Conectiva alert CLA-2002:493 (kernel) [LWN.net]

From:	 secure@conectiva.com.br
To:	 conectiva-updates@papaleguas.conectiva.com.br, lwn@lwn.net,
	 bugtraq@securityfocus.com, security-alerts@linuxsecurity.com
Subject: [CLA-2002:493] Conectiva Linux Security Announcement - kernel
Date:	 Wed, 5 Jun 2002 17:09:48 -0300

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT 
- --------------------------------------------------------------------------

PACKAGE   : kernel
SUMMARY   : Zlib and other fixes
DATE      : 2002-06-05 17:09:00
ID        : CLA-2002:493
RELEVANT
RELEASES  : 5.0, prg graficos, ecommerce, 5.1, 6.0, 7.0

- -------------------------------------------------------------------------

DESCRIPTION
 This announcement updates the kernel package and fixes the following
 vulnerabilities:
 
 Zlib[1]
 This problem affects PPP connections that use data compression and
 also affects the IPSEC module (from the FreeS/WAN project), but also
 only when used with data compression enabled.
 In the case of PPP connections, an attack would have to come directly
 from the other point of this connection, tipically an ISP. Something
 similar happens with IPSEC: an attack would have to come from the
 other point of the VPN, because authentication has to take place and
 succeed before reaching the vulnerable part of the zlib code.
 The first attempt at a fix for this problem introduced an instability
 in the kernel. That fix was available for some time in our updates
 repository and was also used in the kernel shipped with Conectiva
 Linux 8. The fix has been corrected and is also already available for
 Conectiva Linux 8 users[2].
 
 lcall[3]
 This vulnerability allows local users to kill processes which do not
 belong to them, characterizing a local denial of service (DoS).
 
 Additionally, this update also fixes bug #4424[4] for Conectiva Linux
 7.0, where some machines with ATX power supplies would not
 automatically be turned off after shutdown.


SOLUTION
 It is recommended that all users upgrade the kernel.
 
 
 REFERENCES
 1. http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000469
 2. http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000492
 3.http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0058.html
 4. http://distro.conectiva.com.br/bugzilla/show_bug.cgi?id=4424


DIRECT DOWNLOAD LINKS TO THE UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/5.0/SRPMS/kernel-2.2.19-25U50_4cl.src.rpm
ftp://atualizacoes.conectiva.com.br/5.0/i386/kernel-2.2.19-25U50_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.0/i386/kernel-BOOT-2.2.19-25U50_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.0/i386/kernel-doc-2.2.19-25U50_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.0/i386/kernel-headers-2.2.19-25U50_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.0/i386/kernel-ibcs-2.2.19-25U50_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.0/i386/kernel-smp-2.2.19-25U50_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.0/i386/kernel-source-2.2.19-25U50_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.0/i586/kernel-2.2.19-25U50_4cl.i586.rpm
ftp://atualizacoes.conectiva.com.br/5.0/i586/kernel-smp-2.2.19-25U50_4cl.i586.rpm
ftp://atualizacoes.conectiva.com.br/5.0/i686/kernel-2.2.19-25U50_4cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/5.0/i686/kernel-enterprise-2.2.19-25U50_4cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/5.0/i686/kernel-smp-2.2.19-25U50_4cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/5.1/SRPMS/kernel-2.2.19-25U51_4cl.src.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i386/kernel-2.2.19-25U51_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i386/kernel-BOOT-2.2.19-25U51_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i386/kernel-doc-2.2.19-25U51_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i386/kernel-headers-2.2.19-25U51_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i386/kernel-ibcs-2.2.19-25U51_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i386/kernel-smp-2.2.19-25U51_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i386/kernel-source-2.2.19-25U51_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i586/kernel-2.2.19-25U51_4cl.i586.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i586/kernel-smp-2.2.19-25U51_4cl.i586.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i686/kernel-2.2.19-25U51_4cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i686/kernel-enterprise-2.2.19-25U51_4cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i686/kernel-smp-2.2.19-25U51_4cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/kernel-2.2.19-25U60_4cl.src.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/alsasound-2.2.19-3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/kernel-2.2.19-25U60_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/kernel-2.2.19-25U60_4cl.i586.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/kernel-2.2.19-25U60_4cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/kernel-BOOT-2.2.19-25U60_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/kernel-doc-2.2.19-25U60_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/kernel-enterprise-2.2.19-25U60_4cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/kernel-headers-2.2.19-25U60_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/kernel-ibcs-2.2.19-25U60_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/kernel-smp-2.2.19-25U60_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/kernel-smp-2.2.19-25U60_4cl.i586.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/kernel-smp-2.2.19-25U60_4cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/kernel-source-2.2.19-25U60_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/kernel-2.4.12-4U70_3cl.src.rpm
ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/kernel-2.2.19-25U70_4cl.src.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/kernel-2.2.19-25U70_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/kernel-source-2.2.19-25U70_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/kernel-headers-2.2.19-25U70_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/kernel-doc-2.2.19-25U70_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/kernel-ibcs-2.2.19-25U70_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/kernel-smp-2.2.19-25U70_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/kernel-BOOT-2.2.19-25U70_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/kernel-2.2.19-25U70_4cl.i586.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/kernel-smp-2.2.19-25U70_4cl.i586.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/kernel-2.2.19-25U70_4cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/kernel-smp-2.2.19-25U70_4cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/kernel-enterprise-2.2.19-25U70_4cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/devfsd-2.4.12-4U70_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/kernel-2.4.12-4U70_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/kernel-2.4.12-4U70_3cl.i586.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/kernel-2.4.12-4U70_3cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/kernel-BOOT-2.4.12-4U70_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/kernel-doc-2.4.12-4U70_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/kernel-enterprise-2.4.12-4U70_3cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/kernel-headers-2.4.12-4U70_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/kernel-smp-2.4.12-4U70_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/kernel-smp-2.4.12-4U70_3cl.i586.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/kernel-smp-2.4.12-4U70_3cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/kernel-source-2.4.12-4U70_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/SRPMS/kernel-2.2.19-25U50_4cl.src.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/kernel-2.2.19-25U50_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/kernel-BOOT-2.2.19-25U50_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/kernel-doc-2.2.19-25U50_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/kernel-headers-2.2.19-25U50_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/kernel-ibcs-2.2.19-25U50_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/kernel-smp-2.2.19-25U50_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/kernel-source-2.2.19-25U50_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i586/kernel-2.2.19-25U50_4cl.i586.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i586/kernel-smp-2.2.19-25U50_4cl.i586.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i686/kernel-2.2.19-25U50_4cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i686/kernel-enterprise-2.2.19-25U50_4cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i686/kernel-smp-2.2.19-25U50_4cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/SRPMS/kernel-2.2.19-25U50_4cl.src.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/kernel-2.2.19-25U50_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/kernel-BOOT-2.2.19-25U50_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/kernel-doc-2.2.19-25U50_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/kernel-headers-2.2.19-25U50_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/kernel-ibcs-2.2.19-25U50_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/kernel-smp-2.2.19-25U50_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/kernel-source-2.2.19-25U50_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i586/kernel-2.2.19-25U50_4cl.i586.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i586/kernel-smp-2.2.19-25U50_4cl.i586.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i686/kernel-2.2.19-25U50_4cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i686/kernel-enterprise-2.2.19-25U50_4cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i686/kernel-smp-2.2.19-25U50_4cl.i686.rpm


