Updated krb5 packages which fix two buffer overflow vulnerabilities in the included Kerberos-aware telnet client are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Kerberos is a networked authentication system which uses a trusted third party (a KDC) to authenticate clients and servers to each other.

The krb5-workstation package includes a Kerberos-aware telnet client.
Two buffer overflow flaws were discovered in the way the telnet client handles messages from a server. An attacker may be able to execute arbitrary code on a victim's machine if the victim can be tricked into connecting to a malicious telnet server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-0468 and CVE-2005-0469 to these issues.

Users of krb5 should update to these erratum packages which contain a backported patch to correct this issue.

Red Hat would like to thank iDEFENSE for their responsible disclosure of this issue.

Updated kdelibs packages that fix a local denial of service issue are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The kdelibs package provides libraries for the K Desktop Environment.

Sebastian Krahmer discovered a flaw in dcopserver, the KDE Desktop Communication Protocol (DCOP) daemon. A local user could use this flaw to stall the DCOP authentication process, affecting any local desktop users and causing a reduction in their desktop functionality. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0396 to this issue.

Users of KDE should upgrade to these erratum packages, which contain backported patches to correct these issues.

Updated kernel packages are now available as part of ongoing support and maintenance of Red Hat Enterprise Linux version 3. This is the fifth regular update.

The Linux kernel handles the basic functions of the operating system.

This is the fifth regular kernel update to Red Hat Enterprise Linux 3.

New features introduced by this update include :

  - support for 2-TB partitions on block devices - support     for new disk, network, and USB devices - support for     clustered APIC mode on AMD64 NUMA systems - netdump     support on AMD64, Intel EM64T, Itanium, and ppc64     systems - diskdump support on sym53c8xx and SATA     piix/promise adapters - NMI switch support on AMD64 and     Intel EM64T systems

There were many bug fixes in various parts of the kernel. The ongoing effort to resolve these problems has resulted in a marked improvement in the reliability and scalability of Red Hat Enterprise Linux 3.

Some key areas affected by these fixes include the kernel's networking, SATA, TTY, and USB subsystems, as well as the architecture-dependent handling under the ia64, ppc64, and x86_64 directories. Scalability improvements were made primarily in the memory management and file system areas.

A flaw in offset handling in the xattr file system code backported to Red Hat Enterprise Linux 3 was fixed. On 64-bit systems, a user who can access an ext3 extended-attribute-enabled file system could cause a denial of service (system crash). This issue is rated as having a moderate security impact (CVE-2005-0757).

The following device drivers have been upgraded to new versions :

3c59x ------ LK1.1.18 3w-9xxx ---- 2.24.00.011fw (new in Update 5) 3w-xxxx ---- 1.02.00.037 8139too ---- (upstream 2.4.29) b44 -------- 0.95 cciss ------ v2.4.54.RH1 e100 ------- 3.3.6-k2 e1000 ------ 5.6.10.1-k2 lpfcdfc ---- 1.0.13 (new in Update 5) tg3 -------- 3.22RH

Note: The kernel-unsupported package contains various drivers and modules that are unsupported and therefore might contain security problems that have not been addressed.

All Red Hat Enterprise Linux 3 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

Updated glibc packages that address several bugs are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The GNU libc packages (known as glibc) contain the standard C libraries used by applications.

It was discovered that the use of LD_DEBUG, LD_SHOW_AUXV, and LD_DYNAMIC_WEAK were not restricted for a setuid program. A local user could utilize this flaw to gain information, such as the list of symbols used by the program. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1453 to this issue.

This erratum addresses the following bugs in the GNU C Library :

  - fix stack alignment in IA-32 clone - fix double free in     globfree - fix fnmatch to avoid jumping based on     uninitialized memory read - fix fseekpos after ungetc -     fix TZ env var handling if the variable ends with + or -
    - avoid depending on values read from uninitialized     memory in strtold on certain architectures - fix mapping     alignment computation in dl-load - fix i486+ strncat     inline assembly - make gethostid/sethostid work on     bi-arch platforms - fix ppc64 getcontext/swapcontext -     fix pthread_exit if called after pthread_create, but     before the created thread actually started - fix return     values for tgamma (+-0) - fix handling of very long     lines in /etc/hosts - avoid page aliasing of thread     stacks on AMD64 - avoid busy loop in malloc if     concurrent with fork - allow putenv and setenv in shared     library constructors - fix restoring of CCR in     swapcontext and getcontext on ppc64 - avoid using     sigaction (SIGPIPE, ...) in syslog implementation

All users of glibc should upgrade to these updated packages, which resolve these issues.

