Red Hat has released the following security updates: [RHSA-2011:1391-01] Moderate: httpd security and bug fix update, [RHSA-2011:1392-01] Moderate: httpd security and bug fix update, and [RHSA-2011:1386-01] Important: kernel security, bug fix, and enhancement update



[RHSA-2011:1391-01] Moderate: httpd security and bug fix update

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: httpd security and bug fix update
Advisory ID: RHSA-2011:1391-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2011-1391.html
Issue date: 2011-10-20
CVE Names: CVE-2011-3348 CVE-2011-3368
=====================================================================

1. Summary:

Updated httpd packages that fix two security issues and one bug are now
available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64
Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, noarch, x86_64
Red Hat Enterprise Linux HPC Node (v. 6) - x86_64
Red Hat Enterprise Linux HPC Node Optional (v. 6) - noarch, x86_64
Red Hat Enterprise Linux Server (v. 6) - i386, noarch, ppc64, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 6) - i386, noarch, x86_64

3. Description:

The Apache HTTP Server is a popular web server.

It was discovered that the Apache HTTP Server did not properly validate the
request URI for proxied requests. In certain configurations, if a reverse
proxy used the ProxyPassMatch directive, or if it used the RewriteRule
directive with the proxy flag, a remote attacker could make the proxy
connect to an arbitrary server, possibly disclosing sensitive information
from internal web servers not directly accessible to the attacker.
(CVE-2011-3368)

It was discovered that mod_proxy_ajp incorrectly returned an "Internal
Server Error" response when processing certain malformed HTTP requests,
which caused the back-end server to be marked as failed in configurations
where mod_proxy was used in load balancer mode. A remote attacker could
cause mod_proxy to not send requests to back-end AJP (Apache JServ
Protocol) servers for the retry timeout period or until all back-end
servers were marked as failed. (CVE-2011-3348)

Red Hat would like to thank Context Information Security for reporting the
CVE-2011-3368 issue.

This update also fixes the following bug:

* The fix for CVE-2011-3192 provided by the RHSA-2011:1245 update
introduced regressions in the way httpd handled certain Range HTTP header
values. This update corrects those regressions. (BZ#736592)

All httpd users should upgrade to these updated packages, which contain
backported patches to correct these issues. After installing the updated
packages, the httpd daemon must be restarted for the update to take effect.

4. Solution:

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

736592 - httpd: RHSA-2011:1245 regressions [rhel-6]
736690 - CVE-2011-3348 httpd: mod_proxy_ajp remote temporary DoS
740045 - CVE-2011-3368 httpd: reverse web proxy vulnerability

6. Package List:

Red Hat Enterprise Linux Desktop (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/httpd-2.2.15-9.el6_1.3.src.rpm

i386:
httpd-2.2.15-9.el6_1.3.i686.rpm
httpd-debuginfo-2.2.15-9.el6_1.3.i686.rpm
httpd-tools-2.2.15-9.el6_1.3.i686.rpm

x86_64:
httpd-2.2.15-9.el6_1.3.x86_64.rpm
httpd-debuginfo-2.2.15-9.el6_1.3.x86_64.rpm
httpd-tools-2.2.15-9.el6_1.3.x86_64.rpm

Red Hat Enterprise Linux Desktop Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/httpd-2.2.15-9.el6_1.3.src.rpm

i386:
httpd-debuginfo-2.2.15-9.el6_1.3.i686.rpm
httpd-devel-2.2.15-9.el6_1.3.i686.rpm
mod_ssl-2.2.15-9.el6_1.3.i686.rpm

noarch:
httpd-manual-2.2.15-9.el6_1.3.noarch.rpm

x86_64:
httpd-debuginfo-2.2.15-9.el6_1.3.i686.rpm
httpd-debuginfo-2.2.15-9.el6_1.3.x86_64.rpm
httpd-devel-2.2.15-9.el6_1.3.i686.rpm
httpd-devel-2.2.15-9.el6_1.3.x86_64.rpm
mod_ssl-2.2.15-9.el6_1.3.x86_64.rpm

Red Hat Enterprise Linux HPC Node (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/httpd-2.2.15-9.el6_1.3.src.rpm

x86_64:
httpd-2.2.15-9.el6_1.3.x86_64.rpm
httpd-debuginfo-2.2.15-9.el6_1.3.x86_64.rpm
httpd-tools-2.2.15-9.el6_1.3.x86_64.rpm

