made :

A flaw in fragment queuing was discovered that affected the Linux 2.4
and Linux 2.6 kernel netfilter subsystem. On systems configured to
filter or process network packets (for example those configured to do
firewalling), a remote attacker could send a carefully crafted set of
fragmented packets to a machine and cause a denial of service (system
crash). In order to sucessfully exploit this flaw, the attacker would
need to know (or guess) some aspects of the firewall ruleset in place
on the target system to be able to craft the right fragmented packets.
(CVE-2005-0449)

A flaw was discovered in the Linux PPP driver. On systems allowing
remote users to connect to a server using ppp, a remote client could
cause a denial of service (system crash). (CVE-2005-0384)

A flaw was discovered in the bluetooth driver system. On system where
the bluetooth modules are loaded, a local user could use this flaw to
gain elevated (root) privileges. (CVE-2005-0750)

An integer overflow flaw was discovered in the ubsec_keysetup function
in the Broadcom 5820 cryptonet driver. On systems using this driver, a
local user could cause a denial of service (crash) or possibly gain
elevated privileges. (CVE-2004-0619) Please note that this update
contains an unpatched kernel module called bcm5820_old for backwards
compatibility which is still vulnerable to CVE-2004-0619.

The following device drivers have been updated to new versions :

mptfusion: 2.05.16 -> 2.05.16.02 bcm5820: 1.17 -> 1.81 cciss: 2.4.52
-> 2.4.54 qla2x00: 6.04.01 -> 7.01.01

There were many bug fixes in various parts of the kernel. The ongoing
effort to resolve these problems has resulted in a marked improvement
in the reliability and scalability of Red Hat Enterprise Linux 2.1.

Bug fixes include: - Fixes an incorrect and ever-changing physical_id
field in /proc/cpuinfo. - Now recognizes a particular e1000 device
(PCI ID 8086:1014) - Fixes a panic in disk quota code - Fixes a bug in
which msync(...MS_SYNC) returns before the data is written to disk -
Adds new devices to the SCSI scan list so they can be initialized and
handled properly: LSI ProFibre 4000R, HP HSV200/210, HP MSA, STK
OPENstorage D178. - Fixes a potential format overflow in
/proc/partitions - Restores module parameters to the e100 driver for
compatibility with existing customer scripts. - Fixes a bug in which
cat'ing /proc/mdstat while adding/removing devices can cause a kernel
oops

All Red Hat Enterprise Linux 2.1 users are advised to upgrade their
kernels to the packages associated with their machine architectures
and configurations as listed in this erratum.

Please note that a vulnerability addressed by this update
(CVE-2005-0449) required a change to the kernel module ABI which could
cause third party modules to not work. However, Red Hat is currently
not aware of any module that would be affected by this change.

Updated kernel packages that fix several security issues are now
available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the
Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

This advisory includes fixes for several security issues :

iSEC Security Research discovered multiple vulnerabilities in the IGMP
functionality. These flaws could allow a local user to cause a denial
of service (crash) or potentially gain privileges. Where multicast
applications are being used on a system, these flaws may also allow
remote users to cause a denial of service. The Common Vulnerabilities
and Exposures project (cve.mitre.org) has assigned the name
CVE-2004-1137 to this issue.

iSEC Security Research discovered a flaw in the page fault handler
code that could lead to local users gaining elevated (root) privileges
on multiprocessor machines. (CVE-2005-0001)

iSEC Security Research discovered a VMA handling flaw in the uselib(2)
system call of the Linux kernel. A local user could make use of this
flaw to gain elevated (root) privileges. (CVE-2004-1235)

A flaw affecting the OUTS instruction on the AMD64 and Intel EM64T
architecture was discovered. A local user could use this flaw to write
to privileged IO ports. (CVE-2005-0204)

The Direct Rendering Manager (DRM) driver in Linux kernel 2.6 does not
properly check the DMA lock, which could allow remote attackers or
local users to cause a denial of service (X Server crash) or possibly
modify the video output. (CVE-2004-1056)

OGAWA Hirofumi discovered incorrect tables sizes being used in the
filesystem Native Language Support ASCII translation table. This could
lead to a denial of service (system crash). (CVE-2005-0177)

