RHBA-2008:0340 - Bug Fix Advisory

Topic

Updated system-config-securitylevel packages that fix several bugs and add
an enchancement are now available.

Description

system-config-securitylevel is a graphical program for configuring firewall
and SELinux settings.

These updated packages address the following bugs:

• the Gujarati (gu_IN) translation of the Firewall pop-up menu in the

Firewall Options tab contained a typo. A numeric '3' pre-pended the Enabled
or Active menu item. This has been corrected.

• system-config-securitylevel generated a default ipv6 iptables rule-set

which allowed TCP connections to higher ports (32768 - 61000). This updated
package corrects this such that newly created default ipv6 iptables
rule-sets do not allow TCP connections via these ports.

Note: installing this update will not, of itself, generate a corrected ipv6
iptables rule-set. Nor will running the updated system-config-securitylevel
application and clicking the Apply and Update buttons without making
specific changes. To correct existing rule-sets run the following as root:
"lokkit -q".

• if the firewall or SELinux configuration was mis-configured using another

tool (eg system-config-securitylevel-tui), and system-config-securitylevel
was subsequently launched and used to configure a firewall setting, the
tool did not alert the user that the firewall settings could not be
written. With this updated package, system-config-securitylevel presents a
"Configuration failed" alert in such instances.

• the Add Port dialogue box was set to appear as close to the top-left

corner of the screen as was practical. In some circumstances, on
multi-screen setups, this could cause this dialogue box to appear on
another screen. In this updated package the Add Port dialogue box is set to
appear centered above the system-config-securitylevel window.

• system-config-securitylevel did not check that port numbers added via the

Add Port dialogue box were below 65535. This made it possible to write a
non-existent port number to iptables, breaking the configuration. With this
updated package, entering a port numbers above 65535 in the Add Port
dialogue box and clicking OK causes an 'Invalid port' alert to present.

This update also adds the following enhancement:

• the main system-config-securitylevel window provided no tool for

re-sizing the "Trusted services" list. These updated packages add a re-size
handle below the "Trusted services" list.

All users are advised to upgrade to these updated packages, which resolve
these issues.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 232931 - Autogenerated ip6tables ruleset is insecure, allowing incoming TCP connections to higher ports
• BZ - 243743 - Complain on configuration error.
• BZ - 243744 - Place add port dialog centered on gui.
• BZ - 243745 - Trusted services list is not expanding.
• BZ - 247608 - system-config-securitylevel doesn't check the port number

CVEs

(none)

References

(none)