Red Hat Enterprise Linux HPC Node Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/httpd-2.2.15-9.el6_1.3.src.rpm

noarch:
httpd-manual-2.2.15-9.el6_1.3.noarch.rpm

x86_64:
httpd-debuginfo-2.2.15-9.el6_1.3.i686.rpm
httpd-debuginfo-2.2.15-9.el6_1.3.x86_64.rpm
httpd-devel-2.2.15-9.el6_1.3.i686.rpm
httpd-devel-2.2.15-9.el6_1.3.x86_64.rpm
mod_ssl-2.2.15-9.el6_1.3.x86_64.rpm

Red Hat Enterprise Linux Server (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/httpd-2.2.15-9.el6_1.3.src.rpm

i386:
httpd-2.2.15-9.el6_1.3.i686.rpm
httpd-debuginfo-2.2.15-9.el6_1.3.i686.rpm
httpd-devel-2.2.15-9.el6_1.3.i686.rpm
httpd-tools-2.2.15-9.el6_1.3.i686.rpm
mod_ssl-2.2.15-9.el6_1.3.i686.rpm

noarch:
httpd-manual-2.2.15-9.el6_1.3.noarch.rpm

ppc64:
httpd-2.2.15-9.el6_1.3.ppc64.rpm
httpd-debuginfo-2.2.15-9.el6_1.3.ppc.rpm
httpd-debuginfo-2.2.15-9.el6_1.3.ppc64.rpm
httpd-devel-2.2.15-9.el6_1.3.ppc.rpm
httpd-devel-2.2.15-9.el6_1.3.ppc64.rpm
httpd-tools-2.2.15-9.el6_1.3.ppc64.rpm
mod_ssl-2.2.15-9.el6_1.3.ppc64.rpm

s390x:
httpd-2.2.15-9.el6_1.3.s390x.rpm
httpd-debuginfo-2.2.15-9.el6_1.3.s390.rpm
httpd-debuginfo-2.2.15-9.el6_1.3.s390x.rpm
httpd-devel-2.2.15-9.el6_1.3.s390.rpm
httpd-devel-2.2.15-9.el6_1.3.s390x.rpm
httpd-tools-2.2.15-9.el6_1.3.s390x.rpm
mod_ssl-2.2.15-9.el6_1.3.s390x.rpm

x86_64:
httpd-2.2.15-9.el6_1.3.x86_64.rpm
httpd-debuginfo-2.2.15-9.el6_1.3.i686.rpm
httpd-debuginfo-2.2.15-9.el6_1.3.x86_64.rpm
httpd-devel-2.2.15-9.el6_1.3.i686.rpm
httpd-devel-2.2.15-9.el6_1.3.x86_64.rpm
httpd-tools-2.2.15-9.el6_1.3.x86_64.rpm
mod_ssl-2.2.15-9.el6_1.3.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/httpd-2.2.15-9.el6_1.3.src.rpm

i386:
httpd-2.2.15-9.el6_1.3.i686.rpm
httpd-debuginfo-2.2.15-9.el6_1.3.i686.rpm
httpd-devel-2.2.15-9.el6_1.3.i686.rpm
httpd-tools-2.2.15-9.el6_1.3.i686.rpm
mod_ssl-2.2.15-9.el6_1.3.i686.rpm

noarch:
httpd-manual-2.2.15-9.el6_1.3.noarch.rpm

x86_64:
httpd-2.2.15-9.el6_1.3.x86_64.rpm
httpd-debuginfo-2.2.15-9.el6_1.3.i686.rpm
httpd-debuginfo-2.2.15-9.el6_1.3.x86_64.rpm
httpd-devel-2.2.15-9.el6_1.3.i686.rpm
httpd-devel-2.2.15-9.el6_1.3.x86_64.rpm
httpd-tools-2.2.15-9.el6_1.3.x86_64.rpm
mod_ssl-2.2.15-9.el6_1.3.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2011-3348.html
https://www.redhat.com/security/data/cve/CVE-2011-3368.html
https://access.redhat.com/security/updates/classification/#moderate
https://rhn.redhat.com/errata/RHSA-2011-1245.html

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2011 Red Hat, Inc.

[RHSA-2011:1392-01] Moderate: httpd security and bug fix update

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: httpd security and bug fix update
Advisory ID: RHSA-2011:1392-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2011-1392.html
Issue date: 2011-10-20
CVE Names: CVE-2011-3368
=====================================================================

1. Summary:

Updated httpd packages that fix one security issue and one bug are now
available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

2. Relevant releases/architectures:

RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Description:

The Apache HTTP Server is a popular web server.

