The specific version of ClamAV that the system is running is reportedly affected by the following vulnerabilities:

- ClamAV contains an unspecified off-by-one flaw in the htmlnorm functionality that may allow an attacker to cause an out-of-bounds write. No further details have been provided.

- ClamAV contains an out-of-bounds read flaw in the autoit functionality. This may allow a context-dependent attacker to crash the program or potentially disclose memory contents.

- ClamAV contains an out-of-bounds dereference issue that is triggered during the parsing of mbox files. This may allow a context-dependent attacker to have an unspecified impact.

- ClamAV contains a flaw that is triggered during the handling of a specially crafted 7z file. This may allow a context-dependent attacker to cause a memory overlay and crash the program, which can leave the system vulnerable to other attacks.


Cisco ClamAV contains a flaw that is triggered when handling the scan of a specially crafted document. This may allow a remote attacker to cause the Advance Malware Protection (AMP) process to restart.


Perl contains an overflow condition in the VDir::MapPathA() function. The issue is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
Technical Information: Note: Programming language vulnerability. This code is used in a wide variety of software and the issue may manifest in a number of different ways. Depending on the implementation, it varies if this vulnerability requires local access or may be exploited remotely.


The remote Cisco Adaptive Security Appliance (ASA) is missing a vendor-supplied security patch. It is, therefore, affected by a remote code execution vulnerability due to an overflow condition in the Internet Key Exchange (IKE) implementation. An unauthenticated, remote attacker can exploit this, via a specially crafted UDP packet, to cause a denial of service or the execution of arbitrary code. Note that only systems configured in routed firewall mode and single / multiple context mode are affected.

A vulnerability in the code responsible for the self-updating feature of Cisco AnyConnect Secure Mobility Client for Linux and the Cisco AnyConnect Secure Mobility Client for Mac OS X could allow an authenticated, local attacker to execute an arbitrary executable file of its choosing with privileges equivalent to the Linux or Mac OS X root account.

The vulnerability is due to lack of checks in the code for the path and filename of the file being installed. An attacker could exploit this vulnerability by invoking this functionality with a crafted installation file. A successful exploit could allow the attacker to execute commands on the underlying Linux or Mac OS X host with privileges equivalent to the root account.

ISC dhclient did not strip or escape certain shell meta-characters in responses from the dhcp server (like hostname) before passing the responses on to dhclient-script. Depending on the script and OS, this can result in execution of exploit code on the client.

Based on the system log, this system is running a WhatsUp Network Monitor.

The LCE observed a log which indicates this system is a Sonicwall firewall.

Based on the system log, this system is running Cyberark.

A vulnerability in interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker to move arbitrary files with elevated privileges.

The vulnerability is due to missing source path validation in certain IPC commands. An attacker could exploit this vulnerability by sending crafted IPC messages. An exploit could allow the attacker to move arbitrary files with elevated privileges, which could affect the integrity of the system and cause a denial of service condition.

A vulnerability in the connection establishment process of Cisco AnyConnect Secure Mobility Client could allow an unauthenticated, remote attacker to write or overwrite files in the active user's context.

The vulnerability is due to insufficient input validation. An unauthenticated, remote attacker could exploit this vulnerability by persuading a user to connect to a malicious head-end system. The malicious head-end system could be used to pass back crafted configuration attributes, which the attacker could leverage to execute a directory traversal attack. A successful exploit could allow the attacker to write or overwrite any file in the active user's context. The location or file must be writable by the user running the AnyConnect client.

A vulnerability in the kernel extension for Mac OS X of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker to cause a denial of service (DoS) condition.

The vulnerability is due to insufficient bounds checking. An attacker could exploit this vulnerability by crafting a piece of contiguous data in memory that is read by the client software. An exploit could allow the attacker to cause an OS X kernel panic.

The remote host is running a version of kvm which is vulnerable to an out-of-bounds memory access flaw, which can cause a crash or execution of arbitrary code on the host.

The remote host is running a version of qemu-kvm-rhev which is vulnerable to an out-of-bounds memory access flaw, which can cause a crash or execution of arbitrary code on the host.

The remote host is running a version of qemu-kvm which is vulnerable to an out-of-bounds memory access flaw, which can cause a crash or execution of arbitrary code on the host.

The remote host is running a version of xen which is vulnerable to an out-of-bounds memory access flaw, which can cause a crash or execution of arbitrary code on the host.

Updated kernel packages that fix several security issues in the Red
Hat Enterprise Linux 3 kernel are now available.

This security advisory has been rated as having important security
impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

The following security issues were fixed :

The Vicam USB driver did not use the copy_from_user function to access
userspace, crossing security boundaries. (CVE-2004-0075)

The ext3 and jfs code did not properly initialize journal descriptor
blocks. A privileged local user could read portions of kernel memory.
(CVE-2004-0177)

The terminal layer did not properly lock line discipline changes or
pending IO. An unprivileged local user could read portions of kernel
memory, or cause a denial of service (system crash). (CVE-2004-0814)

A race condition was discovered. Local users could use this flaw to
read the environment variables of another process that is still
spawning via /proc/.../cmdline. (CVE-2004-1058)

A flaw in the execve() syscall handling was discovered, allowing a
local user to read setuid ELF binaries that should otherwise be
protected by standard permissions. (CVE-2004-1073). Red Hat originally
reported this as being fixed by RHSA-2004:549, but the associated fix
was missing from that update.