Michael Kerrisk discovered a flaw in the 2.6.9 kernel which allows
users to unlock arbitrary shared memory segments. This flaw could lead
to applications not behaving as expected. (CVE-2005-0176)

Improvements in the POSIX signal and tty standards compliance exposed
a race condition. This flaw can be triggered accidentally by threaded
applications or deliberately by a malicious user and can result in a
denial of service (crash) or in occasional cases give access to a
small random chunk of kernel memory. (CVE-2005-0178)

The PaX team discovered a flaw in mlockall introduced in the 2.6.9
kernel. An unprivileged user could use this flaw to cause a denial of
service (CPU and memory consumption or crash). (CVE-2005-0179)

Brad Spengler discovered multiple flaws in sg_scsi_ioctl in the 2.6
kernel. An unprivileged user may be able to use this flaw to cause a
denial of service (crash) or possibly other actions. (CVE-2005-0180)

Kirill Korotaev discovered a missing access check regression in the
Red Hat Enterprise Linux 4 kernel 4GB/4GB split patch. On systems
using the hugemem kernel, a local unprivileged user could use this
flaw to cause a denial of service (crash). (CVE-2005-0090)

A flaw in the Red Hat Enterprise Linux 4 kernel 4GB/4GB split patch
can allow syscalls to read and write arbitrary kernel memory. On
systems using the hugemem kernel, a local unprivileged user could use
this flaw to gain privileges. (CVE-2005-0091)

An additional flaw in the Red Hat Enterprise Linux 4 kernel 4GB/4GB
split patch was discovered. On x86 systems using the hugemem kernel, a
local unprivileged user may be able to use this flaw to cause a denial
of service (crash). (CVE-2005-0092)

All Red Hat Enterprise Linux 4 users are advised to upgrade their
kernels to the packages associated with their machine architectures
and configurations as listed in this erratum.

Updated kernel packages that fix several security issues in Red Hat
Enterprise Linux 3 are now available.

The Linux kernel handles the basic functions of the operating system.

This advisory includes fixes for several security issues :

iSEC Security Research discovered a VMA handling flaw in the uselib(2)
system call of the Linux kernel. A local user could make use of this
flaw to gain elevated (root) privileges. The Common Vulnerabilities
and Exposures project (cve.mitre.org) has assigned the name
CVE-2004-1235 to this issue.

A flaw was discovered where an executable could cause a VMA overlap
leading to a crash. A local user could trigger this flaw by creating a
carefully crafted a.out binary on 32-bit systems or a carefully
crafted ELF binary on Itanium systems. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CVE-2005-0003
to this issue.

iSEC Security Research discovered a flaw in the page fault handler
code that could lead to local users gaining elevated (root) privileges
on multiprocessor machines. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CVE-2005-0001 to this
issue. A patch that coincidentally fixed this issue was committed to
the Update 4 kernel release in December 2004. Therefore Red Hat
Enterprise Linux 3 kernels provided by RHBA-2004:550 and subsequent
updates are not vulnerable to this issue.

A flaw in the system call filtering code in the audit subsystem
included in Red Hat Enterprise Linux 3 allowed a local user to cause a
crash when auditing was enabled. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CVE-2004-1237
to this issue.

Olaf Kirch discovered that the recent security fixes for cmsg_len
handling (CVE-2004-1016) broke 32-bit compatibility on 64-bit
platforms such as AMD64 and Intel EM64T. A patch to correct this issue
is included.

A recent Internet Draft by Fernando Gont recommended that ICMP Source
Quench messages be ignored by hosts. A patch to ignore these messages
is included.

Note: The kernel-unsupported package contains various drivers and
modules that are unsupported and therefore might contain security
problems that have not been addressed.

All Red Hat Enterprise Linux 3 users are advised to upgrade their
kernels to the packages associated with their machine architectures
and configurations as listed in this erratum.

Updated kernel packages that fix several security issues in Red Hat
Enterprise Linux 2.1 are now available.

The Linux kernel handles the basic functions of the operating system.