It was discovered that the Apache HTTP Server did not properly validate the
request URI for proxied requests. In certain configurations, if a reverse
proxy used the ProxyPassMatch directive, or if it used the RewriteRule
directive with the proxy flag, a remote attacker could make the proxy
connect to an arbitrary server, possibly disclosing sensitive information
from internal web servers not directly accessible to the attacker.
(CVE-2011-3368)

Red Hat would like to thank Context Information Security for reporting this
issue.

This update also fixes the following bug:

* The fix for CVE-2011-3192 provided by the RHSA-2011:1245 update
introduced regressions in the way httpd handled certain Range HTTP header
values. This update corrects those regressions. (BZ#736593, BZ#736594)

All httpd users should upgrade to these updated packages, which contain
backported patches to correct these issues. After installing the updated
packages, the httpd daemon must be restarted for the update to take effect.

4. Solution:

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

736593 - httpd: RHSA-2011:1245 regressions [rhel-5]
736594 - httpd: RHSA-2011:1245 regressions [rhel-4]
740045 - CVE-2011-3368 httpd: reverse web proxy vulnerability

6. Package List:

Red Hat Enterprise Linux AS version 4:

Source:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/httpd-2.0.52-49.ent.src.rpm

i386:
httpd-2.0.52-49.ent.i386.rpm
httpd-debuginfo-2.0.52-49.ent.i386.rpm
httpd-devel-2.0.52-49.ent.i386.rpm
httpd-manual-2.0.52-49.ent.i386.rpm
httpd-suexec-2.0.52-49.ent.i386.rpm
mod_ssl-2.0.52-49.ent.i386.rpm

ia64:
httpd-2.0.52-49.ent.ia64.rpm
httpd-debuginfo-2.0.52-49.ent.ia64.rpm
httpd-devel-2.0.52-49.ent.ia64.rpm
httpd-manual-2.0.52-49.ent.ia64.rpm
httpd-suexec-2.0.52-49.ent.ia64.rpm
mod_ssl-2.0.52-49.ent.ia64.rpm

ppc:
httpd-2.0.52-49.ent.ppc.rpm
httpd-debuginfo-2.0.52-49.ent.ppc.rpm
httpd-devel-2.0.52-49.ent.ppc.rpm
httpd-manual-2.0.52-49.ent.ppc.rpm
httpd-suexec-2.0.52-49.ent.ppc.rpm
mod_ssl-2.0.52-49.ent.ppc.rpm

s390:
httpd-2.0.52-49.ent.s390.rpm
httpd-debuginfo-2.0.52-49.ent.s390.rpm
httpd-devel-2.0.52-49.ent.s390.rpm
httpd-manual-2.0.52-49.ent.s390.rpm
httpd-suexec-2.0.52-49.ent.s390.rpm
mod_ssl-2.0.52-49.ent.s390.rpm

s390x:
httpd-2.0.52-49.ent.s390x.rpm
httpd-debuginfo-2.0.52-49.ent.s390x.rpm
httpd-devel-2.0.52-49.ent.s390x.rpm
httpd-manual-2.0.52-49.ent.s390x.rpm
httpd-suexec-2.0.52-49.ent.s390x.rpm
mod_ssl-2.0.52-49.ent.s390x.rpm

x86_64:
httpd-2.0.52-49.ent.x86_64.rpm
httpd-debuginfo-2.0.52-49.ent.x86_64.rpm
httpd-devel-2.0.52-49.ent.x86_64.rpm
httpd-manual-2.0.52-49.ent.x86_64.rpm
httpd-suexec-2.0.52-49.ent.x86_64.rpm
mod_ssl-2.0.52-49.ent.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

Source:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/httpd-2.0.52-49.ent.src.rpm

i386:
httpd-2.0.52-49.ent.i386.rpm
httpd-debuginfo-2.0.52-49.ent.i386.rpm
httpd-devel-2.0.52-49.ent.i386.rpm
httpd-manual-2.0.52-49.ent.i386.rpm
httpd-suexec-2.0.52-49.ent.i386.rpm
mod_ssl-2.0.52-49.ent.i386.rpm

x86_64:
httpd-2.0.52-49.ent.x86_64.rpm
httpd-debuginfo-2.0.52-49.ent.x86_64.rpm
httpd-devel-2.0.52-49.ent.x86_64.rpm
httpd-manual-2.0.52-49.ent.x86_64.rpm
httpd-suexec-2.0.52-49.ent.x86_64.rpm
mod_ssl-2.0.52-49.ent.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