Keith Owens reported a flaw in the Itanium unw_unwind_to_user()
function. A local user could use this flaw to cause a denial of
service (system crash) on the Itanium architecture. (CVE-2005-0135)

A missing Itanium syscall table entry could allow an unprivileged
local user to cause a denial of service (system crash) on the Itanium
architecture. (CVE-2005-0137)

A flaw affecting the OUTS instruction on the AMD64 and Intel EM64T
architectures was discovered. A local user could use this flaw to
access privileged IO ports. (CVE-2005-0204)

A flaw was discovered in the Linux PPP driver. On systems allowing
remote users to connect to a server using ppp, a remote client could
cause a denial of service (system crash). (CVE-2005-0384)

A flaw in the Red Hat backport of NPTL to Red Hat Enterprise Linux 3
was discovered that left a pointer to a freed tty structure. A local
user could potentially use this flaw to cause a denial of service
(system crash) or possibly gain read or write access to ttys that
should normally be prevented. (CVE-2005-0403)

A flaw in fragment queuing was discovered affecting the netfilter
subsystem. On systems configured to filter or process network packets
(for example those configured to do firewalling), a remote attacker
could send a carefully crafted set of fragmented packets to a machine
and cause a denial of service (system crash). In order to sucessfully
exploit this flaw, the attacker would need to know (or guess) some
aspects of the firewall ruleset in place on the target system to be
able to craft the right fragmented packets. (CVE-2005-0449)

Missing validation of an epoll_wait() system call parameter could
allow a local user to cause a denial of service (system crash) on the
IBM S/390 and zSeries architectures. (CVE-2005-0736)

A flaw when freeing a pointer in load_elf_library was discovered. A
local user could potentially use this flaw to cause a denial of
service (system crash). (CVE-2005-0749)

A flaw was discovered in the bluetooth driver system. On system where
the bluetooth modules are loaded, a local user could use this flaw to
gain elevated (root) privileges. (CVE-2005-0750)

In addition to the security issues listed above, there was an
important fix made to the handling of the msync() system call for a
particular case in which the call could return without queuing
modified mmap()'ed data for file system update. (BZ 147969)

Note: The kernel-unsupported package contains various drivers and
modules that are unsupported and therefore might contain security
problems that have not been addressed.

Red Hat Enterprise Linux 3 users are advised to upgrade their kernels
to the packages associated with their machine
architectures/configurations

Please note that the fix for CVE-2005-0449 required changing the
external symbol linkages (kernel module ABI) for the ip_defrag() and
ip_ct_gather_frags() functions. Any third-party module using either of
these would also need to be fixed.


Updated kernel packages are now available as part of ongoing support
and maintenance of Red Hat Enterprise Linux version 2.1. This is the
seventh regular update.

This security advisory has been rated as having important security
impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

This is the seventh regular kernel update to Red Hat Enterprise Linux
2.1

The following security updates were made :

A flaw in fragment queuing was discovered that affected the Linux 2.4
and Linux 2.6 kernel netfilter subsystem. On systems configured to
filter or process network packets (for example those configured to do
firewalling), a remote attacker could send a carefully crafted set of
fragmented packets to a machine and cause a denial of service (system
crash). In order to sucessfully exploit this flaw, the attacker would
need to know (or guess) some aspects of the firewall ruleset in place
on the target system to be able to craft the right fragmented packets.
(CVE-2005-0449)

A flaw was discovered in the Linux PPP driver. On systems allowing
remote users to connect to a server using ppp, a remote client could
cause a denial of service (system crash). (CVE-2005-0384)

A flaw was discovered in the bluetooth driver system. On system where
the bluetooth modules are loaded, a local user could use this flaw to
gain elevated (root) privileges. (CVE-2005-0750)

An integer overflow flaw was discovered in the ubsec_keysetup function
in the Broadcom 5820 cryptonet driver. On systems using this driver, a
local user could cause a denial of service (crash) or possibly gain
elevated privileges. (CVE-2004-0619) Please note that this update
contains an unpatched kernel module called bcm5820_old for backwards
compatibility which is still vulnerable to CVE-2004-0619.

The following device drivers have been updated to new versions :

mptfusion: 2.05.16 -> 2.05.16.02 bcm5820: 1.17 -> 1.81 cciss: 2.4.52
-> 2.4.54 qla2x00: 6.04.01 -> 7.01.01

There were many bug fixes in various parts of the kernel. The ongoing
effort to resolve these problems has resulted in a marked improvement
in the reliability and scalability of Red Hat Enterprise Linux 2.1.

Bug fixes include: - Fixes an incorrect and ever-changing physical_id
field in /proc/cpuinfo. - Now recognizes a particular e1000 device
(PCI ID 8086:1014) - Fixes a panic in disk quota code - Fixes a bug in
which msync(...MS_SYNC) returns before the data is written to disk -
Adds new devices to the SCSI scan list so they can be initialized and
handled properly: LSI ProFibre 4000R, HP HSV200/210, HP MSA, STK
OPENstorage D178. - Fixes a potential format overflow in
/proc/partitions - Restores module parameters to the e100 driver for
compatibility with existing customer scripts. - Fixes a bug in which
cat'ing /proc/mdstat while adding/removing devices can cause a kernel
oops

All Red Hat Enterprise Linux 2.1 users are advised to upgrade their
kernels to the packages associated with their machine architectures
and configurations as listed in this erratum.

Please note that a vulnerability addressed by this update
(CVE-2005-0449) required a change to the kernel module ABI which could
cause third party modules to not work. However, Red Hat is currently
not aware of any module that would be affected by this change.