Updated evolution packages that fix various bugs are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Evolution is the GNOME collection of personal information management (PIM) tools. Evolution includes a mailer, calendar, contact manager, and communication facility. The tools which make up Evolution are tightly integrated with one another and act as a seamless personal information management tool.

A bug was found in Evolution's helper program camel-lock-helper. This bug could allow a local attacker to gain root privileges if camel-lock-helper has been built to execute with elevated privileges.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0102 to this issue. On Red Hat Enterprise Linux, camel-lock-helper is not built to execute with elevated privileges by default. Please note however that if users have rebuilt Evolution from the source RPM, as the root user, camel-lock-helper may be given elevated privileges.

Additionally, these updated packages address the following issues :

-- If evolution ran during a GNOME session, the evolution-wombat process did not exit when the user logged out of the desktop.

-- For folders marked for Offline Synchronization: if a user moved a message from a Local Folder to an IMAP folder while in Offline mode, the message was not present in either folder after returning to Online mode.

This update fixes this problem. Email messages that have been lost this way may still be present in the following path :

~/evolution/<NAME_OF_MAIL_STORE>/ \ <path-to-folder-via-subfolder-directories>/ \ <temporary-uid-of-message>

If this bug has affected you it may be possible to recover data by examining the contents of this directory.

All users of evolution should upgrade to these updated packages, which resolve these issues.

Updated openssh packages that fix a potential security vulnerability and various other bugs are now available for Red Hat Enterprise Linux 3.

This update has been rated as having low security impact by the Red Hat Security Response Team.

OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. SSH replaces rlogin and rsh, and provides secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forwarded over a secure channel. Public key authentication can be used for 'passwordless' access to servers.

The scp protocol allows a server to instruct a client to write to arbitrary files outside of the current directory. This could potentially cause a security issue if a user uses scp to copy files from a malicious server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0175 to this issue.

These updated packages also correct the following bugs :

On systems where direct ssh access for the root user was disabled by configuration (setting 'PermitRootLogin no'), attempts to guess the root password could be judged as sucessful or unsucessful by observing a delay.

On systems where the privilege separation feature was turned on, the user resource limits were not correctly set if the configuration specified to raise them above the defaults. It was also not possible to change an expired password.

Users of openssh should upgrade to these updated packages, which contain backported patches to resolve these issues.

Updated ghostscript packages that fix a PDF output issue and a temporary file security bug are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Ghostscript is a program for displaying PostScript files or printing them to non-PostScript printers.

A bug was found in the way several of Ghostscript's utility scripts created temporary files. A local user could cause these utilities to overwrite files that the victim running the utility has write access to. The Common Vulnerabilities and Exposures project assigned the name CVE-2004-0967 to this issue.

Additionally, this update addresses the following issue :

A problem has been identified in the PDF output driver, which can cause output to be delayed indefinitely on some systems. The fix has been backported from GhostScript 7.07.

All users of ghostscript should upgrade to these updated packages, which contain backported patches to resolve these issues.

Updated rsh packages that fix various bugs and a theoretical security issue are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team

The rsh package contains a set of programs that allow users to run commands on remote machines, login to other machines, and copy files between machines, using the rsh, rlogin, and rcp commands. All three of these commands use rhosts-style authentication.

The rcp protocol allows a server to instruct a client to write to arbitrary files outside of the current directory. This could potentially cause a security issue if a user uses rcp to copy files from a malicious server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0175 to this issue.

These updated packages also address the following bugs :

The rexec command failed with 'Invalid Argument', because the code used sigaction() as an unsupported signal.

