-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 +------------------------------------------------------------------------+ | Guardian Digital Security Advisory July 24, 2003 | | http://www.guardiandigital.com ESA-20032407-018 | | | | Package: kernel | | Summary: several local vulnerabilities. | +------------------------------------------------------------------------+ EnGarde Secure Linux is an enterprise class Linux platform engineered to enable corporations to quickly and cost-effectively build a complete and secure Internet presence while preventing Internet threats. OVERVIEW - -------- This kernel update fixes several bugs and vulnerabilities. A summary of the changes from the last kernel update are below. * A vulnerability in the TTY layer allows local attackers to cause a denial of service ("kernel oops"). The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0247 to this issue. * The mxcsr code in Linux kernel 2.4 allows attackers to modify CPU state registers via a malformed address. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0248 to this issue. * Paul Starzetz discovered a race condition in the execve() system call. This file read race condition could be used to cause a denial of service (local crash). The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0462 to this issue. * The execve system call records the file descriptor of the executable process in the file table of the calling process, which allows local users to gain read access to restricted file descriptors. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0476 to this issue. * The /proc filesystem allows local users to obtain sensitive information by opening various entries in /proc/self before executing a setuid program, which causes the program to fail to change the ownership and permissions of that entry. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0501 to this issue. This update also upgrades the Linux kernel to the most recent stable version (2.4.21). Guardian Digital products affected by this issue include: EnGarde Secure Community 2 EnGarde Secure Professional v1.5 It is recommended that all users apply this update as soon as possible. SOLUTION - -------- Guardian Digital Secure Network subscribers may automatically update affected systems by accessing their account from within the Guardian Digital WebTool. To modify your GDSN account and contact preferences, please go to: https://www.guardiandigital.com/account/ REFERENCES - ---------- Guardian Digital's public key: http://ftp.engardelinux.org/pub/engarde/ENGARDE-GPG-KEY Official Web Site of the Linux Kernel: http://www.kernel.org/ Guardian Digital Advisories: http://infocenter.guardiandigital.com/advisories/ Security Contact: securityat_private - -------------------------------------------------------------------------- Author: Ryan W. Maple <ryanat_private> Copyright 2003, Guardian Digital, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) iD8DBQE/H+LeHD5cqd57fu0RAkmOAJ9bae4pcofCs0Ae2MPU4/LN30EGmQCfQ74x 5uh4G/lriHXlLcNdzebWkn8= =2YPQ -----END PGP SIGNATURE-----
This archive was generated by hypermail 2b30 : Thu Jul 24 2003 - 12:18:22 PDT