Updated kernel packages that fix several security issues are now
available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the
Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

This advisory includes fixes for several security issues :

iSEC Security Research discovered multiple vulnerabilities in the IGMP
functionality. These flaws could allow a local user to cause a denial
of service (crash) or potentially gain privileges. Where multicast
applications are being used on a system, these flaws may also allow
remote users to cause a denial of service. The Common Vulnerabilities
and Exposures project (cve.mitre.org) has assigned the name
CVE-2004-1137 to this issue.

iSEC Security Research discovered a flaw in the page fault handler
code that could lead to local users gaining elevated (root) privileges
on multiprocessor machines. (CVE-2005-0001)

iSEC Security Research discovered a VMA handling flaw in the uselib(2)
system call of the Linux kernel. A local user could make use of this
flaw to gain elevated (root) privileges. (CVE-2004-1235)

A flaw affecting the OUTS instruction on the AMD64 and Intel EM64T
architecture was discovered. A local user could use this flaw to write
to privileged IO ports. (CVE-2005-0204)

The Direct Rendering Manager (DRM) driver in Linux kernel 2.6 does not
properly check the DMA lock, which could allow remote attackers or
local users to cause a denial of service (X Server crash) or possibly
modify the video output. (CVE-2004-1056)

OGAWA Hirofumi discovered incorrect tables sizes being used in the
filesystem Native Language Support ASCII translation table. This could
lead to a denial of service (system crash). (CVE-2005-0177)

Michael Kerrisk discovered a flaw in the 2.6.9 kernel which allows
users to unlock arbitrary shared memory segments. This flaw could lead
to applications not behaving as expected. (CVE-2005-0176)

Improvements in the POSIX signal and tty standards compliance exposed
a race condition. This flaw can be triggered accidentally by threaded
applications or deliberately by a malicious user and can result in a
denial of service (crash) or in occasional cases give access to a
small random chunk of kernel memory. (CVE-2005-0178)

The PaX team discovered a flaw in mlockall introduced in the 2.6.9
kernel. An unprivileged user could use this flaw to cause a denial of
service (CPU and memory consumption or crash). (CVE-2005-0179)

Brad Spengler discovered multiple flaws in sg_scsi_ioctl in the 2.6
kernel. An unprivileged user may be able to use this flaw to cause a
denial of service (crash) or possibly other actions. (CVE-2005-0180)

Kirill Korotaev discovered a missing access check regression in the
Red Hat Enterprise Linux 4 kernel 4GB/4GB split patch. On systems
using the hugemem kernel, a local unprivileged user could use this
flaw to cause a denial of service (crash). (CVE-2005-0090)

A flaw in the Red Hat Enterprise Linux 4 kernel 4GB/4GB split patch
can allow syscalls to read and write arbitrary kernel memory. On
systems using the hugemem kernel, a local unprivileged user could use
this flaw to gain privileges. (CVE-2005-0091)

An additional flaw in the Red Hat Enterprise Linux 4 kernel 4GB/4GB
split patch was discovered. On x86 systems using the hugemem kernel, a
local unprivileged user may be able to use this flaw to cause a denial
of service (crash). (CVE-2005-0092)

All Red Hat Enterprise Linux 4 users are advised to upgrade their
kernels to the packages associated with their machine architectures
and configurations as listed in this erratum.


Updated kernel packages that fix several security issues in Red Hat
Enterprise Linux 3 are now available.

The Linux kernel handles the basic functions of the operating system.

This advisory includes fixes for several security issues :

iSEC Security Research discovered a VMA handling flaw in the uselib(2)
system call of the Linux kernel. A local user could make use of this
flaw to gain elevated (root) privileges. The Common Vulnerabilities
and Exposures project (cve.mitre.org) has assigned the name
CVE-2004-1235 to this issue.

A flaw was discovered where an executable could cause a VMA overlap
leading to a crash. A local user could trigger this flaw by creating a
carefully crafted a.out binary on 32-bit systems or a carefully
crafted ELF binary on Itanium systems. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CVE-2005-0003
to this issue.

iSEC Security Research discovered a flaw in the page fault handler
code that could lead to local users gaining elevated (root) privileges
on multiprocessor machines. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CVE-2005-0001 to this
issue. A patch that coincidentally fixed this issue was committed to
the Update 4 kernel release in December 2004. Therefore Red Hat
Enterprise Linux 3 kernels provided by RHBA-2004:550 and subsequent
updates are not vulnerable to this issue.

A flaw in the system call filtering code in the audit subsystem
included in Red Hat Enterprise Linux 3 allowed a local user to cause a
crash when auditing was enabled. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CVE-2004-1237
to this issue.

Olaf Kirch discovered that the recent security fixes for cmsg_len
handling (CVE-2004-1016) broke 32-bit compatibility on 64-bit
platforms such as AMD64 and Intel EM64T. A patch to correct this issue
is included.

A recent Internet Draft by Fernando Gont recommended that ICMP Source
Quench messages be ignored by hosts. A patch to ignore these messages
is included.

Note: The kernel-unsupported package contains various drivers and
modules that are unsupported and therefore might contain security
problems that have not been addressed.

All Red Hat Enterprise Linux 3 users are advised to upgrade their
kernels to the packages associated with their machine architectures
and configurations as listed in this erratum.


Updated kernel packages that fix several security issues in Red Hat
Enterprise Linux 3 are now available.

The Linux kernel handles the basic functions of the operating system.