This advisory includes fixes for the following security issues :

iSEC Security Research discovered a VMA handling flaw in the uselib(2)
system call of the Linux kernel. A local user could make use of this
flaw to gain elevated (root) privileges. The Common Vulnerabilities
and Exposures project (cve.mitre.org) has assigned the name
CVE-2004-1235 to this issue.

iSEC Security Research discovered a flaw in the page fault handler
code that could lead to local users gaining elevated (root) privileges
on multiprocessor machines. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CVE-2005-0001 to this
issue.

iSEC Security Research and Georgi Guninski independently discovered a
flaw in the scm_send function in the auxiliary message layer. A local
user could create a carefully crafted auxiliary message which could
cause a denial of service (system hang). The Common Vulnerabilities
and Exposures project (cve.mitre.org) has assigned the name
CVE-2004-1016 to this issue.

Kirill Korotaev found a flaw in load_elf_binary affecting kernels
prior to 2.4.26. A local user could create a carefully crafted binary
in such a way that it would cause a denial of service (system crash).
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2004-1234 to this issue.

These packages also fix issues in the io_edgeport driver
(CVE-2004-1017), a memory leak in ip_options_get (CVE-2004-1335), and
missing VM_IO flags in some drivers (CVE-2004-1057).

A recent Internet Draft by Fernando Gont recommended that ICMP Source
Quench messages be ignored by hosts. A patch to ignore these messages
is included.

All Red Hat Enterprise Linux 2.1 users are advised to upgrade their
kernels to the packages associated with their machine architectures
and configurations as listed in this erratum.

Updated kernel packages that fix several security issues in Red Hat
Enterprise Linux 3 are now available.

The Linux kernel handles the basic functions of the operating system.

This advisory includes fixes for several security issues :

Petr Vandrovec discovered a flaw in the 32bit emulation code affecting
the Linux 2.4 kernel on the AMD64 architecture. A local attacker could
use this flaw to gain privileges. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CVE-2004-1144
to this issue.

ISEC security research discovered multiple vulnerabilities in the IGMP
functionality which was backported in the Red Hat Enterprise Linux 3
kernels. These flaws could allow a local user to cause a denial of
service (crash) or potentially gain privileges. Where multicast
applications are being used on a system, these flaws may also allow
remote users to cause a denial of service. The Common Vulnerabilities
and Exposures project (cve.mitre.org) has assigned the name
CVE-2004-1137 to this issue.

ISEC security research and Georgi Guninski independantly discovered a
flaw in the scm_send function in the auxiliary message layer. A local
user could create a carefully crafted auxiliary message which could
cause a denial of service (system hang). The Common Vulnerabilities
and Exposures project (cve.mitre.org) has assigned the name
CVE-2004-1016 to this issue.

A floating point information leak was discovered in the ia64
architecture context switch code. A local user could use this flaw to
read register values of other processes by setting the MFH bit. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2004-0565 to this issue.

Kirill Korotaev found a flaw in load_elf_binary affecting kernels
prior to 2.4.26. A local user could create a carefully crafted binary
in such a way that it would cause a denial of service (system crash).
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2004-1234 to this issue.

These packages also fix issues in the io_edgeport driver, and a memory
leak in ip_options_get.

Note: The kernel-unsupported package contains various drivers and
modules that are unsupported and therefore might contain security
problems that have not been addressed.

All Red Hat Enterprise Linux 3 users are advised to upgrade their
kernels to the packages associated with their machine architectures
and configurations as listed in this erratum.

Updated kernel packages that fix several security issues in Red Hat
Enterprise Linux 3 are now available.

The Linux kernel handles the basic functions of the operating system.

This update includes fixes for several security issues :

A missing serialization flaw in unix_dgram_recvmsg was discovered that
affects kernels prior to 2.4.28. A local user could potentially make
use of a race condition in order to gain privileges. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CVE-2004-1068 to this issue.

