RHSA-2007:0497-01 Moderate: iscsi-initiator-utils security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ---------------------------------------------------------------------
Red Hat Security Advisory

Synopsis: Moderate: iscsi-initiator-utils security update
Advisory ID: RHSA-2007:0497-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0497.html
Issue date: 2007-06-14
Updated on: 2007-06-14
Product: Red Hat Enterprise Linux
Keywords: open-iscsi
CVE Names: CVE-2007-3099 CVE-2007-3100
- ---------------------------------------------------------------------

1. Summary:

Updated iscsi-initiator-utils packages that fix a security flaw in
open-iscsi are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, x86_64

3. Problem description:

The iscsi package provides the server daemon for the iSCSI protocol, as
well as the utility programs used to manage it. iSCSI is a protocol for
distributed disk access using SCSI commands sent over Internet Protocol
networks.

Olaf Kirch discovered two flaws in open-iscsi. A local attacker could use
these flaws to cause the server daemon to stop responding, leading to a
denial of service. (CVE-2007-3099, CVE-2007-3100).

All users of open-iscsi should upgrade to this updated package which
resolves these issues.

Note: This issue did not affect Red Hat Enterprise Linux 2.1, 3, or 4.
open-iscsi is available in Red Hat Enterprise Linux 5 as a Technology
Preview.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

5. Bug IDs fixed (http://bugzilla.redhat.com/):

243719 - CVE-2007-3099 dos flaws in open-iscsi (CVE-2007-3100)

6. RPMs required:

Red Hat Enterprise Linux Desktop (v. 5 client):

SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/iscsi-initiator-utils-6.2.0.742-0.6.el5.src.rpm
1641a3f2f9c7c06b923bd5ae7174aafc iscsi-initiator-utils-6.2.0.742-0.6.el5.src.rpm

i386:
e8241658758493f0ed6b0deb515ff2d4 iscsi-initiator-utils-6.2.0.742-0.6.el5.i386.rpm
b6dae38ce85a004fb6b1c5316472296b iscsi-initiator-utils-debuginfo-6.2.0.742-0.6.el5.i386.rpm

x86_64:
907981526cb8a26b6c2858fa18fb2b69 iscsi-initiator-utils-6.2.0.742-0.6.el5.x86_64.rpm
9f1158d5930b38af251ff3070bee2f4d iscsi-initiator-utils-debuginfo-6.2.0.742-0.6.el5.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/iscsi-initiator-utils-6.2.0.742-0.6.el5.src.rpm
1641a3f2f9c7c06b923bd5ae7174aafc iscsi-initiator-utils-6.2.0.742-0.6.el5.src.rpm

i386:
e8241658758493f0ed6b0deb515ff2d4 iscsi-initiator-utils-6.2.0.742-0.6.el5.i386.rpm
b6dae38ce85a004fb6b1c5316472296b iscsi-initiator-utils-debuginfo-6.2.0.742-0.6.el5.i386.rpm

ia64:
a579261aff181eba655d27527696ad76 iscsi-initiator-utils-6.2.0.742-0.6.el5.ia64.rpm
85e98cd7a8b8139f1dcb3602fc2bf0e3 iscsi-initiator-utils-debuginfo-6.2.0.742-0.6.el5.ia64.rpm

ppc:
87d4404ac8698baa64353da68164500c iscsi-initiator-utils-6.2.0.742-0.6.el5.ppc.rpm
6b949fdac71d03cbf6c59446762c3653 iscsi-initiator-utils-debuginfo-6.2.0.742-0.6.el5.ppc.rpm

x86_64:
907981526cb8a26b6c2858fa18fb2b69 iscsi-initiator-utils-6.2.0.742-0.6.el5.x86_64.rpm
9f1158d5930b38af251ff3070bee2f4d iscsi-initiator-utils-debuginfo-6.2.0.742-0.6.el5.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3099
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3100
http://kbase.redhat.com/faq/FAQ_105_10521.shtm
http://www.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is lt;secalert@redhat.comgt;. More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2007 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD4DBQFGcRaDXlSAg2UNWIIRAjY7AJdhlzRQE8FSWb8ecqr57t79AdVKAKCu9dwH
WZ6BkrIAg356I0uMqs+sdA==
=KbB7
-----END PGP SIGNATURE-----