Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found -7 articles for you...
98
security advisorymoderatesystem enhancementRed Hat Enterprise MRG Realtime 2.5 RHSA-2014:1318-01 Moderate Security
Updated Red Hat Enterprise MRG Realtime packages that fix multiple security issues and add one enhancement are now available for Red Hat Enterprise MRG 2.5. Red Hat Product Security has rated this update as having Moderate security. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat Enterprise MRG Realtime 2.5 security and enhancement update Advisory ID: RHSA-2014:1318-01 Product: Red Hat Enterprise MRG for RHEL-6 Advisory URL: https://access.redhat.com/errata/RHSA-2014:1318.html Issue date: 2014-09-29 CVE Names: CVE-2014-3181 CVE-2014-3182 CVE-2014-3184 CVE-2014-3185 CVE-2014-4171 CVE-2014-5471 CVE-2014-5472 CVE-2014-6410 ==================================================================== 1. Summary: Updated Red Hat Enterprise MRG Realtime packages that fix multiple security issues and add one enhancement are now available for Red Hat Enterprise MRG 2.5. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: MRG Realtime for RHEL 6 Server v.2 - noarch, x86_64 3. Description: Red Hat Enterprise MRG (Messaging, Realtime, and Grid) is a next-generation IT infrastructure for enterprise computing. MRG offers increased performance, reliability, interoperability, and faster computing for enterprise customers. MRG Realtime provides the highest levels of predictability for consistent low-latency response times to meet the needs of time-sensitive workloads. MRG Realtime also provides new levels of determinism by optimizing lengthy kernel code paths to ensure that they do not become bottlenecks. This allows for better prioritization of applications,resulting in consistent, predictable response times for high-priority applications. * An out-of-bounds write flaw was found in the way the Apple Magic Mouse/Trackpad multi-touch driver handled Human Interface Device (HID) reports with an invalid size. An attacker with physical access to the system could use this flaw to crash the system or, potentially, escalate their privileges on the system. (CVE-2014-3181, Moderate) * A memory corruption flaw was found in the way the USB ConnectTech WhiteHEAT serial driver processed completion commands sent via USB Request Blocks buffers. An attacker with physical access to the system could use this flaw to crash the system or, potentially, escalate their privileges on the system. (CVE-2014-3185, Moderate) * A race condition flaw was found in the way the Linux kernel's mmap(2), madvise(2), and fallocate(2) system calls interacted with each other while operating on virtual memory file system files. A local user could use this flaw to cause a denial of service. (CVE-2014-4171, Moderate) * A stack overflow flaw caused by infinite recursion was found in the way the Linux kernel's Universal Disk Format (UDF) file system implementation processed indirect Information Control Blocks (ICBs). An attacker with physical access to the system could use a specially crafted UDF image to crash the system. (CVE-2014-6410, Low) * An out-of-bounds read flaw was found in the way the Logitech Unifying receiver driver handled HID reports with an invalid device_index value. An attacker with physical access to the system could use this flaw to crash the system or, potentially, escalate their privileges on the system. (CVE-2014-3182, Low) * Multiple out-of-bounds write flaws were found in the way the Cherry Cymotion keyboard driver, KYE/Genius device drivers, Logitech device drivers, Monterey Genius KB29E keyboard driver, Petalynx Maxter remote control driver, and Sunplus wireless desktop driver handled HID reports with an invalid report descriptor size. An attacker with physical access to thesystem could use either of these flaws to write data past an allocated memory buffer. (CVE-2014-3184, Low) * It was found that the parse_rock_ridge_inode_internal() function of the Linux kernel's ISOFS implementation did not correctly check relocated directories when processing Rock Ridge child link (CL) tags. An attacker with physical access to the system could use a specially crafted ISO image to crash the system or, potentially, escalate their privileges on the system. (CVE-2014-5471, CVE-2014-5472, Low) This update also adds the following enhancement: * The Solarflare SFC9120 10GBE Ethernet NICs were not supported by the MRG Realtime kernel. With this update, the drivers have been updated to enable the Solarflare SFC9120 cards on the Realtime kernel. (BZ#1086945) All Red Hat Enterprise MRG Realtime users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add this enhancement. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1111180 - CVE-2014-4171 Kernel: mm/shmem: denial of service 1134099 - CVE-2014-5471 CVE-2014-5472 kernel: isofs: unbound recursion when processing relocated directories 1141173 - CVE-2014-3181 Kernel: HID: OOB write in magicmouse driver 1141210 - CVE-2014-3182 Kernel: HID: logitech-dj OOB array access 1141391 - CVE-2014-3184 Kernel: HID: off by one error in various _report_fixup routines 1141400 - CVE-2014-3185 Kernel: USB serial: memory corruption flaw 1141809 - CVE-2014-6410 kernel: udf: Avoid infinite loop when processing indirect ICBs 6. Package List: MRG Realtime for RHEL 6 Serverv.2: Source: kernel-rt-3.10.33-rt32.51.el6rt.src.rpm noarch: kernel-rt-doc-3.10.33-rt32.51.el6rt.noarch.rpm kernel-rt-firmware-3.10.33-rt32.51.el6rt.noarch.rpm x86_64: kernel-rt-3.10.33-rt32.51.el6rt.x86_64.rpm kernel-rt-debug-3.10.33-rt32.51.el6rt.x86_64.rpm kernel-rt-debug-debuginfo-3.10.33-rt32.51.el6rt.x86_64.rpm kernel-rt-debug-devel-3.10.33-rt32.51.el6rt.x86_64.rpm kernel-rt-debuginfo-3.10.33-rt32.51.el6rt.x86_64.rpm kernel-rt-debuginfo-common-x86_64-3.10.33-rt32.51.el6rt.x86_64.rpm kernel-rt-devel-3.10.33-rt32.51.el6rt.x86_64.rpm kernel-rt-trace-3.10.33-rt32.51.el6rt.x86_64.rpm kernel-rt-trace-debuginfo-3.10.33-rt32.51.el6rt.x86_64.rpm kernel-rt-trace-devel-3.10.33-rt32.51.el6rt.x86_64.rpm kernel-rt-vanilla-3.10.33-rt32.51.el6rt.x86_64.rpm kernel-rt-vanilla-debuginfo-3.10.33-rt32.51.el6rt.x86_64.rpm kernel-rt-vanilla-devel-3.10.33-rt32.51.el6rt.