Updated 2.4 kernel fixes security vulnerabilities and various bugs

Updated kernel packages that fix a remote denial of service vulnerability
in the TCP/IP stack, and a local privilege vulnerability, are now available.

[Updated 28 August 2003]
Added CAN-2003-0187 and CAN-2003-0619 to the list of security issues that
were fixed by this advisory (there are no changes to the packages themselves).

The Linux kernel handles the basic functions of the operating system.

The connection tracking core of Netfilter for Linux 2.4.20, with
CONFIG_IP_NF_CONNTRACK enabled (or the ip_conntrack module loaded), allows
remote attackers to cause a denial of service (resource consumption). This
causes Netfilter to fail to identify connections with an UNCONFIRMED status
and use large timeouts. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2003-0187 to this issue.

A flaw has been found in several hash table implementations in the kernel
networking code. A remote attacker could send packets with carefully
chosen, forged source addresses in such a way as to make every routing
cache entry get hashed into the same hash chain. The result would be that
the kernel would use a disproportionate amount of processor time to deal
with new packets, resulting in a remote denial of service attack. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned
the name CAN-2003-0244 to this issue.

A flaw has been found in the "ioperm" system call, which fails to properly
restrict privileges. This flaw can allow an unprivileged local user to
gain read and write access to I/O ports on the system. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2003-0246 to this issue.

An integer signedness error in the Linux kernel before 2.4.21 allows remote
attackers to cause a denial of service (kernel panic) via a negative size
value within XDR data of an NFSv3 procedure call. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2003-0619 to this issue.

All users should upgrade to these updated packages, which are not
vulnerable to these issues.

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To use Red Hat Network to upgrade the kernel, launch the Red Hat Update
Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system. Note that you need to select the
kernel explicitly if you are using the default configuration of up2date.

To install kernel packages manually, use "rpm -ivh <package>" and
modify system settings to boot the kernel you have installed. To
do this, edit /boot/grub/grub.conf and change the default entry to
"default=0" (or, if you have chosen to use LILO as your boot loader,
edit /etc/lilo.conf and run lilo)

Do not use "rpm -Uvh" as that will remove your running kernel binaries
from your system. You may use "rpm -e" to remove old kernels after
determining that the new kernel functions properly on your system.

81282 - No pcmcia devices found (HP OmniBook XT6050) after upgrade.
86180 - orinoco_cs periodically drops connection with linksys wpc11v3
88047 - /proc/<pid>/cmdline is empty in RHL8
88550 - Acer 351tev fails loading trident.o module
88847 - Sound card AZT1008 not initialized by ad1848.o
89049 - ALi M5451 doesn't work
89554 - Kernel needs dell inspiron 8500 support
89686 - V.110 doesn't work with HFC_PCI cards.
89732 - Installer hangs when loading aic7xxx module
89743 - usb-uhci Kernel freeze with one-shot interrupt transfers
90276 - Some drivers are missing a copy_from_user() function call

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0187
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0244
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0246
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0619
http://marc.theaimsgroup.com/?l=bk-commits-24&m=105217616607144&w=2
http://bugzilla.kernel.org/show_bug.cgi?id=703

dos