Source:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/httpd-2.0.52-49.ent.src.rpm

i386:
httpd-2.0.52-49.ent.i386.rpm
httpd-debuginfo-2.0.52-49.ent.i386.rpm
httpd-devel-2.0.52-49.ent.i386.rpm
httpd-manual-2.0.52-49.ent.i386.rpm
httpd-suexec-2.0.52-49.ent.i386.rpm
mod_ssl-2.0.52-49.ent.i386.rpm

ia64:
httpd-2.0.52-49.ent.ia64.rpm
httpd-debuginfo-2.0.52-49.ent.ia64.rpm
httpd-devel-2.0.52-49.ent.ia64.rpm
httpd-manual-2.0.52-49.ent.ia64.rpm
httpd-suexec-2.0.52-49.ent.ia64.rpm
mod_ssl-2.0.52-49.ent.ia64.rpm

x86_64:
httpd-2.0.52-49.ent.x86_64.rpm
httpd-debuginfo-2.0.52-49.ent.x86_64.rpm
httpd-devel-2.0.52-49.ent.x86_64.rpm
httpd-manual-2.0.52-49.ent.x86_64.rpm
httpd-suexec-2.0.52-49.ent.x86_64.rpm
mod_ssl-2.0.52-49.ent.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

Source:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/httpd-2.0.52-49.ent.src.rpm

i386:
httpd-2.0.52-49.ent.i386.rpm
httpd-debuginfo-2.0.52-49.ent.i386.rpm
httpd-devel-2.0.52-49.ent.i386.rpm
httpd-manual-2.0.52-49.ent.i386.rpm
httpd-suexec-2.0.52-49.ent.i386.rpm
mod_ssl-2.0.52-49.ent.i386.rpm

ia64:
httpd-2.0.52-49.ent.ia64.rpm
httpd-debuginfo-2.0.52-49.ent.ia64.rpm
httpd-devel-2.0.52-49.ent.ia64.rpm
httpd-manual-2.0.52-49.ent.ia64.rpm
httpd-suexec-2.0.52-49.ent.ia64.rpm
mod_ssl-2.0.52-49.ent.ia64.rpm

x86_64:
httpd-2.0.52-49.ent.x86_64.rpm
httpd-debuginfo-2.0.52-49.ent.x86_64.rpm
httpd-devel-2.0.52-49.ent.x86_64.rpm
httpd-manual-2.0.52-49.ent.x86_64.rpm
httpd-suexec-2.0.52-49.ent.x86_64.rpm
mod_ssl-2.0.52-49.ent.x86_64.rpm

Red Hat Enterprise Linux Desktop (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/httpd-2.2.3-53.el5_7.3.src.rpm

i386:
httpd-2.2.3-53.el5_7.3.i386.rpm
httpd-debuginfo-2.2.3-53.el5_7.3.i386.rpm
mod_ssl-2.2.3-53.el5_7.3.i386.rpm

x86_64:
httpd-2.2.3-53.el5_7.3.x86_64.rpm
httpd-debuginfo-2.2.3-53.el5_7.3.x86_64.rpm
mod_ssl-2.2.3-53.el5_7.3.x86_64.rpm

RHEL Desktop Workstation (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/httpd-2.2.3-53.el5_7.3.src.rpm

i386:
httpd-debuginfo-2.2.3-53.el5_7.3.i386.rpm
httpd-devel-2.2.3-53.el5_7.3.i386.rpm
httpd-manual-2.2.3-53.el5_7.3.i386.rpm

x86_64:
httpd-debuginfo-2.2.3-53.el5_7.3.i386.rpm
httpd-debuginfo-2.2.3-53.el5_7.3.x86_64.rpm
httpd-devel-2.2.3-53.el5_7.3.i386.rpm
httpd-devel-2.2.3-53.el5_7.3.x86_64.rpm
httpd-manual-2.2.3-53.el5_7.3.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/httpd-2.2.3-53.el5_7.3.src.rpm

i386:
httpd-2.2.3-53.el5_7.3.i386.rpm
httpd-debuginfo-2.2.3-53.el5_7.3.i386.rpm
httpd-devel-2.2.3-53.el5_7.3.i386.rpm
httpd-manual-2.2.3-53.el5_7.3.i386.rpm
mod_ssl-2.2.3-53.el5_7.3.i386.rpm

ia64:
httpd-2.2.3-53.el5_7.3.ia64.rpm
httpd-debuginfo-2.2.3-53.el5_7.3.ia64.rpm
httpd-devel-2.2.3-53.el5_7.3.ia64.rpm
httpd-manual-2.2.3-53.el5_7.3.ia64.rpm
mod_ssl-2.2.3-53.el5_7.3.ia64.rpm

