lug-bg: Kernel Exploit for 2.4.x, 2.5.x, and 2.6.x kernel branches.] security fix for Fedora Core 1

[ilia <iliad@xxxxxx>]

[SECURITY] Fedora Core 1 Update: kernel-2.4.22-1.2179.nptl

[NEWS] 2004-04-15
Per David Jones with Red Hat, md5sums have been corrected in this Advisory.

http://www.redhat.com/archives/fedora-announce-list/2004-April/msg00004.html

---------------------------------------------------------------------
Fedora Update Notification
FEDORA-2004-101
2004-04-14
---------------------------------------------------------------------

Name        : kernel
Version     : 2.4.22                      
Release     : 1.2179.nptl                  
Summary     : The Linux kernel (the core of the Linux operating system)
Description :
The kernel package contains the Linux kernel (vmlinuz), the core of your
Fedora Core Linux operating system.  The kernel handles the basic functions
of the operating system:  memory allocation, process allocation, device
input and output, etc.

---------------------------------------------------------------------
Update Information:

iDefense reported a buffer overflow flaw in the ISO9660 filesystem code.
An attacker could create a malicious filesystem in such a way that they
could gain root privileges if that filesystem is mounted. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2004-0109 to this issue.

Solar Designer from OpenWall discovered a minor information leak in the
ext3 filesystem code due to the lack of initialization of journal
descriptor blocks. This flaw has only minor security implications and
exploitation requires privileged access to the raw device. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2004-0133 to this issue.

These packages also contain an updated fix with additional checks for
issues in the R128 Direct Render Infrastructure. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2004-0003 to this issue.

Additionally, additional hardening of the mremap function was applied to
prevent a potential local denial of service attack.

The low latency patch applied in previous kernels has also been found
to cause stability problems under certain conditions. It has been disabled in
this update whilst further investigation occurs.

---------------------------------------------------------------------

* Tue Apr 13 2004 Dave Jones 
- mremap NULL pointer dereference fix
- Disable low latency patch, pending investigation into crashes.
- Additional r128 DRM check. (CAN-2004-0003)
- Bounds checking in ISO9660 filesystem. (CAN-2004-0109)
- Fix Information leak in EXT3 (CAN-2004-0133)

---------------------------------------------------------------------
This update can be downloaded from:
 http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/

614d9051d0224008dcc270e0d8b9c463  2.4.22-1.2179.nptl/x86_64/kernel-2.4.22-1.2179.nptl.x86_64.rpm
b9cb0cbeb925bca8a12ba63058f15d28  2.4.22-1.2179.nptl/x86_64/kernel-source-2.4.22-1.2179.nptl.x86_64.rpm
96e738a8be19378abaaef8eee1f252d0  2.4.22-1.2179.nptl/x86_64/kernel-doc-2.4.22-1.2179.nptl.x86_64.rpm
1bd46eacb1eb5d25f0523a3aae7bea85  2.4.22-1.2179.nptl/x86_64/kernel-smp-2.4.22-1.2179.nptl.x86_64.rpm
ad8953b2fa8152576888c725432ed098  2.4.22-1.2179.nptl/x86_64/kernel-debuginfo-2.4.22-1.2179.nptl.x86_64.rpm
91eceae5508c8939af5d677bee5654c7  2.4.22-1.2179.nptl/SRPMS/kernel-2.4.22-1.2179.nptl.src.rpm
b9368e3c63dcd9cf8ddc72a90d669a4c  2.4.22-1.2179.nptl/i686/kernel-2.4.22-1.2179.nptl.i686.rpm
ecd1a72eea8cc01c78fa8ed880a43f6f  2.4.22-1.2179.nptl/i686/kernel-smp-2.4.22-1.2179.nptl.i686.rpm
fd4f04571b3d0002ad37be017e686b3f  2.4.22-1.2179.nptl/i686/kernel-debuginfo-2.4.22-1.2179.nptl.i686.rpm
ed2880317a12d54c0a078e11ce979a83  2.4.22-1.2179.nptl/i386/kernel-source-2.4.22-1.2179.nptl.i386.rpm
a074148ab23312a5a32db9b3a2792bdc  2.4.22-1.2179.nptl/i386/kernel-doc-2.4.22-1.2179.nptl.i386.rpm
41812eb52e21595476b00b59c7f2c9b7  2.4.22-1.2179.nptl/i386/kernel-BOOT-2.4.22-1.2179.nptl.i386.rpm
43171ce5f8683b66679f855453bbc479  2.4.22-1.2179.nptl/i386/kernel-debuginfo-2.4.22-1.2179.nptl.i386.rpm
af5b012b2cc5eeb815dc8a5e69975060  2.4.22-1.2179.nptl/athlon/kernel-2.4.22-1.2179.nptl.athlon.rpm
86e216f025311cc98bc3d209698e7aa7  2.4.22-1.2179.nptl/athlon/kernel-smp-2.4.22-1.2179.nptl.athlon.rpm
fcfd93b137278ceb880e774d6f07b5a6  2.4.22-1.2179.nptl/athlon/kernel-debuginfo-2.4.22-1.2179.nptl.athlon.rpm
6cac4bf3a414cde461294fa3b44b68f9  2.4.22-1.2179.nptl/i586/kernel-2.4.22-1.2179.nptl.i586.rpm
35df3c2e929a69aa4ddb07638695c329  2.4.22-1.2179.nptl/i586/kernel-debuginfo-2.4.22-1.2179.nptl.i586.rpm 

This update can also be installed with the Update Agent; you can
launch the Update Agent with the 'up2date' command.