__________________________________________________________
	
						   The U.S. Department of Energy
					   Computer Incident Advisory Capability
							   ___  __ __    _     ___
							  /       |     /_\   /
							  \___  __|__  /   \  \___
				 __________________________________________________________
	
								 INFORMATION BULLETIN
	
								 Kernel Security Update
							  [Red Hat  RHSA-2007:0936-2]
	
	September 27, 2007 20:00 GMT                                      Number R-360
	[REVISED 27 Sept 2007]
	[REVISED 28 Sept 2007]
	______________________________________________________________________________
	PROBLEM:       A flaw was found in the IA32 system call emulation provided on 
				   AMD64 and Intel 64 platforms. 
	PLATFORM:      Red Hat Enterprise Linux (v. 5 server) 
				   Red Hat Enterprise Linux Desktop (v. 5 client) 
				   Ubunto 6.06 LTS
				   Ubunto 6.10
				   Ubunto 7.04
				   Debian GNU/Linux 4.0 (etch)
	DAMAGE:        An untrusted local user could exploit this flaw to run code in 
				   the kernel (ie a root privilege escalation). 
	SOLUTION:      Upgrade to the appropriate version. 
	______________________________________________________________________________
	VULNERABILITY  The risk is MEDIUM. An untrusted local user could gain root 
	ASSESSMENT:    privileges. 
	______________________________________________________________________________
	LINKS: 
	 CIAC BULLETIN:      http://www.ciac.org/ciac/bulletins/r-360.shtml 
	 ORIGINAL BULLETIN:  https://rhn.redhat.com/errata/RHSA-2007-0936.html 
	 ADDITIONAL LINKS:   http://www.ubuntu.com/usn/usn-518-1
	                     http://www.debian.org/security/2007/dsa-1378
	 CVE:                http://www.cve.mitre.org/cgi-bin/cvename.cgi?name= 
						 CVE-2007-4573 
	______________________________________________________________________________
	REVISION HISTORY:
	9/27/2007 - revised R-360 to add a link to Ubunto Security Notice USN-518-1 for
                Ubunto 6.06 LTS, Ubunto 6.10, and Ubunto 7.04.
	9/28/2007 - revised R-348 to add a link to Debian Security Advisory DSA-1378-1
                for Debian GNU/Linux 4.0 (etch).
			
			



	[***** Start Red Hat  RHSA-2007:0936-2 *****]
	
	Important: kernel security update
	Advisory: RHSA-2007:0936-2 
	Type: Security Advisory 
	Severity: Important 
	Issued on: 2007-09-27 
	Last updated on: 2007-09-27 
	Affected Products: Red Hat Enterprise Linux (v. 5 server)
	Red Hat Enterprise Linux Desktop (v. 5 client) 
	OVAL: com.redhat.rhsa-20070936.xml 
	CVEs (cve.mitre.org): CVE-2007-4573
	 
	
	
	Details
	Updated kernel packages that fix a security issue in the Red Hat Enterprise 
	Linux 5 kernel are now available. 
	
	This update has been rated as having important security impact by the Red 
	Hat Security Response Team.
	
	The Linux kernel handles the basic functions of the operating system. 
	
	A flaw was found in the IA32 system call emulation provided on AMD64 and 
	Intel 64 platforms. An improperly validated 64-bit value could be stored in 
	the %RAX register, which could trigger an out-of-bounds system call table 
	access. An untrusted local user could exploit this flaw to run code in the 
	kernel (ie a root privilege escalation). (CVE-2007-4573). 
	
	Red Hat would like to thank Wojciech Purczynski for reporting this issue. 
	
	Red Hat Enterprise Linux 5 users are advised to upgrade to these packages, 
	which contain a backported patch to correct this issue.
	
	
	
	Solution
	Before applying this update, make sure that all previously-released 
	errata relevant to your system have been applied. 
	
	This update is available via Red Hat Network. Details on how to use 
	the Red Hat Network to apply this update are available at 
	http://kbase.redhat.com/faq/FAQ_58_10188
	
	
	Updated packages
	Red Hat Enterprise Linux (v. 5 server) 
	
	--------------------------------------------------------------------------------
	 
	SRPMS: 
	kernel-2.6.18-8.1.14.el5.src.rpm     e864e7c886ad6bd8a466d601e124d173 
	  
	IA-32: 
	kernel-2.6.18-8.1.14.el5.i686.rpm     c5708f61da5a1cd657387fd668c09070 
	kernel-PAE-2.6.18-8.1.14.el5.i686.rpm     bff45b4bb682aac45063413899a06576 
	kernel-PAE-devel-2.6.18-8.1.14.el5.i686.rpm     babeefe626d9cfa77e916def06eebca8 
	kernel-devel-2.6.18-8.1.14.el5.i686.rpm     5e4a74221dc2d89eb61687483d765da7 
	kernel-doc-2.6.18-8.1.14.el5.noarch.rpm     c126057734f1b94f43174a83ab6614a9 
	kernel-headers-2.6.18-8.1.14.el5.i386.rpm     3a6500224f3247fb02eb15fdf1dcf7fa 
	kernel-xen-2.6.18-8.1.14.el5.i686.rpm     6e6ff28d8bc48e9227bd15e30fe6a222 
	kernel-xen-devel-2.6.18-8.1.14.el5.i686.rpm     3d8089808868c8848160c50f9836c50d 
	  