The rlogind server reported 'SIGCHLD set to SIG_IGN but calls wait()' message to the system log because the original BSD code was ported incorrectly to linux.

The rexecd server did not function on systems where client hostnames were not in the DNS service, because server code called gethostbyaddr() for each new connection.

The rcp command incorrectly used the 'errno' variable and produced erroneous error messages.

The rexecd command ignored settings in the /etc/security/limits file, because the PAM session was incorrectly initialized.

The rexec command prompted for username and password regardless of the ~/.netrc configuration file contents. This updated package contains a patch that no longer skips the ~/.netrc file.

All users of rsh should upgrade to these updated packages, which resolve these issues.

Updated kdegraphics packages that resolve multiple security issues in kfax are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team

The kdegraphics package contains graphics applications for the K Desktop Environment.

During a source code audit, Chris Evans discovered a number of integer overflow bugs that affect libtiff. The kfax application contains a copy of the libtiff code used for parsing TIFF files and is therefore affected by these bugs. An attacker who has the ability to trick a user into opening a malicious TIFF file could cause kfax to crash or possibly execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-0886 and CVE-2004-0804 to these issues.

Additionally, a number of buffer overflow bugs that affect libtiff have been found. The kfax application contains a copy of the libtiff code used for parsing TIFF files and is therefore affected by these bugs. An attacker who has the ability to trick a user into opening a malicious TIFF file could cause kfax to crash or possibly execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0803 to this issue.

Users of kfax should upgrade to these updated packages, which contain backported patches and are not vulnerable to this issue.

An updated libxml package that fixes multiple buffer overflows is now available.

[Updated 24 May 2005] Multilib packages have been added to this advisory

The libxml package contains a library for manipulating XML files.

Multiple buffer overflow bugs have been found in libxml versions prior to 2.6.14. If an attacker can trick a user into passing a specially crafted FTP URL or FTP proxy URL to an application that uses the vulnerable functions of libxml, it could be possible to execute arbitrary code. Additionally, if an attacker can return a specially crafted DNS request to libxml, it could be possible to execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0989 to this issue.

Yuuichi Teranishi discovered a flaw in libxml versions prior to 2.6.6.
When fetching a remote resource via FTP or HTTP, libxml uses special parsing routines. These routines can overflow a buffer if passed a very long URL. If an attacker is able to find an application using libxml that parses remote resources and allows them to influence the URL, then this flaw could be used to execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0110 to this issue.

All users are advised to upgrade to this updated package, which contains backported patches and is not vulnerable to these issues.

Updated gd packages that fix security issues with overflow in various memory allocation calls are now available.

[Updated 24 May 2005] Multilib packages have been added to this advisory

The gd packages contain a graphics library used for the dynamic creation of images such as PNG and JPEG.

Several buffer overflows were reported in various memory allocation calls. An attacker could create a carefully crafted image file in such a way that it could cause ImageMagick to execute arbitrary code when processing the image. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0990 to these issues.

While researching the fixes to these overflows, additional buffer overflows were discovered in calls to gdMalloc. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0941 to these issues.

Users of gd should upgrade to these updated packages, which contain a backported security patch, and are not vulnerable to these issues.

ID	Name	Severity
21803	CentOS 3 : krb5 (CESA-2005:330)	high
21802	CentOS 3 / 4 : kdelibs (CESA-2005:307)	low
21801	CentOS 3 : kernel (CESA-2005:294)	low
21800	CentOS 3 : glibc (CESA-2005:256)	low
21799	CentOS 3 : evolution (CESA-2005:238)	high
21798	CentOS 3 : openssh (CESA-2005:106)	medium
21797	CentOS 3 : ghostscript (CESA-2005:081)	high
21796	CentOS 3 : rsh (CESA-2005:074)	medium
21795	CentOS 3 : kdegraphics (CESA-2005:021)	critical
21794	CentOS 3 : libxml (CESA-2004:650)	critical
21793	CentOS 3 : gd (CESA-2004:638)	critical

Detections

Analytics

CentOS Local Security Checks Family for Nessus

high

low

low

low

high

medium

high

medium

critical

critical

critical