ppc:
httpd-2.2.3-53.el5_7.3.ppc.rpm
httpd-debuginfo-2.2.3-53.el5_7.3.ppc.rpm
httpd-debuginfo-2.2.3-53.el5_7.3.ppc64.rpm
httpd-devel-2.2.3-53.el5_7.3.ppc.rpm
httpd-devel-2.2.3-53.el5_7.3.ppc64.rpm
httpd-manual-2.2.3-53.el5_7.3.ppc.rpm
mod_ssl-2.2.3-53.el5_7.3.ppc.rpm

s390x:
httpd-2.2.3-53.el5_7.3.s390x.rpm
httpd-debuginfo-2.2.3-53.el5_7.3.s390.rpm
httpd-debuginfo-2.2.3-53.el5_7.3.s390x.rpm
httpd-devel-2.2.3-53.el5_7.3.s390.rpm
httpd-devel-2.2.3-53.el5_7.3.s390x.rpm
httpd-manual-2.2.3-53.el5_7.3.s390x.rpm
mod_ssl-2.2.3-53.el5_7.3.s390x.rpm

x86_64:
httpd-2.2.3-53.el5_7.3.x86_64.rpm
httpd-debuginfo-2.2.3-53.el5_7.3.i386.rpm
httpd-debuginfo-2.2.3-53.el5_7.3.x86_64.rpm
httpd-devel-2.2.3-53.el5_7.3.i386.rpm
httpd-devel-2.2.3-53.el5_7.3.x86_64.rpm
httpd-manual-2.2.3-53.el5_7.3.x86_64.rpm
mod_ssl-2.2.3-53.el5_7.3.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2011-3368.html
https://access.redhat.com/security/updates/classification/#moderate
https://rhn.redhat.com/errata/RHSA-2011-1245.html

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2011 Red Hat, Inc.

[RHSA-2011:1386-01] Important: kernel security, bug fix, and enhancement update

=====================================================================
Red Hat Security Advisory

Synopsis: Important: kernel security, bug fix, and enhancement update
Advisory ID: RHSA-2011:1386-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2011-1386.html
Issue date: 2011-10-20
CVE Names: CVE-2009-4067 CVE-2011-1160 CVE-2011-1585
CVE-2011-1833 CVE-2011-2484 CVE-2011-2496
CVE-2011-2695 CVE-2011-2699 CVE-2011-2723
CVE-2011-2942 CVE-2011-3131 CVE-2011-3188
CVE-2011-3191 CVE-2011-3209 CVE-2011-3347
=====================================================================

1. Summary:

Updated kernel packages that fix multiple security issues, several bugs,
and add one enhancement are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux (v. 5 server) - i386, ia64, noarch, ppc, s390x, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, noarch, x86_64

3. Description:

The kernel packages contain the Linux kernel, the core of any Linux
operating system.

Security fixes:

* The maximum file offset handling for ext4 file systems could allow a
local, unprivileged user to cause a denial of service. (CVE-2011-2695,
Important)

* IPv6 fragment identification value generation could allow a remote
attacker to disrupt a target system's networking, preventing legitimate
users from accessing its services. (CVE-2011-2699, Important)

* A malicious CIFS (Common Internet File System) server could send a
specially-crafted response to a directory read request that would result in
a denial of service or privilege escalation on a system that has a CIFS
share mounted. (CVE-2011-3191, Important)

* A local attacker could use mount.ecryptfs_private to mount (and then
access) a directory they would otherwise not have access to. Note: To
correct this issue, the RHSA-2011:1241 ecryptfs-utils update must also be
installed. (CVE-2011-1833, Moderate)

* A flaw in the taskstats subsystem could allow a local, unprivileged user
to cause excessive CPU time and memory use. (CVE-2011-2484, Moderate)

* Mapping expansion handling could allow a local, unprivileged user to
cause a denial of service. (CVE-2011-2496, Moderate)

* GRO (Generic Receive Offload) fields could be left in an inconsistent
state. An attacker on the local network could use this flaw to cause a
denial of service. GRO is enabled by default in all network drivers that
support it. (CVE-2011-2723, Moderate)

* RHSA-2011:1065 introduced a regression in the Ethernet bridge
implementation. If a system had an interface in a bridge, and an attacker
on the local network could send packets to that interface, they could cause
a denial of service on that system. Xen hypervisor and KVM (Kernel-based
Virtual Machine) hosts often deploy bridge interfaces. (CVE-2011-2942,
Moderate)