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://access.redhat.com/security/cve/CVE-2014-3181 https://access.redhat.com/security/cve/CVE-2014-3182 https://access.redhat.com/security/cve/CVE-2014-3184 https://access.redhat.com/security/cve/CVE-2014-3185 https://access.redhat.com/security/cve/CVE-2014-4171 https://access.redhat.com/security/cve/CVE-2014-5471 https://access.redhat.com/security/cve/CVE-2014-5472 https://access.redhat.com/security/cve/CVE-2014-6410 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFUKcEJXlSAg2UNWIIRAt5xAKDE6HYbCtRHan8geA0ycw2QadWrVACgqd86 QNVgU/7HTm5SvQhg6hhGtB8=ggHn -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list
Sep 29, 2014
Red Hat
98
security advisorymoderatedenial of serviceRed Hat: RHSA-2013-0561-01 moderate: MRG Messaging Security Issues
Updated Messaging component packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise MRG 2.3 for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat Enterprise MRG Messaging 2.3 security update Advisory ID: RHSA-2013:0561-01 Product: Red Hat Enterprise MRG for RHEL-5 Advisory URL: https://access.redhat.com/errata/RHSA-2013:0561.html Issue date: 2013-03-06 CVE Names: CVE-2012-4446 CVE-2012-4458 CVE-2012-4459 ==================================================================== 1. Summary: Updated Messaging component packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise MRG 2.3 for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: MRG Grid Execute Node for RHEL 5 Server v.2 - noarch MRG Grid for RHEL 5 Server v.2 - noarch MRG Management for RHEL 5 Server v.2 - noarch Red Hat MRG Messaging for RHEL 5 Server v.2 - i386, noarch, x86_64 3. Description: Red Hat Enterprise MRG (Messaging, Realtime, and Grid) is a next-generation IT infrastructure for enterprise computing. MRG offers increased performance, reliability, interoperability, and faster computing for enterprise customers. MRG Messaging is a high-speed reliable messaging distribution for Linux based on AMQP (Advanced Message Queuing Protocol), an open protocol standard for enterprise messaging that is designed to make mission critical messagingwidely available as a standard service, and to make enterprise messaging interoperable across platforms, programming languages, and vendors. MRG Messaging includes an AMQP 0-10 messaging broker; AMQP 0-10 client libraries for C++, Java JMS, and Python; as well as persistence libraries and management tools. It was found that the Apache Qpid daemon (qpidd) treated AMQP connections with the federation_tag attribute set as a broker-to-broker connection, rather than a client-to-server connection. This resulted in the source user ID of messages not being checked. A client that can establish an AMQP connection with the broker could use this flaw to bypass intended authentication. For Condor users, if condor-aviary is installed, this flaw could be used to submit jobs that would run as any user (except root, as Condor does not run jobs as root). (CVE-2012-4446) It was found that the AMQP type decoder in qpidd allowed arbitrary data types in certain messages. A remote attacker could use this flaw to send a message containing an excessively large amount of data, causing qpidd to allocate a large amount of memory. qpidd would then be killed by the Out of Memory killer (denial of service). (CVE-2012-4458) An integer overflow flaw, leading to an out-of-bounds read, was found in the Qpid qpid::framing::Buffer::checkAvailable() function. An unauthenticated, remote attacker could send a specially-crafted message to Qpid, causing it to crash. (CVE-2012-4459) The CVE-2012-4446, CVE-2012-4458, and CVE-2012-4459 issues were discovered by Florian Weimer of the Red Hat Product Security Team. This update also fixes several bugs and adds enhancements. Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section. All users of the Messaging capabilities of Red Hat Enterprise MRG are advised to upgrade to these updated packages, which resolve these issues, and fix the bugs and add the enhancements noted in the Red Hat Enterprise MRG 2 Technical Notes. After installingthe updated packages, stop the cluster by either running "service qpidd stop" on all nodes, or "qpid-cluster --all-stop" on any one of the cluster nodes. Once stopped, restart the cluster with "service qpidd start" on all nodes for the update to take effect. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 5. Bugs fixed (http://bugzilla.redhat.com/): 678612 - service qpidd stop [failed] - with --log-to-stdout yes 710787 - Client doesn't completely honor reconnect=false Connection option 720714 - Clustered broker exits with invalid-argument error after attempting to create dynamic federation bridge 737685 - Acquired messages are not sent to alternate exchange when queue is deleted and receiver's session closed 740485 - qpid-stat is unable to get info from a remote host 754990 - qpidd broker ring queue limit depth working differently with --default-queue-limit=0 vs. default 773719 - Concurrent queue bind on the same queue results in crash 781496 - Incorrect timestamp returned by query method call 782806 - [RFE] Python qpid client ssl support 783215 - An error shall be raised rather than purge of messages when rerouting to alt-exchange and alt-exchange doesn't exist 784957 - Qpid broker ACL processing produces unexpected results 786555 - qpid-config add queue returns success. 790004 - Cluster URL option does not contain IPv6 addresses by default 800912 - qpid-perftest stucks when iterations> 1 and npubs
Mar 06, 2013
Red Hat
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!