Paul Starzetz of iSEC discovered various flaws in the ELF binary
loader affecting kernels prior to 2.4.28. A local user could use thse
flaws to gain read access to executable-only binaries or possibly gain
privileges. (CVE-2004-1070, CVE-2004-1071, CVE-2004-1072,
CVE-2004-1073)

A flaw when setting up TSS limits was discovered that affects AMD
AMD64 and Intel EM64T architecture kernels prior to 2.4.23. A local
user could use this flaw to cause a denial of service (crash) or
possibly gain privileges. (CVE-2004-0812)

An integer overflow flaw was discovered in the ubsec_keysetup function
in the Broadcom 5820 cryptonet driver. On systems using this driver, a
local user could cause a denial of service (crash) or possibly gain
elevated privileges. (CVE-2004-0619)

Stefan Esser discovered various flaws including buffer overflows in
the smbfs driver affecting kernels prior to 2.4.28. A local user may
be able to cause a denial of service (crash) or possibly gain
privileges. In order to exploit these flaws the user would require
control of a connected Samba server. (CVE-2004-0883, CVE-2004-0949)

SGI discovered a bug in the elf loader that affects kernels prior to
2.4.25 which could be triggered by a malformed binary. On
architectures other than x86, a local user could create a malicious
binary which could cause a denial of service (crash). (CVE-2004-0136)

Conectiva discovered flaws in certain USB drivers affecting kernels
prior to 2.4.27 which used the copy_to_user function on uninitialized
structures. These flaws could allow local users to read small amounts
of kernel memory. (CVE-2004-0685)

All Red Hat Enterprise Linux 3 users are advised to upgrade their
kernels to the packages associated with their machine architectures
and configurations as listed in this erratum.

Updated kernel packages are now available as part of ongoing support
and maintenance of Red Hat Enterprise Linux version 2.1. This is the
sixth regular update.

The Linux kernel handles the basic functions of the operating system.

This is the sixth regular kernel update to Red Hat Enterprise Linux
version 2.1. It updates a number of device drivers, and adds much
improved SATA support.

This update includes fixes for several security issues :

Paul Starzetz of iSEC discovered various flaws in the ELF binary
loader affecting kernels prior to 2.4.28. A local user could use these
flaws to gain read access to executable-only binaries or possibly gain
privileges. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the names CVE-2004-1070, CVE-2004-1071,
CVE-2004-1072, and CVE-2004-1073 to these issues.

A missing serialization flaw in unix_dgram_recvmsg was discovered that
affects kernels prior to 2.4.28. A local user could potentially make
use of a race condition in order to gain privileges. (CVE-2004-1068)

Stefan Esser discovered various flaws including buffer overflows in
the smbfs driver affecting kernels before 2.4.28. A local user may be
able to cause a denial of service (crash) or possibly gain privileges.
In order to exploit these flaws the user would need to have control of
a connected smb server. (CVE-2004-0883, CVE-2004-0949)

Conectiva discovered flaws in certain USB drivers affecting kernels
before 2.4.27 which used the copy_to_user function on uninitialized
structures. These flaws could allow local users to read small amounts
of kernel memory. (CVE-2004-0685)

The ext3 code in kernels before 2.4.26 did not properly initialize
journal descriptor blocks. A privileged local user could read portions
of kernel memory. (CVE-2004-0177)

The following drivers have also been updated :

* tg3 v3.10 * e1000 v5.3.19-k2 * e100 v3.0.27-k2 * megaraid *
megaraid2 v2.10.8.2

All Red Hat Enterprise Linux 2.1 users are advised to upgrade their
kernels to the packages associated with their machine architectures
and configurations as listed in this erratum.

Updated kernel packages are now available as part of ongoing support
and maintenance of Red Hat Enterprise Linux version 2.1. This is the
fifth regular update.

The Linux kernel handles the basic functions of the operating system.

This is the fifth regular kernel update to Red Hat Enterprise Linux
version 2.1. It contains one minor security fix, many bug fixes, and
updates a number of device drivers.

A bug in the SoundBlaster 16 code which did not properly handle
certain sample sizes has been fixed. This flaw could be used by local
users to crash a system. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CVE-2004-0178 to this
issue.

The following drivers have also been updated :

* cciss v2.4.52 * e1000 v5252k1 * e100 v2.3.43-k1 * fusion v2.05.16 *
ips v7.00.15 * aacraid v1.1.5 * megaraid2 v2.10.6

All Red Hat Enterprise Linux 2.1 users are advised to upgrade their
kernels to the packages associated with their machine architectures
and configurations as listed in this erratum.