ADDITIONAL INSTRUCTIONS
 Users of Conectiva Linux version 6.0 or higher may use apt to perform 
 upgrades of RPM packages:
 - add the following line to /etc/apt/sources.list if it is not there yet
   (you may also use linuxconf to do this):

 rpm [cncbr] ftp://atualizacoes.conectiva.com.br 6.0/conectiva updates

(replace 6.0 with the correct version number if you are not running CL6.0)

 - run:                 apt-get update
 - after that, execute: apt-get upgrade

 Detailed instructions reagarding the use of apt and upgrade examples 
 can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en


- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at 
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en

- -------------------------------------------------------------------------
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE8/nAL42jd0JmAcZARArE1AKDw8gZepV7ZOvtNvhLhVIubxPWEiACfZFGO
jFqygVKzcbrleCehpnv6ojs=
=3RpL
-----END PGP SIGNATURE-----

(Log in to post comments)

That's what UnitedLinux is for

Posted Jun 5, 2002 22:18 UTC (Wed) by AnswerGuy (guest, #1256) [Link]

Are you sure that this is the same bug that's been known of for months?

It sounds to me like they found a new twist to that vulnerability and are now posting an alert and a fix for THAT. (Note: I don't have the inside track on this; but that's what the blurb suggests to me).

I'm also skeptical that UnitedLinux will affect this sort of announcement in any way. Connectiva is one of the UnitedLinux partners, and is one of the most proactive vendors in the Linux community (when it comes to code audits and posting security/bug fixes). I would hope that they'd continue to do this; adding notes that relate to UnitedLinux when that's appropriate. It would be sad, indeed, if their participation in UnitedLinux hampered their work or delayed announcements of their fixes or alerts.

More to the point I'd like to see some concerted (as in co-operative and co-ordinated) effort among Linux distributors, large corporate users, and government agencies (especially among those governments that are adopting or considering mandated Linux use for their internal use) in major code audits of all core GNU/Linux code. Start with the kernel (fund Dawson Engler's Meta-L/xgcc static code auding work) and Glibc and go through all of the major software components (util-linux, etc) to find the remaining buffer overflows, sign errors, format string bugs, race conditions and other problems.

Of course we've tried that before (with limited success). However, we can try again, and harder this time. We can fund education for more code janitors, and fund their work. We can fund research into better code analysis tools.

Every bug that we find and fix is one that we don't need to learn about "above the fold" or via forensics on our compromised servers.

It is the old double free()

Posted Jun 6, 2002 1:42 UTC (Thu) by proski (subscriber, #104) [Link]

I looked into the source RPM, and it's clearly the fix for the old "double free" bug. The announcement just explains how this bug can be exploited. Other vendors didn't wait for exploits and updated their kernels much earlier.

I understand that the idea of UnitedLinux is that most common packages are compiled once, and the resulting binaries are certified and used without changes by the participants. I don't know if the kernel will be one of those packages. I think it will, and it means that if Caldera has an improved IPX support, then every other distribution will have it, and if SuSE has Reiserfs4, then everyone will have it, and so on.

This will also mean that if Caldera says "our kernel needs a fix", Conectiva cannot say "we are not affected because we are not shipping your fancy IPX configuration tool" or "show us a realistic scenario of exploit". Everyone will have to upgrade. That's why security experts of every company will pay attention. That will shorten the time between an alert and the fix.

That's all is just my understanding. They may be planning something different.

Anyway, the security audits is a different story alltogether. Since every distributor wins something if the code is audited, but the audit doesn't give the competitive edge (holding back a security fix would result in a huge scandal), every distributor should participate in the audit, regardsless of their membership in UnitedLinux. How to do it is a separate question.