This advisory includes fixes for several security issues :

Petr Vandrovec discovered a flaw in the 32bit emulation code affecting
the Linux 2.4 kernel on the AMD64 architecture. A local attacker could
use this flaw to gain privileges. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CVE-2004-1144
to this issue.

ISEC security research discovered multiple vulnerabilities in the IGMP
functionality which was backported in the Red Hat Enterprise Linux 3
kernels. These flaws could allow a local user to cause a denial of
service (crash) or potentially gain privileges. Where multicast
applications are being used on a system, these flaws may also allow
remote users to cause a denial of service. The Common Vulnerabilities
and Exposures project (cve.mitre.org) has assigned the name
CVE-2004-1137 to this issue.

ISEC security research and Georgi Guninski independantly discovered a
flaw in the scm_send function in the auxiliary message layer. A local
user could create a carefully crafted auxiliary message which could
cause a denial of service (system hang). The Common Vulnerabilities
and Exposures project (cve.mitre.org) has assigned the name
CVE-2004-1016 to this issue.

A floating point information leak was discovered in the ia64
architecture context switch code. A local user could use this flaw to
read register values of other processes by setting the MFH bit. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2004-0565 to this issue.

Kirill Korotaev found a flaw in load_elf_binary affecting kernels
prior to 2.4.26. A local user could create a carefully crafted binary
in such a way that it would cause a denial of service (system crash).
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2004-1234 to this issue.

These packages also fix issues in the io_edgeport driver, and a memory
leak in ip_options_get.

Note: The kernel-unsupported package contains various drivers and
modules that are unsupported and therefore might contain security
problems that have not been addressed.

All Red Hat Enterprise Linux 3 users are advised to upgrade their
kernels to the packages associated with their machine architectures
and configurations as listed in this erratum.


Updated kernel packages are now available as part of ongoing support
and maintenance of Red Hat Enterprise Linux version 2.1. This is the
fifth regular update.

The Linux kernel handles the basic functions of the operating system.

This is the fifth regular kernel update to Red Hat Enterprise Linux
version 2.1. It contains one minor security fix, many bug fixes, and
updates a number of device drivers.

A bug in the SoundBlaster 16 code which did not properly handle
certain sample sizes has been fixed. This flaw could be used by local
users to crash a system. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CVE-2004-0178 to this
issue.

The following drivers have also been updated :

* cciss v2.4.52 * e1000 v5252k1 * e100 v2.3.43-k1 * fusion v2.05.16 *
ips v7.00.15 * aacraid v1.1.5 * megaraid2 v2.10.6

All Red Hat Enterprise Linux 2.1 users are advised to upgrade their
kernels to the packages associated with their machine architectures
and configurations as listed in this erratum.


Updated kernel packages that fix several security issues in Red Hat
Enterprise Linux 3 are now available.

The Linux kernel handles the basic functions of the operating system.

Paul Starzetz discovered flaws in the Linux kernel when handling file
offset pointers. These consist of invalid conversions of 64 to 32-bit
file offset pointers and possible race conditions. A local
unprivileged user could make use of these flaws to access large
portions of kernel memory. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CVE-2004-0415 to this
issue.

These packages contain a patch written by Al Viro to correct these
flaws. Red Hat would like to thank iSEC Security Research for
disclosing this issue and a number of vendor-sec participants for
reviewing and working on the patch to this issue.

In addition, these packages correct a number of minor security 
issues :

An bug in the e1000 network driver. This bug could be used by local
users to leak small amounts of kernel memory (CVE-2004-0535).

A bug in the SoundBlaster 16 code which does not properly handle
certain sample sizes. This flaw could be used by local users to crash
a system (CVE-2004-0178).

A possible NULL-pointer dereference in the Linux kernel prior to
2.4.26 on the Itanium platform could allow a local user to crash a
system (CVE-2004-0447).

Inappropriate permissions on /proc/scsi/qla2300/HbaApiNode
(CVE-2004-0587).

All Red Hat Enterprise Linux 3 users are advised to upgrade their
kernels to the packages associated with their machine architectures
and configurations as listed in this erratum.


Updated kernel packages that fix a security vulnerability affecting
the kernel nfs server for Red Hat Enterprise Linux 3 are now
available.

The Linux kernel handles the basic functions of the operating system.

During an audit of the Linux kernel, SUSE discovered a flaw that
allowed a user to make unauthorized changes to the group ID of files
in certain circumstances. In the 2.4 kernel, as shipped with Red Hat
Enterprise Linux, the only way this could happen is through the kernel
nfs server. A user on a system that mounted a remote file system from
a vulnerable machine may be able to make unauthorized changes to the
group ID of exported files. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CVE-2004-0497 to this
issue.

Only Red Hat Enterprise Linux systems that are configured to share
file systems via NFS are affected by this issue.

All Red Hat Enterprise Linux 3 users are advised to upgrade their
kernels to the packages associated with their machine architectures
and configurations as listed in this erratum.


Updated kernel packages that fix a security vulnerability affecting
the kernel nfs server for Red Hat Enterprise Linux 2.1 are now
available.

The Linux kernel handles the basic functions of the operating system.

During an audit of the Linux kernel, SUSE discovered a flaw that
allowed a user to make unauthorized changes to the group ID of files
in certain circumstances. In the 2.4 kernel, as shipped with Red Hat
Enterprise Linux, the only way this could happen is through the kernel
nfs server. A user on a system that mounted a remote file system from
a vulnerable machine may be able to make unauthorized changes to the
group ID of exported files. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CVE-2004-0497 to this
issue.

