Fedora Core alert: Updated kernel packages resolve security vulnerabilities

---------------------------------------------------------------------
Fedora Security Update Notification
FEDORA-2004-079
2004-02-18
---------------------------------------------------------------------

Name        : kernel
Version     : 2.4.22                      
Release     : 1.2173.nptl                  
Summary     : The Linux kernel (the core of the Linux operating system)
Description :
The kernel package contains the Linux kernel (vmlinuz), the core of your
Fedora Core Linux operating system.  The kernel handles the basic functions
of the operating system:  memory allocation, process allocation, device
input and output, etc.

Paul Starzetz discovered a flaw in return value checking in mremap() in the
Linux kernel versions 2.4.24 and previous that may allow a local attacker
to gain root privileges.  No exploit is currently available; however this
issue is exploitable. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2004-0077 to this issue.

Arjan van de Ven discovered a flaw in ncp_lookup() in ncpfs that could
allow local privilege escalation.  ncpfs is only used to allow a system to
mount volumes of NetWare servers or print to NetWare printers.  The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2004-0010 to this issue.

All users are advised to upgrade to these errata packages, which contain
backported security patches that correct these issues.   

Red Hat would like to thank Paul Starzetz from ISEC for reporting the issue
CAN-2004-0077.

---------------------------------------------------------------------

* Wed Feb 18 2004 Dave Jones 
- Fix security problem in gamma DRI driver.

* Tue Feb 17 2004 Dave Jones 
- Fix leak in SSTFB driver.

* Sat Feb 14 2004 Dave Jones 
- aacraid fix for #92129

* Fri Feb 13 2004 Dave Jones 
- Fix building of vt8231.o

* Thu Feb 05 2004 Dave Jones 
- Check do_mremap return values (CAN-2004-0077)

* Mon Feb 02 2004 Dave Jones 
- Disable stack overflow checking.
- More bits from 2.4.25pre
  - Fix ipt_conntrack/ipt_state module refcounting.
  - Zero last byte of mount option page
  - AMD64 update
  - Fix deep stack usage in ncpfs (CAN-2004-0010)

---------------------------------------------------------------------
This update can be downloaded from:
  http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/

be83c63da2ef761aeb7e8696879be360  SRPMS/kernel-2.4.22-1.2173.nptl.src.rpm
78db0934086e959ad1bff965bcc2a188  i386/kernel-source-2.4.22-1.2173.nptl.i386.rpm
64a824908fb9851768f2bdd0911b5f65  i386/kernel-doc-2.4.22-1.2173.nptl.i386.rpm
f8136a330f1bdad42b5c08c5cfaa7464  i386/kernel-BOOT-2.4.22-1.2173.nptl.i386.rpm
50991b3c9e6a7ab6b16d884e032ad391  i386/debug/kernel-debuginfo-2.4.22-1.2173.nptl.i386.rpm
731de10afe170d5ebd33c199690c947c  i386/kernel-2.4.22-1.2173.nptl.i586.rpm
7a676c2c3c5b899f9de46245e553dded  i386/debug/kernel-debuginfo-2.4.22-1.2173.nptl.i586.rpm
c3571e87235b5717205f752a2981e044  i386/kernel-2.4.22-1.2173.nptl.i686.rpm
cebf23c3578adc7bfce4c39902111fd0  i386/kernel-smp-2.4.22-1.2173.nptl.i686.rpm
1eb059360ae74ba8116baa67835bce90  i386/debug/kernel-debuginfo-2.4.22-1.2173.nptl.i686.rpm
c41be8c7cde8cbfab3630a03d4251bb2  i386/kernel-2.4.22-1.2173.nptl.athlon.rpm
958c124d969d6804bd81011924d063e2  i386/kernel-smp-2.4.22-1.2173.nptl.athlon.rpm
cc3b30df501a44e64c1405b6928c04f7  i386/debug/kernel-debuginfo-2.4.22-1.2173.nptl.athlon.rpm

This update can also be installed with the Update Agent; you can
launch the Update Agent with the 'up2date' command.  
---------------------------------------------------------------------


--
fedora-announce-list mailing list
[e-mail:fedora-announce-list@redhat.com]
http://www.redhat.com/mailman/listinfo/fedora-announce-list