	IA-64: 
	kernel-2.6.18-8.1.14.el5.ia64.rpm     04f3f9061fdd5dd13976ec24d6490f3c 
	kernel-devel-2.6.18-8.1.14.el5.ia64.rpm     f1ea0fc12a5f524207b352bb2797797b 
	kernel-doc-2.6.18-8.1.14.el5.noarch.rpm     c126057734f1b94f43174a83ab6614a9 
	kernel-headers-2.6.18-8.1.14.el5.ia64.rpm     bf20f192973330148a4e39fb01ebb2ac 
	kernel-xen-2.6.18-8.1.14.el5.ia64.rpm     043bea776071be0fbec7bfcb2ca26c71 
	kernel-xen-devel-2.6.18-8.1.14.el5.ia64.rpm     642a0cc7fb33898b1c8e29c0b3b2144d 
	  
	PPC: 
	kernel-2.6.18-8.1.14.el5.ppc64.rpm     fd1014c95cdafb8f2f5821edb8fe3e3e 
	kernel-devel-2.6.18-8.1.14.el5.ppc64.rpm     6f90335fc97510f00d412433d2cac5d6 
	kernel-doc-2.6.18-8.1.14.el5.noarch.rpm     c126057734f1b94f43174a83ab6614a9 
	kernel-headers-2.6.18-8.1.14.el5.ppc.rpm     b198a4254da4be818b65568f43a1d13f 
	kernel-headers-2.6.18-8.1.14.el5.ppc64.rpm     912b2826d06f1ec64c5285d210cdcda3 
	kernel-kdump-2.6.18-8.1.14.el5.ppc64.rpm     9bcded50fdf04a34cf068be0205751ba 
	kernel-kdump-devel-2.6.18-8.1.14.el5.ppc64.rpm     18c9d8881fb4ac39b9a147f75aec7d8b 
	  
	s390x: 
	kernel-2.6.18-8.1.14.el5.s390x.rpm     e9e962c7ef8589a669ff3491bd65d294 
	kernel-devel-2.6.18-8.1.14.el5.s390x.rpm     b3a54a09be16b1a727e54364755514f4 
	kernel-doc-2.6.18-8.1.14.el5.noarch.rpm     c126057734f1b94f43174a83ab6614a9 
	kernel-headers-2.6.18-8.1.14.el5.s390x.rpm     5f94fecd0b8622617fb48c49819b97bb 
	  
	x86_64: 
	kernel-2.6.18-8.1.14.el5.x86_64.rpm     768d7dcf7eed6bbf7add28d46237d3e5 
	kernel-devel-2.6.18-8.1.14.el5.x86_64.rpm     181e5913174d98cc4bb0f919ddc770b2 
	kernel-doc-2.6.18-8.1.14.el5.noarch.rpm     c126057734f1b94f43174a83ab6614a9 
	kernel-headers-2.6.18-8.1.14.el5.x86_64.rpm     60bd95d21e87bf5f8b7cd6b2eae982e1 
	kernel-xen-2.6.18-8.1.14.el5.x86_64.rpm     413f70b178c8374137d3305ea1a4cc36 
	kernel-xen-devel-2.6.18-8.1.14.el5.x86_64.rpm     5f7ffa8121bb45510b25110973ff677f 
	  
	Red Hat Enterprise Linux Desktop (v. 5 client) 
	
	--------------------------------------------------------------------------------
	 
	SRPMS: 
	kernel-2.6.18-8.1.14.el5.src.rpm     e864e7c886ad6bd8a466d601e124d173 
	  
	IA-32: 
	kernel-2.6.18-8.1.14.el5.i686.rpm     c5708f61da5a1cd657387fd668c09070 
	kernel-PAE-2.6.18-8.1.14.el5.i686.rpm     bff45b4bb682aac45063413899a06576 
	kernel-PAE-devel-2.6.18-8.1.14.el5.i686.rpm     babeefe626d9cfa77e916def06eebca8 
	kernel-devel-2.6.18-8.1.14.el5.i686.rpm     5e4a74221dc2d89eb61687483d765da7 
	kernel-doc-2.6.18-8.1.14.el5.noarch.rpm     c126057734f1b94f43174a83ab6614a9 
	kernel-headers-2.6.18-8.1.14.el5.i386.rpm     3a6500224f3247fb02eb15fdf1dcf7fa 
	kernel-xen-2.6.18-8.1.14.el5.i686.rpm     6e6ff28d8bc48e9227bd15e30fe6a222 
	kernel-xen-devel-2.6.18-8.1.14.el5.i686.rpm     3d8089808868c8848160c50f9836c50d 
	  