Only Red Hat Enterprise Linux systems that are configured to share
file systems via NFS are affected by this issue.

All Red Hat Enterprise Linux 2.1 users are advised to upgrade their
kernels to the packages associated with their machine architectures
and configurations as listed in this erratum. These packages contain a
backported patch to correct this issue.


Updated kernel packages are now available as part of ongoing support
and maintenance of Red Hat Enterprise Linux version 3. This is the
second regular update.

The Linux kernel handles the basic functions of the operating system.

This is the second regular kernel update to Red Hat Enterprise Linux
version 3. It contains several minor security fixes, many bug fixes,
device driver updates, new hardware support, and the introduction of
Linux Syscall Auditing support.

There were bug fixes in many different parts of the kernel, the bulk
of which addressed unusual situations such as error handling, race
conditions, and resource starvation. The combined effect of the
approximately 140 fixes is a strong improvement in the reliability and
durability of Red Hat Enterprise Linux. Some of the key areas affected
are disk drivers, network drivers, USB support, x86_64 and ppc64
platform support, ia64 32-bit emulation layer enablers, and the VM,
NFS, IPv6, and SCSI subsystems.

A significant change in the SCSI subsystem (the disabling of the
scsi-affine-queue patch) should significantly improve SCSI disk driver
performance in many scenarios. There were 10 Bugzillas against SCSI
performance problems addressed by this change.

The following drivers have been upgraded to new versions :

bonding ---- 2.4.1 cciss ------ 2.4.50.RH1 e1000 ------ 5.2.30.1-k1
fusion ----- 2.05.11.03 ipr -------- 1.0.3 ips -------- 6.11.07
megaraid2 -- 2.10.1.1 qla2x00 ---- 6.07.02-RH1 tg3 -------- 3.1
z90crypt --- 1.1.4

This update introduces support for the new Intel EM64T processor. A
new 'ia32e' architecture has been created to support booting on
platforms based on either the original AMD Opteron CPU or the new
Intel EM64T CPU. The existing 'x86_64' architecture has remained
optimized for Opteron systems. Kernels for both types of systems are
built from the same x86_64-architecture sources and share a common
kernel source RPM (kernel-source-2.4.21-15.EL.x86_64.rpm).

Other highlights in this update include a major upgrade to the SATA
infrastructure, addition of IBM JS20 Power Blade support, and creation
of an optional IBM eServer zSeries On-Demand Timer facility for
reducing idle CPU overhead.

The following security issues were addressed in this update :

A minor flaw was found where /proc/tty/driver/serial reveals the exact
character counts for serial links. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CVE-2003-0461
to this issue.

The kernel strncpy() function in Linux 2.4 and 2.5 does not pad the
target buffer with null bytes on architectures other than x86, as
opposed to the expected libc behavior, which could lead to information
leaks. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CVE-2003-0465 to this issue.

A minor data leak was found in two real time clock drivers (for
/dev/rtc). The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CVE-2003-0984 to this issue.

A flaw in the R128 Direct Render Infrastructure (dri) driver could
allow local privilege escalation. This driver is part of the
kernel-unsupported package. The Common Vulnera- bilities and Exposures
project (cve.mitre.org) has assigned the name CVE-2004-0003 to this
issue.

A flaw in ncp_lookup() in ncpfs could allow local privilege
escalation. The ncpfs module allows a system to mount volumes of
NetWare servers or print to NetWare printers and is in the
kernel-unsupported package. The Common Vulnera- bilities and Exposures
project (cve.mitre.org) has assigned the name CVE-2004-0010 to this
issue.

(Note that the kernel-unsupported package contains drivers and other
modules that are unsupported and therefore might contain security
problems that have not been addressed.)

All Red Hat Enterprise Linux 3 users are advised to upgrade their
kernels to the packages associated with their machine architectures
and configurations as listed in this erratum.


Updated kernel packages that fix a security vulnerability which may
allow local users to gain root privileges are now available.

The Linux kernel handles the basic functions of the operating system.

This kernel updates several drivers and fixes a number of bugs,
including a potential security vulnerability.

iDefense reported a buffer overflow flaw in the ISO9660 filesystem
code. An attacker could create a malicious filesystem in such a way
that root privileges may be obtained if the filesystem is mounted. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2004-0109 to this issue.

The following drivers were updated :

LSI megaraid2 v2.10.1.1 IBM Serveraid v. 6.11.07 MPT Fusion
v.2.05.11.03

All users are advised to upgrade to these errata packages, which
contain a backported security patch that corrects this issue.


Updated kernel packages that fix a security vulnerability which may
allow local users to gain root privileges are now available.

[Updated 5 March 2004] Added kernel-headers packages

The Linux kernel handles the basic functions of the operating system.

Paul Starzetz discovered a flaw in return value checking in mremap()
in the Linux kernel versions 2.4.24 and previous that may allow a
local attacker to gain root privileges. No exploit is currently
available; however this issue is exploitable. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CVE-2004-0077 to this issue.

Arjan van de Ven discovered a flaw in ncp_lookup() in ncpfs that could
allow local privilege escalation. ncpfs is only used to allow a system
to mount volumes of NetWare servers or print to NetWare printers. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2004-0010 to this issue.

All users are advised to upgrade to these errata packages, which
contain backported security patches that correct these issues.

Red Hat would like to thank Paul Starzetz from ISEC for reporting this
issue CVE-2004-0077.


