Issued:
2009-04-22
Updated:
2009-04-22

RHBA-2009:0443 - Bug Fix Advisory

Synopsis

audit bugfix update

Type/Severity

Bug Fix Advisory

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

Updated audit packages that resolve several issues are now available.

Description

The audit packages contain user-space utilities for storing and searching
the audit records generated by the audit subsystem in the Linux 2.6 kernel.

These updated packages fix the following bugs in the auditd daemon and one
of its utilities:

  • when the log_format parameter was set to "NOLOG" in the auditd.conf

configuration file, audit events which were queued in the internal message
queue were not cleared after being written to dispatchers. This caused the
internal message queue to grow over time, causing an auditd memory leak.
With these updated packages the audit events in the internal message queue
are properly cleared after being written, thus plugging the memory leak.

  • certain audit rules failed parser checks even though they were specified

correctly, which prevented those rules from being loaded into the kernel.
With this update, all correctly-specified audit rules pass parser checks
and can be loaded into the kernel, thus resolving the problem.

All users of audit are advised to upgrade to these updated packages, which
resolve these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

  • Red Hat Enterprise Linux Server 5 x86_64
  • Red Hat Enterprise Linux Server 5 ia64
  • Red Hat Enterprise Linux Server 5 i386
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.3 x86_64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.3 ia64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.3 i386
  • Red Hat Enterprise Linux Workstation 5 x86_64
  • Red Hat Enterprise Linux Workstation 5 i386
  • Red Hat Enterprise Linux Desktop 5 i386
  • Red Hat Enterprise Linux for IBM z Systems 5 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.3 s390x
  • Red Hat Enterprise Linux for Power, big endian 5 ppc
  • Red Hat Enterprise Linux Server from RHUI 5 x86_64
  • Red Hat Enterprise Linux Server from RHUI 5 i386
  • Red Hat Enterprise Linux Server - AUS 5.3 x86_64
  • Red Hat Enterprise Linux Server - AUS 5.3 ia64
  • Red Hat Enterprise Linux Server - AUS 5.3 i386
  • Red Hat Enterprise Linux Desktop 5 x86_64
  • Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.3 ppc

Fixes

  • BZ - 494924 - auditd memory leak when using NOLOG format option
  • BZ - 495711 - Some audit rules will not load even though they are correct

CVEs

(none)

References

(none)