Updated kernel packages that fix potential information leaks and a
incorrect driver permission for Red Hat Enterprise Linux 2.1 are now
available.

The Linux kernel handles the basic functions of the operating system.

Paul Starzetz discovered flaws in the Linux kernel when handling file
offset pointers. These consist of invalid conversions of 64 to 32-bit
file offset pointers and possible race conditions. A local
unprivileged user could make use of these flaws to access large
portions of kernel memory. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CVE-2004-0415 to this
issue.

These packages contain a patch written by Al Viro to correct these
flaws. Red Hat would like to thank iSEC Security Research for
disclosing this issue and a number of vendor-sec participants for
reviewing and working on the patch to this issue.

In addition, these packages correct two minor issues :

An bug in the e1000 network driver. This bug could be used by local
users to leak small amounts of kernel memory (CVE-2004-0535).

Inappropriate permissions on /proc/scsi/qla2300/HbaApiNode
(CVE-2004-0587).

All Red Hat Enterprise Linux 2.1 users are advised to upgrade their
kernels to these erratum packages which contain backported patches to
correct these issues.

Updated kernel packages that fix several security issues in Red Hat
Enterprise Linux 3 are now available.

The Linux kernel handles the basic functions of the operating system.

Paul Starzetz discovered flaws in the Linux kernel when handling file
offset pointers. These consist of invalid conversions of 64 to 32-bit
file offset pointers and possible race conditions. A local
unprivileged user could make use of these flaws to access large
portions of kernel memory. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CVE-2004-0415 to this
issue.

These packages contain a patch written by Al Viro to correct these
flaws. Red Hat would like to thank iSEC Security Research for
disclosing this issue and a number of vendor-sec participants for
reviewing and working on the patch to this issue.

In addition, these packages correct a number of minor security 
issues :

An bug in the e1000 network driver. This bug could be used by local
users to leak small amounts of kernel memory (CVE-2004-0535).

A bug in the SoundBlaster 16 code which does not properly handle
certain sample sizes. This flaw could be used by local users to crash
a system (CVE-2004-0178).

A possible NULL-pointer dereference in the Linux kernel prior to
2.4.26 on the Itanium platform could allow a local user to crash a
system (CVE-2004-0447).

Inappropriate permissions on /proc/scsi/qla2300/HbaApiNode
(CVE-2004-0587).

All Red Hat Enterprise Linux 3 users are advised to upgrade their
kernels to the packages associated with their machine architectures
and configurations as listed in this erratum.

Updated kernel packages that fix a security vulnerability affecting
the kernel nfs server for Red Hat Enterprise Linux 3 are now
available.

The Linux kernel handles the basic functions of the operating system.

During an audit of the Linux kernel, SUSE discovered a flaw that
allowed a user to make unauthorized changes to the group ID of files
in certain circumstances. In the 2.4 kernel, as shipped with Red Hat
Enterprise Linux, the only way this could happen is through the kernel
nfs server. A user on a system that mounted a remote file system from
a vulnerable machine may be able to make unauthorized changes to the
group ID of exported files. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CVE-2004-0497 to this
issue.

Only Red Hat Enterprise Linux systems that are configured to share
file systems via NFS are affected by this issue.

All Red Hat Enterprise Linux 3 users are advised to upgrade their
kernels to the packages associated with their machine architectures
and configurations as listed in this erratum.

Updated kernel packages that fix a security vulnerability affecting
the kernel nfs server for Red Hat Enterprise Linux 2.1 are now
available.

The Linux kernel handles the basic functions of the operating system.

During an audit of the Linux kernel, SUSE discovered a flaw that
allowed a user to make unauthorized changes to the group ID of files
in certain circumstances. In the 2.4 kernel, as shipped with Red Hat
Enterprise Linux, the only way this could happen is through the kernel
nfs server. A user on a system that mounted a remote file system from
a vulnerable machine may be able to make unauthorized changes to the
group ID of exported files. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CVE-2004-0497 to this
issue.

Only Red Hat Enterprise Linux systems that are configured to share
file systems via NFS are affected by this issue.

All Red Hat Enterprise Linux 2.1 users are advised to upgrade their
kernels to the packages associated with their machine architectures
and configurations as listed in this erratum. These packages contain a
backported patch to correct this issue.

