A flaw was discovered in the way file checksums were stored in the AIDE database. A packaging flaw in the Red Hat AIDE rpm resulted in the file database not containing any file checksum information. This could prevent AIDE from detecting certain file modifications. This update has been rated as having moderate security impact by the Red Hat Security Response Team.

- ---------------------------------------------------------------------                   Red Hat Security Advisory

Synopsis:          Moderate: aide security update
Advisory ID:       RHSA-2007:0539-01
Advisory URL:      https://access.redhat.com/errata/RHSA-2007:0539.html
Issue date:        2007-09-04
Updated on:        2007-09-04
Product:           Red Hat Enterprise Linux
Keywords:          aide
CVE Names:         CVE-2007-3849 
- ---------------------------------------------------------------------1. Summary:

An updated aide package that fixes various bugs is now available for Red
Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64

3. Problem description:

Advanced Intrusion Detection Environment (AIDE) is a file integrity checker
and intrusion detection program.

A flaw was discovered in the way file checksums were stored in the AIDE
database. A packaging flaw in the Red Hat AIDE rpm resulted in the file
database not containing any file checksum information. This could prevent
AIDE from detecting certain file modifications. (CVE-2007-3849)

This update also fixes the following bugs:

* certain configurations could result in a segmentation fault upon
initialization.

* AIDE was unable to open its log file in the LSPP evaluated configuration.

* if AIDE found SELinux context differences, the changed files report it
generated only included the first 32 characters of the context.

All users of AIDE are advised to upgrade to this updated package containing
AIDE version 0.13.1 which is not vulnerable to these issues.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.  

This update is available via Red Hat Network.  Details on how to use 
the Red Hat Network to apply this update are available at

5. Bug IDs fixed (http://bugzilla.redhat.com/):

225089 - aide Segmentation fault on initialization
236855 - LSPP: aide can't write its log file
236923 - CVE-2007-3849 Rebase aide to 0.13.1
240144 - [LSPP] aide report output limits context to 32char -- not evaluation blocking

6. RPMs required:

Red Hat Enterprise Linux Desktop (v. 5 client):

SRPMS:
5ae051f7cebfbef7ebf4829c41134b07  aide-0.13.1-2.0.4.el5.src.rpm

i386:
63b364d7e2d356b0441ada657dd40312  aide-0.13.1-2.0.4.el5.i386.rpm
7eb96b96b84e9482583ae4afe2b614b0  aide-debuginfo-0.13.1-2.0.4.el5.i386.rpm

x86_64:
b5bb0f3be1d18d4dbd4784e9238b66b9  aide-0.13.1-2.0.4.el5.x86_64.rpm
5844acb1a87c4ffa36d97382b87f49f6  aide-debuginfo-0.13.1-2.0.4.el5.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

SRPMS:
5ae051f7cebfbef7ebf4829c41134b07  aide-0.13.1-2.0.4.el5.src.rpm

i386:
63b364d7e2d356b0441ada657dd40312  aide-0.13.1-2.0.4.el5.i386.rpm
7eb96b96b84e9482583ae4afe2b614b0  aide-debuginfo-0.13.1-2.0.4.el5.i386.rpm

ia64:
b6981b6f0287f3a1d958f7627782f695  aide-0.13.1-2.0.4.el5.ia64.rpm
c1244a0baa9901db07e39e4d2e697abf  aide-debuginfo-0.13.1-2.0.4.el5.ia64.rpm

ppc:
15d4fcbf6efdd60052f3258c0c95d5a1  aide-0.13.1-2.0.4.el5.ppc.rpm
4f106c80aa147f95e92b13dd18b7ed54  aide-debuginfo-0.13.1-2.0.4.el5.ppc.rpm

s390x:
e9df37b291bf6b7d0367d3d4fc966e52  aide-0.13.1-2.0.4.el5.s390x.rpm
d0ea63d7118f3ffcedfdd6996b72d4cc  aide-debuginfo-0.13.1-2.0.4.el5.s390x.rpm

x86_64:
b5bb0f3be1d18d4dbd4784e9238b66b9  aide-0.13.1-2.0.4.el5.x86_64.rpm
5844acb1a87c4ffa36d97382b87f49f6  aide-debuginfo-0.13.1-2.0.4.el5.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://access.redhat.com/security/team/key#package

7. References:

https://www.cve.org/CVERecord?id=CVE-2007-3849
https://access.redhat.com/security/updates/classification#moderate

8. Contact:

The Red Hat security contact is .  More contact
details at https://access.redhat.com/security/team/contact

Copyright 2007 Red Hat, Inc.