Red Hat Enterprise Linux Server 5

SRPM
audit-1.7.7-6.el5_3.2.src.rpm SHA-256: d4e4b0f56279e4ef161aef0821644d28aa08a22bd91d6d9f0a31fa40a297ab3c
x86_64
audispd-plugins-1.7.7-6.el5_3.2.x86_64.rpm SHA-256: aab1660b34a6f8b5ee8eda1385d6aca512581e1dd41c52148e43251a563645df
audit-1.7.7-6.el5_3.2.x86_64.rpm SHA-256: bf250705cb139d487d40d4f488848c8661058486b24c612c14d786a0659c4c31
audit-libs-1.7.7-6.el5_3.2.i386.rpm SHA-256: 0902ab18d02855fb7edba699b7e2291e4e5a23a47b74bbb92e20510265a4a913
audit-libs-1.7.7-6.el5_3.2.x86_64.rpm SHA-256: 043ee33720bb37b485987ea89eac2e1c4b1065f957c0bb05752e1b494872879d
audit-libs-devel-1.7.7-6.el5_3.2.i386.rpm SHA-256: b2292ff42c33ca24e1d01bfa986c992cfeb888e46bb1f704be8adf85fa52d4c6
audit-libs-devel-1.7.7-6.el5_3.2.x86_64.rpm SHA-256: 99e21b305c6b3159230bb59eec0d37c766c752304229310fa1e724868c794d87
audit-libs-python-1.7.7-6.el5_3.2.x86_64.rpm SHA-256: d5519847304706e897435f340dbe5ee025703e88c755f829c7b7adb973b06121
system-config-audit-0.4.8-7.el5_3.1.x86_64.rpm SHA-256: ff1e1ec189dc90bb67b684dcdcb823732d7989b78299969dbd6e71d548f03c17
ia64
audispd-plugins-1.7.7-6.el5_3.2.ia64.rpm SHA-256: 0958713a4df18c606ded90adfb1241ac181592c681888f1d7fcdba972acbc98e
audit-1.7.7-6.el5_3.2.ia64.rpm SHA-256: a55371e61e30eed3ccec873ce43fb2a867ef98079b30112d34a1004cc0bddcc0
audit-libs-1.7.7-6.el5_3.2.i386.rpm SHA-256: 0902ab18d02855fb7edba699b7e2291e4e5a23a47b74bbb92e20510265a4a913
audit-libs-1.7.7-6.el5_3.2.ia64.rpm SHA-256: fc70e7b291f88fde22ba21edc34383c23e5187d720048945b59daacf3ffbfcdb
audit-libs-devel-1.7.7-6.el5_3.2.ia64.rpm SHA-256: 9d1ff525dfc5b9c2fcb2547cc4c0729e76b2e9f215561bbc7c161b9606a30b3c
audit-libs-python-1.7.7-6.el5_3.2.ia64.rpm SHA-256: c756a49c0629d584422a49287693de107e4b1c99b9d57619516986ebf3880c2b
system-config-audit-0.4.8-7.el5_3.1.ia64.rpm SHA-256: 0e65ac840bd664b264d27aee80e1e9e8d2ba0f1fa20a7a427bcd6f830bc73da5
i386
audispd-plugins-1.7.7-6.el5_3.2.i386.rpm SHA-256: 8eb8b6038cc3e74ff27e7d1fb879da67016f12ccd43d1d9bc151388c55a3e4b7
audit-1.7.7-6.el5_3.2.i386.rpm SHA-256: 7bd5888f3b7cb0c68c0a33a3833c5d08249665444c6770b766f68b4e3bdd42b9
audit-libs-1.7.7-6.el5_3.2.i386.rpm SHA-256: 0902ab18d02855fb7edba699b7e2291e4e5a23a47b74bbb92e20510265a4a913
audit-libs-devel-1.7.7-6.el5_3.2.i386.rpm SHA-256: b2292ff42c33ca24e1d01bfa986c992cfeb888e46bb1f704be8adf85fa52d4c6
audit-libs-python-1.7.7-6.el5_3.2.i386.rpm SHA-256: 913e34c6403e71b24e68e1aa8dd24d5bdaf3c037797c87f887e7327424f13d88
system-config-audit-0.4.8-7.el5_3.1.i386.rpm SHA-256: a8177a2ef125f1373d7960a760e0d61c36e340db76541fe0ba8d2cbfe2d6485f

Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.3

SRPM
x86_64
ia64
i386

Red Hat Enterprise Linux Server - AUS 5.3

SRPM
ia64
i386
x86_64

Red Hat Enterprise Linux Workstation 5

SRPM
audit-1.7.7-6.el5_3.2.src.rpm SHA-256: d4e4b0f56279e4ef161aef0821644d28aa08a22bd91d6d9f0a31fa40a297ab3c
x86_64
audispd-plugins-1.7.7-6.el5_3.2.x86_64.rpm SHA-256: aab1660b34a6f8b5ee8eda1385d6aca512581e1dd41c52148e43251a563645df
audit-1.7.7-6.el5_3.2.x86_64.rpm SHA-256: bf250705cb139d487d40d4f488848c8661058486b24c612c14d786a0659c4c31
audit-libs-1.7.7-6.el5_3.2.i386.rpm SHA-256: 0902ab18d02855fb7edba699b7e2291e4e5a23a47b74bbb92e20510265a4a913
audit-libs-1.7.7-6.el5_3.2.x86_64.rpm SHA-256: 043ee33720bb37b485987ea89eac2e1c4b1065f957c0bb05752e1b494872879d
audit-libs-devel-1.7.7-6.el5_3.2.i386.rpm SHA-256: b2292ff42c33ca24e1d01bfa986c992cfeb888e46bb1f704be8adf85fa52d4c6
audit-libs-devel-1.7.7-6.el5_3.2.x86_64.rpm SHA-256: 99e21b305c6b3159230bb59eec0d37c766c752304229310fa1e724868c794d87
audit-libs-python-1.7.7-6.el5_3.2.x86_64.rpm SHA-256: d5519847304706e897435f340dbe5ee025703e88c755f829c7b7adb973b06121
system-config-audit-0.4.8-7.el5_3.1.x86_64.rpm SHA-256: ff1e1ec189dc90bb67b684dcdcb823732d7989b78299969dbd6e71d548f03c17
i386
audispd-plugins-1.7.7-6.el5_3.2.i386.rpm SHA-256: 8eb8b6038cc3e74ff27e7d1fb879da67016f12ccd43d1d9bc151388c55a3e4b7
audit-1.7.7-6.el5_3.2.i386.rpm SHA-256: 7bd5888f3b7cb0c68c0a33a3833c5d08249665444c6770b766f68b4e3bdd42b9
audit-libs-1.7.7-6.el5_3.2.i386.rpm SHA-256: 0902ab18d02855fb7edba699b7e2291e4e5a23a47b74bbb92e20510265a4a913
audit-libs-devel-1.7.7-6.el5_3.2.i386.rpm SHA-256: b2292ff42c33ca24e1d01bfa986c992cfeb888e46bb1f704be8adf85fa52d4c6
audit-libs-python-1.7.7-6.el5_3.2.i386.rpm SHA-256: 913e34c6403e71b24e68e1aa8dd24d5bdaf3c037797c87f887e7327424f13d88
system-config-audit-0.4.8-7.el5_3.1.i386.rpm SHA-256: a8177a2ef125f1373d7960a760e0d61c36e340db76541fe0ba8d2cbfe2d6485f