Updated kernel packages for Red Hat Enterprise Linux 3 that fix
security vulnerabilities are now available.

The Linux kernel handles the basic functions of the operating system.

A flaw was found in Linux kernel versions 2.4 and 2.6 for x86 and
x86_64 that allowed local users to cause a denial of service (system
crash) by triggering a signal handler with a certain sequence of fsave
and frstor instructions. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CVE-2004-0554 to this
issue.

Another flaw was discovered in an error path supporting the clone()
system call that allowed local users to cause a denial of service
(memory leak) by passing invalid arguments to clone() running in an
infinite loop of a user's program. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CVE-2004-0427
to this issue.

Enhancements were committed to the 2.6 kernel by Al Viro which enabled
the Sparse source code checking tool to check for a certain class of
kernel bugs. A subset of these fixes also applies to various drivers
in the 2.4 kernel. Although the majority of these resides in drivers
unsupported in Red Hat Enterprise Linux 3, the flaws could lead to
privilege escalation or access to kernel memory. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CVE-2004-0495 to these issues.

All Red Hat Enterprise Linux 3 users are advised to upgrade their
kernels to the packages associated with their machine architectures
and configurations as listed in this erratum. These packages contain
backported patches to correct these issues.

Updated kernel packages are now available as part of ongoing support
and maintenance of Red Hat Enterprise Linux version 3. This is the
second regular update.

The Linux kernel handles the basic functions of the operating system.

This is the second regular kernel update to Red Hat Enterprise Linux
version 3. It contains several minor security fixes, many bug fixes,
device driver updates, new hardware support, and the introduction of
Linux Syscall Auditing support.

There were bug fixes in many different parts of the kernel, the bulk
of which addressed unusual situations such as error handling, race
conditions, and resource starvation. The combined effect of the
approximately 140 fixes is a strong improvement in the reliability and
durability of Red Hat Enterprise Linux. Some of the key areas affected
are disk drivers, network drivers, USB support, x86_64 and ppc64
platform support, ia64 32-bit emulation layer enablers, and the VM,
NFS, IPv6, and SCSI subsystems.

A significant change in the SCSI subsystem (the disabling of the
scsi-affine-queue patch) should significantly improve SCSI disk driver
performance in many scenarios. There were 10 Bugzillas against SCSI
performance problems addressed by this change.

The following drivers have been upgraded to new versions :

bonding ---- 2.4.1 cciss ------ 2.4.50.RH1 e1000 ------ 5.2.30.1-k1
fusion ----- 2.05.11.03 ipr -------- 1.0.3 ips -------- 6.11.07
megaraid2 -- 2.10.1.1 qla2x00 ---- 6.07.02-RH1 tg3 -------- 3.1
z90crypt --- 1.1.4

This update introduces support for the new Intel EM64T processor. A
new 'ia32e' architecture has been created to support booting on
platforms based on either the original AMD Opteron CPU or the new
Intel EM64T CPU. The existing 'x86_64' architecture has remained
optimized for Opteron systems. Kernels for both types of systems are
built from the same x86_64-architecture sources and share a common
kernel source RPM (kernel-source-2.4.21-15.EL.x86_64.rpm).

Other highlights in this update include a major upgrade to the SATA
infrastructure, addition of IBM JS20 Power Blade support, and creation
of an optional IBM eServer zSeries On-Demand Timer facility for
reducing idle CPU overhead.

The following security issues were addressed in this update :

A minor flaw was found where /proc/tty/driver/serial reveals the exact
character counts for serial links. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CVE-2003-0461
to this issue.

The kernel strncpy() function in Linux 2.4 and 2.5 does not pad the
target buffer with null bytes on architectures other than x86, as
opposed to the expected libc behavior, which could lead to information
leaks. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CVE-2003-0465 to this issue.

A minor data leak was found in two real time clock drivers (for
/dev/rtc). The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CVE-2003-0984 to this issue.

A flaw in the R128 Direct Render Infrastructure (dri) driver could
allow local privilege escalation. This driver is part of the
kernel-unsupported package. The Common Vulnera- bilities and Exposures
project (cve.mitre.org) has assigned the name CVE-2004-0003 to this
issue.

