---------------------------------------------------------------------
Red Hat, Inc. Red Hat Security Advisory
Synopsis: Updated kernel-utils packages fix setuid vulnerability
Advisory ID: RHSA-2003:056-08
Issue date: 2003-02-07
Updated on: 2003-02-07
Product: Red Hat Linux
Keywords: uml user mode linux
Cross references:
Obsoletes:
CVE Names: CAN-2003-0019
---------------------------------------------------------------------
1. Topic:
An updated kernel-utils package is available that removes the setuid bits
incorrectly assigned to the uml_net binary.
2. Relevant releases/architectures:
Red Hat Linux 8.0 - i386
3. Problem description:
The kernel-utils package contains several utilities that can be used to
control the kernel or machine hardware. In Red Hat Linux 8.0 this package
contains user mode linux (UML) utilities.
The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was
incorrectly shipped setuid root. This could allow local users to control
certain network interfaces, add and remove arp entries and routes, and put
interfaces in and out of promiscuous mode.
All users of the kernel-utils package should update to these packages that
contain a version of uml_net that is not setuid root.
Alternatively, as a work-around to this vulnerability issue the following
command as root:
chmod -s /usr/bin/uml_net
Red Hat would like to thank Johnny Robertson for alerting us to this issue.
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
Note that this update is also available via Red Hat Network. Many
people find this to be an easier way to apply updates. To use Red Hat
Network, launch the Red Hat Update Agent with the following command:
up2date
This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system. Note that you must select
kernel-utils explicitly on default configurations of up2date.
5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):
83685 - uml_net executable allows users to do bad things
6. RPMs required:
Red Hat Linux 8.0:
SRPMS:
ftp://updates.redhat.com/8.0/en/os/SRPMS/kernel-utils-2.4-8.28.src.rpm
i386:
ftp://updates.redhat.com/8.0/en/os/i386/kernel-utils-2.4-8.28.i386.rpm
7. Verification:
MD5 sum Package Name
--------------------------------------------------------------------------
6eac85b6523b2931db7d039b37b6a2e8 8.0/en/os/SRPMS/kernel-utils-2.4-8.28.src.rpm
40a718a6037b55941a289fa6adc5f0f5 8.0/en/os/i386/kernel-utils-2.4-8.28.i386.rpm
These packages are GPG signed by Red Hat, Inc. for security. Our key
is available at http://www.redhat.com/about/contact/pgpkey.html
You can verify each package with the following command:
rpm --checksig -v <filename>
If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
md5sum <filename>
8. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0019
9. Contact:
The Red Hat security contact is <securityat_private>. More contact
details at http://www.redhat.com/solutions/security/news/contact.html
Copyright 2003 Red Hat, Inc.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
This archive was generated by hypermail 2b30 : Fri Feb 07 2003 - 10:38:04 PST