* A flaw in the Xen hypervisor IOMMU error handling implementation could
allow a privileged guest user, within a guest operating system that has
direct control of a PCI device, to cause performance degradation on the
host and possibly cause it to hang. (CVE-2011-3131, Moderate)

* IPv4 and IPv6 protocol sequence number and fragment ID generation could
allow a man-in-the-middle attacker to inject packets and possibly hijack
connections. Protocol sequence number and fragment IDs are now more random.
(CVE-2011-3188, Moderate)

* A flaw in the kernel's clock implementation could allow a local,
unprivileged user to cause a denial of service. (CVE-2011-3209, Moderate)

* Non-member VLAN (virtual LAN) packet handling for interfaces in
promiscuous mode and also using the be2net driver could allow an attacker
on the local network to cause a denial of service. (CVE-2011-3347,
Moderate)

* A flaw in the auerswald USB driver could allow a local, unprivileged user
to cause a denial of service or escalate their privileges by inserting a
specially-crafted USB device. (CVE-2009-4067, Low)

* A flaw in the Trusted Platform Module (TPM) implementation could allow a
local, unprivileged user to leak information to user space. (CVE-2011-1160,
Low)

* A local, unprivileged user could possibly mount a CIFS share that
requires authentication without knowing the correct password if the mount
was already mounted by another local user. (CVE-2011-1585, Low)

Red Hat would like to thank Fernando Gont for reporting CVE-2011-2699;
Darren Lavender for reporting CVE-2011-3191; the Ubuntu Security Team for
reporting CVE-2011-1833; Vasiliy Kulikov of Openwall for reporting
CVE-2011-2484; Robert Swiecki for reporting CVE-2011-2496; Brent Meshier
for reporting CVE-2011-2723; Dan Kaminsky for reporting CVE-2011-3188;
Yasuaki Ishimatsu for reporting CVE-2011-3209; Somnath Kotur for reporting
CVE-2011-3347; Rafael Dominguez Vega for reporting CVE-2009-4067; and Peter
Huewe for reporting CVE-2011-1160. The Ubuntu Security Team acknowledges
Vasiliy Kulikov of Openwall and Dan Rosenberg as the original reporters of
CVE-2011-1833.

4. Solution:

This update also fixes several bugs and adds one enhancement.
Documentation for these changes will be available shortly from the
Technical Notes document linked to in the References section.

Users should upgrade to these updated packages, which contain
backported patches to correct these issues, and fix the bugs and add
the enhancement noted in the Technical Notes. The system must be
rebooted for this update to take effect.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

To install kernel packages manually, use "rpm -ivh [package]". Do not
use "rpm -Uvh" as that will remove the running kernel binaries from
your system. You may use "rpm -e" to remove old kernels after
determining that the new kernel functions properly on your system.

5. Bugs fixed (http://bugzilla.redhat.com/):

684671 - CVE-2011-1160 kernel: tpm infoleaks
697394 - CVE-2011-1585 kernel: cifs session reuse
715436 - CVE-2011-2484 kernel: taskstats: duplicate entries in listener mode can lead to DoS
716538 - CVE-2011-2496 kernel: mm: avoid wrapping vm_pgoff in mremap() and stack expansions
722393 - CVE-2009-4067 kernel: usb: buffer overflow in auerswald_probe()
722557 - CVE-2011-2695 kernel: ext4: kernel panic when writing data to the last block of sparse file
723429 - CVE-2011-2699 kernel: ipv6: make fragment identifications less predictable
726552 - CVE-2011-2723 kernel: gro: only reset frag0 when skb can be pulled
728518 - win2003 i386 guest BSOD when created with e1000 nic [rhel-5.7.z]
730341 - CVE-2011-3131 kernel: xen: IOMMU fault livelock
730682 - [EL5.7] igb: failed to activate WOL on 2nd LAN port on i350 [rhel-5.7.z]
730686 - Huge performance regression in NFS client [rhel-5.7.z]
730917 - CVE-2011-2942 kernel: bridge: null pointer dereference in __br_deliver
731172 - CVE-2011-1833 kernel: ecryptfs: mount source TOCTOU race
732658 - CVE-2011-3188 kernel: net: improve sequence number generation
732869 - CVE-2011-3191 kernel: cifs: signedness issue in CIFSFindNext()
732878 - CVE-2011-3209 kernel: panic occurs when clock_gettime() is called
733665 - Incorrect values in /proc/sys/vm/dirty_writeback_centises and dirty_expire_centisecs [rhel-5.7.z]
736425 - CVE-2011-3347 kernel: be2net: promiscuous mode and non-member VLAN packets DoS
738389 - Patch needed to allow MTU >1500 on vif prior to connecting to bridge [rhel-5.7.z]
738392 - netfront MTU drops to 1500 after domain migration [rhel-5.7.z]
739823 - 2.6.18-238.1.1.el5 or newer won't boot under Xen HVM due to linux-2.6-virt-nmi-don-t-print-nmi-stuck-messages-on-guests.patch [rhel-5.7.z]