A flaw in ncp_lookup() in ncpfs could allow local privilege
escalation. The ncpfs module allows a system to mount volumes of
NetWare servers or print to NetWare printers and is in the
kernel-unsupported package. The Common Vulnera- bilities and Exposures
project (cve.mitre.org) has assigned the name CVE-2004-0010 to this
issue.

(Note that the kernel-unsupported package contains drivers and other
modules that are unsupported and therefore might contain security
problems that have not been addressed.)

All Red Hat Enterprise Linux 3 users are advised to upgrade their
kernels to the packages associated with their machine architectures
and configurations as listed in this erratum.

Updated kernel packages that fix two privilege escalation
vulnerabilities are now available.

The Linux kernel handles the basic functions of the operating system.

iSEC Security Research discovered a flaw in the ip_setsockopt()
function code of the Linux kernel versions 2.4.22 to 2.4.25 inclusive.
This flaw also affects the 2.4.21 kernel in Red Hat Enterprise Linux 3
which contained a backported version of the affected code. A local
user could use this flaw to gain root privileges. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CVE-2004-0424 to this issue.

iDefense reported a buffer overflow flaw in the ISO9660 filesystem
code. An attacker could create a malicious filesystem in such a way
that root privileges may be obtained if the filesystem is mounted. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2004-0109 to this issue.

All Red Hat Enterprise Linux 3 users are advised to upgrade their
kernels to the packages associated with their machine architectures
and configurations as listed in this erratum.

Updated kernel packages that fix a security vulnerability which may
allow local users to gain root privileges are now available.

The Linux kernel handles the basic functions of the operating system.

This kernel updates several drivers and fixes a number of bugs,
including a potential security vulnerability.

iDefense reported a buffer overflow flaw in the ISO9660 filesystem
code. An attacker could create a malicious filesystem in such a way
that root privileges may be obtained if the filesystem is mounted. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2004-0109 to this issue.

The following drivers were updated :

LSI megaraid2 v2.10.1.1 IBM Serveraid v. 6.11.07 MPT Fusion
v.2.05.11.03

All users are advised to upgrade to these errata packages, which
contain a backported security patch that corrects this issue.

Updated kernel packages that fix a security vulnerability which may
allow local users to gain root privileges are now available.

[Updated 5 March 2004] Added kernel-headers packages

The Linux kernel handles the basic functions of the operating system.

Paul Starzetz discovered a flaw in return value checking in mremap()
in the Linux kernel versions 2.4.24 and previous that may allow a
local attacker to gain root privileges. No exploit is currently
available; however this issue is exploitable. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CVE-2004-0077 to this issue.

Arjan van de Ven discovered a flaw in ncp_lookup() in ncpfs that could
allow local privilege escalation. ncpfs is only used to allow a system
to mount volumes of NetWare servers or print to NetWare printers. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2004-0010 to this issue.

All users are advised to upgrade to these errata packages, which
contain backported security patches that correct these issues.

Red Hat would like to thank Paul Starzetz from ISEC for reporting this
issue CVE-2004-0077.

Updated kernel packages that fix a security vulnerability that may
allow local users to gain root privileges are now available. These
packages also resolve other minor issues.

The Linux kernel handles the basic functions of the operating system.

Paul Starzetz discovered a flaw in return value checking in mremap()
in the Linux kernel versions 2.4.24 and previous that may allow a
local attacker to gain root privileges. No exploit is currently
available; however this issue is exploitable. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CVE-2004-0077 to this issue.

All users are advised to upgrade to these errata packages, which
contain backported security patches that correct these issues.

Red Hat would like to thank Paul Starzetz from ISEC for reporting this
issue.

For the IBM S/390 and IBM eServer zSeries architectures, the upstream
version of the s390utils package (which fixes a bug in the zipl
bootloader) is also included.

Updated kernel packages are now available that fix a few security
issues, an NFS performance issue, and an e1000 driver loading issue
introduced in Update 3.

The Linux kernel handles the basic functions of the operating system.

Alan Cox found issues in the R128 Direct Render Infrastructure that
could allow local privilege escalation. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CVE-2004-0003
to this issue.