Updated kernel packages that fix a security vulnerability that may
allow local users to gain root privileges are now available. These
packages also resolve other minor issues.

The Linux kernel handles the basic functions of the operating system.

Paul Starzetz discovered a flaw in return value checking in mremap()
in the Linux kernel versions 2.4.24 and previous that may allow a
local attacker to gain root privileges. No exploit is currently
available; however this issue is exploitable. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CVE-2004-0077 to this issue.

All users are advised to upgrade to these errata packages, which
contain backported security patches that correct these issues.

Red Hat would like to thank Paul Starzetz from ISEC for reporting this
issue.

For the IBM S/390 and IBM eServer zSeries architectures, the upstream
version of the s390utils package (which fixes a bug in the zipl
bootloader) is also included.


Updated kernel packages are now available as part of ongoing support
and maintenance of Red Hat Enterprise Linux version 3. This is the
first regular update.

The Linux kernel handles the basic functions of the operating system.

This is the first regular kernel update for Red Hat Enterprise Linux
version 3. It contains a new critical security fix, many other bug
fixes, several device driver updates, and numerous performance and
scalability enhancements.

On AMD64 systems, a fix was made to the eflags checking in 32-bit
ptrace emulation that could have allowed local users to elevate their
privileges. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CVE-2004-0001 to this issue.

Other bug fixes were made in the following kernel areas: VM, NPTL,
IPC, kernel timer, ext3, NFS, netdump, SCSI, ACPI, several device
drivers, and machine-dependent support for the x86_64, ppc64, and s390
architectures.

The VM subsystem was improved to better handle extreme loads and
resource contention (such as might occur during heavy database
application usage). This has resulted in a significantly reduced
possibility of hangs, OOM kills, and low-mem exhaustion.

Several NPTL fixes were made to resolve POSIX compliance issues
concerning process IDs and thread IDs. A section in the Release Notes
elaborates on a related issue with file record locking in
multi-threaded applications.

AMD64 kernels are now configured with NUMA support, S390 kernels now
have CONFIG_BLK_STATS enabled, and DMA capability was restored in the
IA64 agpgart driver.

The following drivers have been upgraded to new versions :

cmpci ------ 6.36 e100 ------- 2.3.30-k1 e1000 ------ 5.2.20-k1 ips
-------- 6.10.52 megaraid --- v1.18k megaraid2 -- v2.00.9

All Red Hat Enterprise Linux 3 users are advised to upgrade their
kernels to the packages associated with their machine architectures
and configurations as listed in this erratum.


Updated kernel packages are now available that fix a security
vulnerability which may allow local users to gain root privileges.

The Linux kernel handles the basic functions of the operating system.

Paul Starzetz discovered a flaw in bounds checking in mremap() in the
Linux kernel versions 2.4.23 and previous which may allow a local
attacker to gain root privileges. No exploit is currently available;
however, it is believed that this issue is exploitable (although not
trivially.) The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CVE-2003-0985 to this issue.

All users of Red Hat Enterprise Linux 3 are advised to upgrade to
these errata packages, which contain a backported security patch that
corrects this issue.

Red Hat would like to thank Paul Starzetz from ISEC for disclosing
this issue as well as Andrea Arcangeli and Solar Designer for working
on the patch.


Updated kernel packages that address various security vulnerabilities,
fix a number of bugs, and update various drivers are now available.

The Linux kernel handles the basic functions of the operating system.

The execve system call in Linux 2.4.x records the file descriptor of
the executable process in the file table of the calling process, which
allows local users to gain read access to restricted file descriptors.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2003-0476 to this issue.

A number of bugfixes are included, including important fixes for the
ext3 file system and timer code.

New features include limited support for non-cached NFS file sytems,
Serial ATA (SATA) devices, and new alt-sysreq debugging options.

In addition, the following drivers have been updated :

  - e100 2.3.30-k1 - e1000 5.2.20-k1 - fusion 2.05.05+ - ips
    6.10.52 - aic7xxx 6.2.36 - aic79xxx 1.3.10 - megaraid 2
    2.00.9 - cciss 2.4.49

All users are advised to upgrade to these erratum packages, which
contain backported patches addressing these issues.


Updated kernel packages that address various security vulnerabilities
are now available for Red Hat Enterprise Linux.

The Linux kernel handles the basic functions of the operating system.

Security issues have been found that affect the versions of the Linux
kernel shipped with Red Hat Enterprise Linux :

CVE-2003-0462: Paul Starzetz discovered a file read race condition
existing in the execve() system call, which could cause a local crash.

CVE-2003-0501: The /proc filesystem in Linux allows local users to
obtain sensitive information by opening various entries in /proc/self
before executing a setuid program. This causes the program to fail to
change the ownership and permissions of already opened entries.

CVE-2003-0550: The STP protocol is known to have no security, which
could allow attackers to alter the bridge topology. STP is now turned
off by default.

CVE-2003-0551: STP input processing was lax in its length checking,
which could lead to a denial of service (DoS).

CVE-2003-0552: Jerry Kreuscher discovered that the Forwarding table
could be spoofed by sending forged packets with bogus source addresses
the same as the local host.

CVE-2003-0619: An integer signedness error in the decode_fh function
of nfs3xdr.c allows remote attackers to cause a denial of service
(kernel panic) via a negative size value within XDR data of an NFSv3
procedure call.

CVE-2003-0699: The C-Media PCI sound driver in Linux kernel versions
prior to 2.4.21 accesses userspace without using the get_user
function, which is a potential security hole.