	x86_64: 
	kernel-2.6.18-8.1.14.el5.x86_64.rpm     768d7dcf7eed6bbf7add28d46237d3e5 
	kernel-devel-2.6.18-8.1.14.el5.x86_64.rpm     181e5913174d98cc4bb0f919ddc770b2 
	kernel-doc-2.6.18-8.1.14.el5.noarch.rpm     c126057734f1b94f43174a83ab6614a9 
	kernel-headers-2.6.18-8.1.14.el5.x86_64.rpm     60bd95d21e87bf5f8b7cd6b2eae982e1 
	kernel-xen-2.6.18-8.1.14.el5.x86_64.rpm     413f70b178c8374137d3305ea1a4cc36 
	kernel-xen-devel-2.6.18-8.1.14.el5.x86_64.rpm     5f7ffa8121bb45510b25110973ff677f 
	  
	(The unlinked packages above are only available from the Red Hat Network)
	 
	
	
	Bugs fixed (see bugzilla for more information)
	294541 - CVE-2007-4573 x86_64 syscall vulnerability
	
	
	
	References
	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4573
	http://www.redhat.com/security/updates/classification/#important 
	
	
	--------------------------------------------------------------------------------
	These packages are GPG signed by Red Hat for security. Our key and details on how 
	to verify the signature are available from:
	
	https://www.redhat.com/security/team/key/#package 
	
	The Red Hat security contact is secalert@redhat.com. More contact details at 
	http://www.redhat.com/security/team/contact/
	
	
	[***** End Red Hat  RHSA-2007:0936-2 *****]
	_______________________________________________________________________________
	
	CIAC wishes to acknowledge the contributions of Red Hat for the 
	information contained in this bulletin.
	_______________________________________________________________________________
	
	
	CIAC, the Computer Incident Advisory Capability, is the computer
	security incident response team for the U.S. Department of Energy
	(DOE) and the emergency backup response team for the National
	Institutes of Health (NIH). CIAC is located at the Lawrence Livermore
	National Laboratory in Livermore, California. CIAC is also a founding
	member of FIRST, the Forum of Incident Response and Security Teams, a
	global organization established to foster cooperation and coordination
	among computer security teams worldwide.
	
	CIAC services are available to DOE, DOE contractors, and the NIH. CIAC
	can be contacted at:
		Voice:    +1 925-422-8193 (7x24)
		FAX:      +1 925-423-8002
		STU-III:  +1 925-423-2604
		E-mail:   ciac@ciac.org
	
	Previous CIAC notices, anti-virus software, and other information are
	available from the CIAC Computer Security Archive.
	
	   World Wide Web:      http://www.ciac.org/
	   Anonymous FTP:       ftp.ciac.org
	
	PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing
	communities receive CIAC bulletins.  If you are not part of these
	communities, please contact your agency's response team to report
	incidents. Your agency's team will coordinate with CIAC. The Forum of
	Incident Response and Security Teams (FIRST) is a world-wide
	organization. A list of FIRST member organizations and their
	constituencies can be obtained via WWW at http://www.first.org/.
	
	This document was prepared as an account of work sponsored by an
	agency of the United States Government. Neither the United States
	Government nor the University of California nor any of their
	employees, makes any warranty, express or implied, or assumes any
	legal liability or responsibility for the accuracy, completeness, or
	usefulness of any information, apparatus, product, or process
	disclosed, or represents that its use would not infringe privately
	owned rights. Reference herein to any specific commercial products,
	process, or service by trade name, trademark, manufacturer, or
	otherwise, does not necessarily constitute or imply its endorsement,
	recommendation or favoring by the United States Government or the
	University of California. The views and opinions of authors expressed
	herein do not necessarily state or reflect those of the United States
	Government or the University of California, and shall not be used for
	advertising or product endorsement purposes.
	
	LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC)
	
	R-350: Gt Security Update
	R-351: Denial of Service Vulnerabilities in Content Switching Module
	R-352: The Cisco Adaptive Security Appliance Vulnerability
	R-353: phpWiki Security Vulnerabilities
	R-354: Earth Resources Mapping NCSView ActiveX Vulnerabilities
	R-355: PHP Security Update
	R-356: OpenOffice.org Security Update
	R-357: HP-UX Running logins(1M) Vulnerability
	R-358: kdebase Vulnerability
	R-359: Tomcat Security Update