6. Package List:

Red Hat Enterprise Linux Desktop (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/kernel-2.6.18-274.7.1.el5.src.rpm

i386:
kernel-2.6.18-274.7.1.el5.i686.rpm
kernel-PAE-2.6.18-274.7.1.el5.i686.rpm
kernel-PAE-debuginfo-2.6.18-274.7.1.el5.i686.rpm
kernel-PAE-devel-2.6.18-274.7.1.el5.i686.rpm
kernel-debug-2.6.18-274.7.1.el5.i686.rpm
kernel-debug-debuginfo-2.6.18-274.7.1.el5.i686.rpm
kernel-debug-devel-2.6.18-274.7.1.el5.i686.rpm
kernel-debuginfo-2.6.18-274.7.1.el5.i686.rpm
kernel-debuginfo-common-2.6.18-274.7.1.el5.i686.rpm
kernel-devel-2.6.18-274.7.1.el5.i686.rpm
kernel-headers-2.6.18-274.7.1.el5.i386.rpm
kernel-xen-2.6.18-274.7.1.el5.i686.rpm
kernel-xen-debuginfo-2.6.18-274.7.1.el5.i686.rpm
kernel-xen-devel-2.6.18-274.7.1.el5.i686.rpm

noarch:
kernel-doc-2.6.18-274.7.1.el5.noarch.rpm

x86_64:
kernel-2.6.18-274.7.1.el5.x86_64.rpm
kernel-debug-2.6.18-274.7.1.el5.x86_64.rpm
kernel-debug-debuginfo-2.6.18-274.7.1.el5.x86_64.rpm
kernel-debug-devel-2.6.18-274.7.1.el5.x86_64.rpm
kernel-debuginfo-2.6.18-274.7.1.el5.x86_64.rpm
kernel-debuginfo-2.6.18-274.7.1.el5.x86_64.rpm
kernel-debuginfo-common-2.6.18-274.7.1.el5.x86_64.rpm
kernel-devel-2.6.18-274.7.1.el5.x86_64.rpm
kernel-headers-2.6.18-274.7.1.el5.x86_64.rpm
kernel-xen-2.6.18-274.7.1.el5.x86_64.rpm
kernel-xen-debuginfo-2.6.18-274.7.1.el5.x86_64.rpm
kernel-xen-devel-2.6.18-274.7.1.el5.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/kernel-2.6.18-274.7.1.el5.src.rpm

i386:
kernel-2.6.18-274.7.1.el5.i686.rpm
kernel-PAE-2.6.18-274.7.1.el5.i686.rpm
kernel-PAE-debuginfo-2.6.18-274.7.1.el5.i686.rpm
kernel-PAE-devel-2.6.18-274.7.1.el5.i686.rpm
kernel-debug-2.6.18-274.7.1.el5.i686.rpm
kernel-debug-debuginfo-2.6.18-274.7.1.el5.i686.rpm
kernel-debug-devel-2.6.18-274.7.1.el5.i686.rpm
kernel-debuginfo-2.6.18-274.7.1.el5.i686.rpm
kernel-debuginfo-common-2.6.18-274.7.1.el5.i686.rpm
kernel-devel-2.6.18-274.7.1.el5.i686.rpm
kernel-headers-2.6.18-274.7.1.el5.i386.rpm
kernel-xen-2.6.18-274.7.1.el5.i686.rpm
kernel-xen-debuginfo-2.6.18-274.7.1.el5.i686.rpm
kernel-xen-devel-2.6.18-274.7.1.el5.i686.rpm

ia64:
kernel-2.6.18-274.7.1.el5.ia64.rpm
kernel-debug-2.6.18-274.7.1.el5.ia64.rpm
kernel-debug-debuginfo-2.6.18-274.7.1.el5.ia64.rpm
kernel-debug-devel-2.6.18-274.7.1.el5.ia64.rpm
kernel-debuginfo-2.6.18-274.7.1.el5.ia64.rpm
kernel-debuginfo-common-2.6.18-274.7.1.el5.ia64.rpm
kernel-devel-2.6.18-274.7.1.el5.ia64.rpm
kernel-headers-2.6.18-274.7.1.el5.ia64.rpm
kernel-xen-2.6.18-274.7.1.el5.ia64.rpm
kernel-xen-debuginfo-2.6.18-274.7.1.el5.ia64.rpm
kernel-xen-devel-2.6.18-274.7.1.el5.ia64.rpm