Red Hat Enterprise Linux Desktop 5

SRPM
audit-1.7.7-6.el5_3.2.src.rpm SHA-256: d4e4b0f56279e4ef161aef0821644d28aa08a22bd91d6d9f0a31fa40a297ab3c
x86_64
audispd-plugins-1.7.7-6.el5_3.2.x86_64.rpm SHA-256: aab1660b34a6f8b5ee8eda1385d6aca512581e1dd41c52148e43251a563645df
audit-1.7.7-6.el5_3.2.x86_64.rpm SHA-256: bf250705cb139d487d40d4f488848c8661058486b24c612c14d786a0659c4c31
audit-libs-1.7.7-6.el5_3.2.i386.rpm SHA-256: 0902ab18d02855fb7edba699b7e2291e4e5a23a47b74bbb92e20510265a4a913
audit-libs-1.7.7-6.el5_3.2.x86_64.rpm SHA-256: 043ee33720bb37b485987ea89eac2e1c4b1065f957c0bb05752e1b494872879d
audit-libs-python-1.7.7-6.el5_3.2.x86_64.rpm SHA-256: d5519847304706e897435f340dbe5ee025703e88c755f829c7b7adb973b06121
system-config-audit-0.4.8-7.el5_3.1.x86_64.rpm SHA-256: ff1e1ec189dc90bb67b684dcdcb823732d7989b78299969dbd6e71d548f03c17
i386
audispd-plugins-1.7.7-6.el5_3.2.i386.rpm SHA-256: 8eb8b6038cc3e74ff27e7d1fb879da67016f12ccd43d1d9bc151388c55a3e4b7
audit-1.7.7-6.el5_3.2.i386.rpm SHA-256: 7bd5888f3b7cb0c68c0a33a3833c5d08249665444c6770b766f68b4e3bdd42b9
audit-libs-1.7.7-6.el5_3.2.i386.rpm SHA-256: 0902ab18d02855fb7edba699b7e2291e4e5a23a47b74bbb92e20510265a4a913
audit-libs-python-1.7.7-6.el5_3.2.i386.rpm SHA-256: 913e34c6403e71b24e68e1aa8dd24d5bdaf3c037797c87f887e7327424f13d88
system-config-audit-0.4.8-7.el5_3.1.i386.rpm SHA-256: a8177a2ef125f1373d7960a760e0d61c36e340db76541fe0ba8d2cbfe2d6485f