The C-Media PCI sound driver in Linux before 2.4.22 does not use the
get_user function to access userspace in certain conditions, which
crosses security boundaries. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CVE-2003-0700 to this
issue.

An overflow was found in the ixj telephony card driver in Linux
kernels prior to 2.4.20. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CVE-2002-1574 to this
issue.

All users are advised to upgrade to these errata packages, which
contain backported security patches that corrects these issues. These
packages also contain a fix to enhance NFS performance, which was
degraded in the last kernel update as part of Update 3.

ID	Name	Severity
802032	ClamAV < 0.99.1 Multiple Vulnerabilities	High
802006	ClamAV < 0.99 Remote Denial of Service	Medium
802000	Perl 5.22 Buffer Overflow Vulnerability	High
801954	Cisco ASA < 9.5(2.2) IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	Critical
801953	Cisco ASA < 9.4(2.4) IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	Critical
801952	Cisco ASA < 9.3(3.7) IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	Critical
801951	Cisco ASA < 9.2(4.5) IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	Critical
801950	Cisco ASA < 9.1(7) IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	Critical
801949	Cisco ASA < 9.0(4.38) IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	Critical
801948	Cisco ASA < 8.7(1.18) IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	Critical
801947	Cisco ASA 8.6 IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	Critical
801946	Cisco ASA < 8.4(7.30) IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	Critical
801960	Cisco AnyConnect Secure Mobility Client 4.1(8) install-dmg.sh DMG File Installation Embedded PKG File Handling Local Privilege Escalation	High
800649	ISC dhclient < 3.1-ESV-R1 / 4.1-ESV-R2 / 4.2.1-P1 Remote Code Execution	High
802001	Perl Version Detection	Info
801969	WhatsUp Network Monitor Detected	Info
801968	Sonicwall Firewall	Info
801964	Cyberark Detected	Info
801959	Cisco AnyConnect Secure Mobility Client 2.0.0343 through 4.1.0 DLL Side Loading Local Privilege Escalation	High
801958	Cisco AnyConnect Secure Mobility Client 4.0(2049) Unspecified Path Traversal Arbitrary File Manipulation	Medium
801957	Cisco AnyConnect Secure Mobility Client 4.0(2049) Unspecified Out-of-bounds Read Local DoS	Medium
801956	Cisco AnyConnect Secure Mobility Client 4.0(2049) OS X Kernel Extension Local DoS	Medium
801955	Cisco AnyConnect Secure Mobility Client 3.1(60) Privilege Escalation Vulnerability	High
801944	VirtualBox < 4.3-4.3.28 Venom Vulnerability	High
801943	kvm < 83-272 el5+ Venom Vulnerability	High
801942	qemu-kvm-rhev < 2.1.2-23 el7 Venom Vulnerability	High
801941	qemu-kvm < 1.5.3-86 el6 Venom Vulnerability	High
801940	qemu-kvm < 0.12.1.2-2.448 el6 Venom Vulnerability	High
801939	xen < 3.0.3-146 Venom Vulnerability	High
801609	Red Hat 2005-294 Security Check	High
801608	Red Hat 2005-293 Security Check	High
801607	Red Hat 2005-283 Security Check	High
801605	Red Hat 2005-092 Security Check	High
801604	Red Hat 2005-043 Security Check	High
801603	Red Hat 2005-016 Security Check	High
801602	Red Hat 2004-689 Security Check	High
801601	Red Hat 2004-549 Security Check	High
801600	Red Hat 2004-505 Security Check	High
801599	Red Hat 2004-437 Security Check	High
801598	Red Hat 2004-418 Security Check	High
801597	Red Hat 2004-413 Security Check	High
801596	Red Hat 2004-360 Security Check	High
801595	Red Hat 2004-354 Security Check	High
801594	Red Hat 2004-255 Security Check	High
801593	Red Hat 2004-188 Security Check	High
801592	Red Hat 2004-183 Security Check	High
801591	Red Hat 2004-105 Security Check	High
801590	Red Hat 2004-069 Security Check	High
801589	Red Hat 2004-066 Security Check	High
801588	Red Hat 2004-044 Security Check	High

Generic Family for Log Correlation Engine