[RHSA-2012:0312-03] Low: initscripts security and bug fix update

[news 28]

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

 

=====================================================================

Red Hat Security Advisory

 

Synopsis: Low: initscripts security and bug fix update

Advisory ID: RHSA-2012:0312-03

Product: Red Hat Enterprise Linux

Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-0312.html

Issue date: 2012-02-21

CVE Names: CVE-2008-1198

=====================================================================

 

1. Summary:

 

An updated initscripts package that fixes one security issue and four bugs

is now available for Red Hat Enterprise Linux 5.

 

The Red Hat Security Response Team has rated this update as having low

security impact. A Common Vulnerability Scoring System (CVSS) base score,

which gives a detailed severity rating, is available from the CVE link in

the References section.

 

2. Relevant releases/architectures:

 

Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64

Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64

 

3. Description:

 

The initscripts package contains system scripts to boot your system, change

runlevels, activate and deactivate most network interfaces, and shut the

system down cleanly.

 

With the default IPsec (Internet Protocol Security) ifup script

configuration, the racoon IKE key management daemon used aggressive IKE

mode instead of main IKE mode. This resulted in the preshared key (PSK)

hash being sent unencrypted, which could make it easier for an attacker

able to sniff network traffic to obtain the plain text PSK from a

transmitted hash. (CVE-2008-1198)

 

Red Hat would like to thank Aleksander Adamowski for reporting this issue.

 

This update also fixes the following bugs:

 

* Prior to this update, the DHCPv6 client was not terminated when the

network service was stopped. This update modifies the source so that the

client is now terminated when stopping the network service. (BZ#568896)

 

* Prior to this update, on some systems the rm command failed and reported

the error message "rm: cannot remove directory `/var/run/dovecot/login/':

Is a directory" during system boot. This update modifies the source so that

this error message no longer appears. (BZ#679998)

 

* Prior to this update, the netconsole script could not discover and

resolve the MAC address of the router specified in the

/etc/sysconfig/netconsole file. This update modifies the netconsole script

so that the script no longer fails when the arping tool returns the MAC

address of the router more than once. (BZ#744734)

 

* Prior to this update, the arp_ip_target was, due to a logic error, not

correctly removed via sysfs. As a consequence, the error "ifdown-eth: line

64: echo: write error: Invalid argument" was reported when attempting to

shut down a bonding device. This update modifies the script so that the

error no longer appears and arp_ip_target is now correctly removed.

(BZ#745681)

 

All users of initscripts are advised to upgrade to this updated package,

which fixes these issues.

 

4. Solution:

 

Before applying this update, make sure all previously-released errata

relevant to your system have been applied.

 

This update is available via the Red Hat Network. Details on how to

use the Red Hat Network to apply this update are available at

https://access.redhat.com/kb/docs/DOC-11259

 

5. Bugs fixed (http://bugzilla.redhat.com/):

 

435274 - CVE-2008-1198 IPSec ifup script allows for aggressive IKE mode

679998 - [REG][5.6] rm command reports an error message during system booting.

 

6. Package List:

 

Red Hat Enterprise Linux Desktop (v. 5 client):

 

Source:

ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/initscripts-8.45.42-1.el5.src.rpm

 

i386:

initscripts-8.45.42-1.el5.i386.rpm

initscripts-debuginfo-8.45.42-1.el5.i386.rpm

 

x86_64:

initscripts-8.45.42-1.el5.x86_64.rpm

initscripts-debuginfo-8.45.42-1.el5.x86_64.rpm

 

Red Hat Enterprise Linux (v. 5 server):

 

Source:

ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/initscripts-8.45.42-1.el5.src.rpm

 

i386:

initscripts-8.45.42-1.el5.i386.rpm

initscripts-debuginfo-8.45.42-1.el5.i386.rpm

 

ia64:

initscripts-8.45.42-1.el5.ia64.rpm

initscripts-debuginfo-8.45.42-1.el5.ia64.rpm

 

ppc:

initscripts-8.45.42-1.el5.ppc.rpm

initscripts-debuginfo-8.45.42-1.el5.ppc.rpm

 

s390x:

initscripts-8.45.42-1.el5.s390x.rpm

initscripts-debuginfo-8.45.42-1.el5.s390x.rpm

 

x86_64:

initscripts-8.45.42-1.el5.x86_64.rpm

initscripts-debuginfo-8.45.42-1.el5.x86_64.rpm

 

These packages are GPG signed by Red Hat for security. Our key and

details on how to verify the signature are available from

https://access.redhat.com/security/team/key/#package

 

7. References:

 

https://www.redhat.com/security/data/cve/CVE-2008-1198.html

https://access.redhat.com/security/updates/classification/#low

 

8. Contact:

 

The Red Hat security contact is . More contact

details at https://access.redhat.com/security/team/contact/

 

Copyright 2012 Red Hat, Inc.

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.4 (GNU/Linux)

 

iD8DBQFPQyEwXlSAg2UNWIIRAhCUAKC16dMn6pWFawh9Ztfbw+oRsH6ksgCfT7Lk

0EPwOwihTvQZOVIpYMuEKcY=

=TejP

-----END PGP SIGNATURE-----

 

 

--