All users are advised to upgrade to these erratum packages, which
contain backported security patches correcting these vulnerabilities.


This update fixes several minor security related issues.

A problem was discovered where users could reprogram keys, leaving
'traps' for the next user of a console. The ability has been
restricted to root.

A 32 bit integer overflow was discovered in the
invalidate_inode_pages2() function which could lead to a local denial
of service attack.


Updated kernel packages for Red Hat Enterprise Linux are now available
which address several security vulnerabilities.

The Linux kernel handles the basic functions of the operating system.

Several security issues have been found that affect the Linux kernel :

Al Viro found a security issue in the tty layer whereby any user could
cause a kernel oops. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CVE-2003-0247 to this issue.

Andrea Arcangeli found an issue in the low-level mxcsr code in which a
malformed address would leave garbage in cpu state registers. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2003-0248 to this issue.

The TCP/IP fragment reassembly handling allows remote attackers to
cause a denial of service (CPU consumption) via packets that cause a
large number of hash table collisions, a vulnerability similar to
CVE-2003-0244. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CVE-2003-0364 to this issue.

These kernels also contain updated fixes for the ioperm security
issue, as well as fixes for a number of bugs.

It is recommended that users upgrade to these erratum kernels, which
contain patches to correct these vulnerabilities.


These updated kernel packages address security vulnerabilities,
including two possible data corruption scenarios. In addition, a
number of drivers have been updated, improvements made to system
performance, and various issues have been resolved.

The Linux kernel handles the basic functions of the operating system.

Two potential data corruption scenarios have been identified. These
scenarios can occur under heavy, complex I/O loads.

The first scenario only occurs while performing memory mapped file
I/O, where the file is simultaneously unlinked and the corresponding
file blocks reallocated. Furthermore, the memory mapped must be to a
partial page at the end of a file on an ext3 file system. As such, Red
Hat considers this scenario unlikely.

The second scenario was exhibited in systems with more than 4 GB of
memory with a storage controller capable of block device DMA above 4GB
(64-bit DMA). By restricting storage drivers to 32-bit DMA, the
problem was resolved. Prior to this errata, the SCSI subsystem was
already restricted to 32-bit DMA; this errata extends the restriction
to block drivers as well. The change consists of disabling 64-bit DMA
in the cciss driver (the HP SA5xxx and SA6xxx RAID controllers). The
performance implications of this change to the cciss driver are
minimal.

In addition, the following security vulnerabilities have been
addressed :

A flaw was found in several hash table implementations in the kernel
networking code. A remote attacker sending packets with carefully
chosen, forged source addresses could potentially cause every routing
cache entry to be hashed into the same hash chain. As a result, the
kernel would use a disproportionate amount of processor time to deal
with the new packets, leading to a remote denial-of-service (DoS)
attack. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CVE-2003-0244 to this issue.

A flaw was also found in the 'ioperm' system call, which fails to
properly restrict privileges. This flaw can allow an unprivileged
local user to gain read and write access to I/O ports on the system.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2003-0246 to this issue.

In addition, the following drivers have been updated to the versions
indicated :

-aacraid: 0.9.9ac6-TEST -qlogic qla2100, qla2200, qla2300: 6.04.01
-aic7xxx_mod: 6.2.30 and aic79xx: 1.3.4 -ips: v6.00.26 -cpqfc: 2.1.2
-fusion: 2.05.00 -e100: 2.2.21-k1 -e1000: 5.0.43-k1, and added netdump
support -natsemi: 1.07+LK1.0.17 -cciss: 2.4.45. -cpqarray: 2.4.26

If the system is configured to use alternate drivers, we recommend
applying the kudzu errata RHEA-2003:132 prior to updating the kernel.

A number of edge conditions in the virtual memory system have been
identified and resolved. These included the elimination of memory
allocation failures occuring when the system had not depleted all of
the physical memory. This would typically lead to process creation and
network driver failures, and general performance degradation.
Additional memory reclamation improvements were introduced to further
smooth out the natural system performance degradation that occur under
memory exhaustion conditions.

In addition, the latest summit patches have been included.

All users should upgrade to these errata packages, which address these
issues.


The remote host is running a kernel which is vulnerable to a remote denial 
of service.  

The Linux kernel handles all the low-level functionality of the Operating
System.  This version of the kernel is vulnerable to a flaw wherein a remote
attacker can forge source IP addresses in such a way as to create a very
long routing hash chain.  An attacker, exploiting this flaw, would need
the ability to craft TCP/IP packets destined to (or through) the Linux kernel.
A successful attack would shut down the server.


Updated kernel packages are now available that fix a ptrace-related
vulnerability which can lead to elevated (root) privileges.

The Linux kernel handles the basic functions of the operating system.
A vulnerability has been found in version 2.4.18 of the kernel.

This vulnerability allows a local user to gain elevated (root)
privileges without authorization.

All users should upgrade to these errata packages, which contain
patches to fix the vulnerability.


The kernel in Red Hat Linux Advanced Server 2.1 is vulnerable to a
local denial of service attack. Updated packages are available which
address this vulnerability.

[Updated 28 August 2003] Added CVE-2003-0461 to the list of security
issues that were fixed by this advisory (there are no changes to the
packages themselves).

The Linux kernel handles the basic functions of the operating system.
A vulnerability in the Linux kernel has been discovered in which a
non-root user can cause the machine to freeze. This kernel addresses
the vulnerability.