noarch:
kernel-doc-2.6.18-274.7.1.el5.noarch.rpm

ppc:
kernel-2.6.18-274.7.1.el5.ppc64.rpm
kernel-debug-2.6.18-274.7.1.el5.ppc64.rpm
kernel-debug-debuginfo-2.6.18-274.7.1.el5.ppc64.rpm
kernel-debug-devel-2.6.18-274.7.1.el5.ppc64.rpm
kernel-debuginfo-2.6.18-274.7.1.el5.ppc64.rpm
kernel-debuginfo-common-2.6.18-274.7.1.el5.ppc64.rpm
kernel-devel-2.6.18-274.7.1.el5.ppc64.rpm
kernel-headers-2.6.18-274.7.1.el5.ppc.rpm
kernel-headers-2.6.18-274.7.1.el5.ppc64.rpm
kernel-kdump-2.6.18-274.7.1.el5.ppc64.rpm
kernel-kdump-debuginfo-2.6.18-274.7.1.el5.ppc64.rpm
kernel-kdump-devel-2.6.18-274.7.1.el5.ppc64.rpm

s390x:
kernel-2.6.18-274.7.1.el5.s390x.rpm
kernel-debug-2.6.18-274.7.1.el5.s390x.rpm
kernel-debug-debuginfo-2.6.18-274.7.1.el5.s390x.rpm
kernel-debug-devel-2.6.18-274.7.1.el5.s390x.rpm
kernel-debuginfo-2.6.18-274.7.1.el5.s390x.rpm
kernel-debuginfo-common-2.6.18-274.7.1.el5.s390x.rpm
kernel-devel-2.6.18-274.7.1.el5.s390x.rpm
kernel-headers-2.6.18-274.7.1.el5.s390x.rpm
kernel-kdump-2.6.18-274.7.1.el5.s390x.rpm
kernel-kdump-debuginfo-2.6.18-274.7.1.el5.s390x.rpm
kernel-kdump-devel-2.6.18-274.7.1.el5.s390x.rpm

x86_64:
kernel-2.6.18-274.7.1.el5.x86_64.rpm
kernel-debug-2.6.18-274.7.1.el5.x86_64.rpm
kernel-debug-debuginfo-2.6.18-274.7.1.el5.x86_64.rpm
kernel-debug-devel-2.6.18-274.7.1.el5.x86_64.rpm
kernel-debuginfo-2.6.18-274.7.1.el5.x86_64.rpm
kernel-debuginfo-common-2.6.18-274.7.1.el5.x86_64.rpm
kernel-devel-2.6.18-274.7.1.el5.x86_64.rpm
kernel-headers-2.6.18-274.7.1.el5.x86_64.rpm
kernel-xen-2.6.18-274.7.1.el5.x86_64.rpm
kernel-xen-debuginfo-2.6.18-274.7.1.el5.x86_64.rpm
kernel-xen-devel-2.6.18-274.7.1.el5.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2009-4067.html
https://www.redhat.com/security/data/cve/CVE-2011-1160.html
https://www.redhat.com/security/data/cve/CVE-2011-1585.html
https://www.redhat.com/security/data/cve/CVE-2011-1833.html
https://www.redhat.com/security/data/cve/CVE-2011-2484.html
https://www.redhat.com/security/data/cve/CVE-2011-2496.html
https://www.redhat.com/security/data/cve/CVE-2011-2695.html
https://www.redhat.com/security/data/cve/CVE-2011-2699.html
https://www.redhat.com/security/data/cve/CVE-2011-2723.html
https://www.redhat.com/security/data/cve/CVE-2011-2942.html
https://www.redhat.com/security/data/cve/CVE-2011-3131.html
https://www.redhat.com/security/data/cve/CVE-2011-3188.html
https://www.redhat.com/security/data/cve/CVE-2011-3191.html
https://www.redhat.com/security/data/cve/CVE-2011-3209.html
https://www.redhat.com/security/data/cve/CVE-2011-3347.html
https://access.redhat.com/security/updates/classification/#important
https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/5.7_Technical_Notes/kernel.html#RHSA-2011-1386
https://rhn.redhat.com/errata/RHSA-2011-1241.html
https://rhn.redhat.com/errata/RHSA-2011-1065.html

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2011 Red Hat, Inc.