Note: This bug is specific to the x86 architecture kernels only, and
does not affect ia64 or other architectures.

In addition, /proc/tty/driver/serial reveals the exact number of
characters used in serial links, which could allow local users to
obtain potentially sensitive information such as password lengths.

All users should upgrade to these errata packages, which are not
vulnerable to these issues.

Thanks go to Christopher Devine for reporting the vulnerability on
Bugtraq, and Petr Vandrovec for being the first to supply a fix to the
community.


This kernel update for Red Hat Linux Advanced Server 2.1 addresses
some security issues and provides minor bug fixes.

The Linux kernel handles the basic functions of the operating system.
A number of vulnerabilities were found in the Red Hat Linux Advanced
Server kernel. These vulnerabilities could allow a local user to
obtain elevated (root) privileges.

The vulnerabilities existed in a number of drivers, including stradis,
rio500, se401, apm, usbserial, and usbvideo.

Additionally, a number of bugs have been fixed, and some small feature
enhancements have been added.

  - Failed READA requests could be interpreted as I/O errors
    under high load on SMP; this has been fixed.

  - In rare cases, TLB entries could be corrupted on SMP
    Pentium IV systems; this potential for corruption has
    been fixed. Third-party modules will need to be
    recompiled to take advantage of these fixes.

  - The latest tg3 driver fixes have been included; the tg3
    driver now supports more hardware.

  - A mechanism is provided to specify the location of core
    files and to set the name pattern to include the UID,
    program, hostname, and PID of the process that caused
    the core dump.

A number of SCSI fixes have also been included :

  - Configure sparse LUNs in the qla2200 driver - Clean up
    erroneous accounting data as seen by /proc/partitions
    and iostat - Allow up to 128 scsi disks - Do not start
    logical units that require manual intervention, avoiding
    unnecessary startup delays - Improve SCSI layer
    throughput by properly clustering DMA requests

All users of Red Hat Linux Advanced Server are advised to upgrade to
the errata packages.


ID	Name	Severity
802032	ClamAV < 0.99.1 Multiple Vulnerabilities	high
802006	ClamAV < 0.99 Remote Denial of Service	medium
802000	Perl 5.22 Buffer Overflow Vulnerability	high
801954	Cisco ASA < 9.5(2.2) IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	critical
801953	Cisco ASA < 9.4(2.4) IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	critical
801952	Cisco ASA < 9.3(3.7) IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	critical
801951	Cisco ASA < 9.2(4.5) IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	critical
801950	Cisco ASA < 9.1(7) IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	critical
801949	Cisco ASA < 9.0(4.38) IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	critical
801948	Cisco ASA < 8.7(1.18) IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	critical
801947	Cisco ASA 8.6 IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	critical
801946	Cisco ASA < 8.4(7.30) IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	critical
801960	Cisco AnyConnect Secure Mobility Client 4.1(8) install-dmg.sh DMG File Installation Embedded PKG File Handling Local Privilege Escalation	high
800649	ISC dhclient < 3.1-ESV-R1 / 4.1-ESV-R2 / 4.2.1-P1 Remote Code Execution	high
802001	Perl Version Detection	info
801969	WhatsUp Network Monitor Detected	info
801968	Sonicwall Firewall	info
801964	Cyberark Detected	info
801961	Cisco AnyConnect Secure Mobility Client 2.0.0343 through 4.1(8) IPC Channel Source-path Validation Failure Local File Location Manipulation	medium
801958	Cisco AnyConnect Secure Mobility Client 4.0(2049) Unspecified Path Traversal Arbitrary File Manipulation	medium
801957	Cisco AnyConnect Secure Mobility Client 4.0(2049) Unspecified Out-of-bounds Read Local DoS	medium
801956	Cisco AnyConnect Secure Mobility Client 4.0(2049) OS X Kernel Extension Local DoS	medium
801943	kvm < 83-272 el5+ Venom Vulnerability	high
801942	qemu-kvm-rhev < 2.1.2-23 el7 Venom Vulnerability	high
801940	qemu-kvm < 0.12.1.2-2.448 el6 Venom Vulnerability	high
801939	xen < 3.0.3-146 Venom Vulnerability	high
801608	Red Hat 2005-293 Security Check	high
801607	Red Hat 2005-283 Security Check	high
801605	Red Hat 2005-092 Security Check	high
801604	Red Hat 2005-043 Security Check	high
801602	Red Hat 2004-689 Security Check	high
801599	Red Hat 2004-437 Security Check	high
801597	Red Hat 2004-413 Security Check	high
801596	Red Hat 2004-360 Security Check	high
801595	Red Hat 2004-354 Security Check	high
801593	Red Hat 2004-188 Security Check	high
801591	Red Hat 2004-105 Security Check	high
801590	Red Hat 2004-069 Security Check	high
801589	Red Hat 2004-066 Security Check	high
801587	Red Hat 2004-017 Security Check	high
801585	Red Hat 2003-416 Security Check	high
801584	Red Hat 2003-408 Security Check	high
801582	Red Hat 2003-239 Security Check	high
801581	Fedora 2005-1138 Security Check	high
801580	Red Hat 2003-195 Security Check	high
801579	Red Hat 2003-147 Security Check	high
801578	Red Hat 2003-145 Security Check	high
801577	Red Hat 2003-103 Security Check	high
801576	Red Hat 2002-263 Security Check	high
801575	Red Hat 2002-227 Security Check	high

Generic Family for Log Correlation Engine

high

medium

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

high

info

info

info

info

medium

medium

medium

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high