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
audit-1.7.7-6.el5_3.2.src.rpm SHA-256: d4e4b0f56279e4ef161aef0821644d28aa08a22bd91d6d9f0a31fa40a297ab3c
s390x
audispd-plugins-1.7.7-6.el5_3.2.s390x.rpm SHA-256: 8935dd26c1199729754fda395fca699c907b5034674f555119e6ee7ed226771f
audit-1.7.7-6.el5_3.2.s390x.rpm SHA-256: f7ffe77627615f9ab11d611fe49ddff81735dd4887f5c8fd807dae28986782cd
audit-libs-1.7.7-6.el5_3.2.s390.rpm SHA-256: 83f6ccf06bab6b3066d961391cb7b9d977beb0f90a6614149538d3635ac9b297
audit-libs-1.7.7-6.el5_3.2.s390x.rpm SHA-256: 691af7d65c2b3f05157571d8e80edbe0f32368d247c69d580edb6c2a9510fd62
audit-libs-devel-1.7.7-6.el5_3.2.s390.rpm SHA-256: c72eb4dbed9f40ba29d720b5af0eab8730fde697f5193b37d2683d341239fa3b
audit-libs-devel-1.7.7-6.el5_3.2.s390x.rpm SHA-256: 02d5cb56e68e6698b75859dc8152a1c671a59caaabe86c220bfd91edf3b8e68b
audit-libs-python-1.7.7-6.el5_3.2.s390x.rpm SHA-256: 0c68d6dd80f65ba16d4e692ac80cbe67d60144059025ef16b732a944b797ae5c
system-config-audit-0.4.8-7.el5_3.1.s390x.rpm SHA-256: bbd9e842896f3b534bdd7e01fd8d6a2bfd8d818237f6af61eab05a4fd6a4e7af

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.3

SRPM
s390x

Red Hat Enterprise Linux for Power, big endian 5

SRPM
audit-1.7.7-6.el5_3.2.src.rpm SHA-256: d4e4b0f56279e4ef161aef0821644d28aa08a22bd91d6d9f0a31fa40a297ab3c
ppc
audispd-plugins-1.7.7-6.el5_3.2.ppc.rpm SHA-256: 16da683aa4f7e9ed1feaf18439b6d9d3c766e5ad8a558d5d99ea10b6ae3ddab8
audit-1.7.7-6.el5_3.2.ppc.rpm SHA-256: b9ab2846e100f73634bd16860e903bef16aba9b22459348387554543deeb7969
audit-libs-1.7.7-6.el5_3.2.ppc.rpm SHA-256: db81fd2da06d7f60741194654d3720b6dbc829c97af2944364d751fc5a9ec94d
audit-libs-1.7.7-6.el5_3.2.ppc64.rpm SHA-256: 538c60551d71ce579b8365b94ab61cd9f26ca4336a8800d0bff15b88c95ed040
audit-libs-devel-1.7.7-6.el5_3.2.ppc.rpm SHA-256: 8bdb7005c77e10c2f87ebc4d3ac17ce3fcdfef630ad945dbfa827cf9b0ebb5b7
audit-libs-devel-1.7.7-6.el5_3.2.ppc64.rpm SHA-256: bf496cb6e96f00250169c59f5c910ea10de773c61a39b753b53d3e61edea27cf
audit-libs-python-1.7.7-6.el5_3.2.ppc.rpm SHA-256: 38c0f9d778931d97871930254ab2b270bdd8d7eb948e4be33bd51e74e04a1e83
system-config-audit-0.4.8-7.el5_3.1.ppc.rpm SHA-256: bcd71dc41fcbc33e512850345ef8e9de63ef4eb3ce71e14ab038f45bd00b5fed

Red Hat Enterprise Linux Server from RHUI 5

SRPM
audit-1.7.7-6.el5_3.2.src.rpm SHA-256: d4e4b0f56279e4ef161aef0821644d28aa08a22bd91d6d9f0a31fa40a297ab3c
x86_64
audispd-plugins-1.7.7-6.el5_3.2.x86_64.rpm SHA-256: aab1660b34a6f8b5ee8eda1385d6aca512581e1dd41c52148e43251a563645df
audit-1.7.7-6.el5_3.2.x86_64.rpm SHA-256: bf250705cb139d487d40d4f488848c8661058486b24c612c14d786a0659c4c31
audit-libs-1.7.7-6.el5_3.2.i386.rpm SHA-256: 0902ab18d02855fb7edba699b7e2291e4e5a23a47b74bbb92e20510265a4a913
audit-libs-1.7.7-6.el5_3.2.x86_64.rpm SHA-256: 043ee33720bb37b485987ea89eac2e1c4b1065f957c0bb05752e1b494872879d
audit-libs-devel-1.7.7-6.el5_3.2.i386.rpm SHA-256: b2292ff42c33ca24e1d01bfa986c992cfeb888e46bb1f704be8adf85fa52d4c6
audit-libs-devel-1.7.7-6.el5_3.2.x86_64.rpm SHA-256: 99e21b305c6b3159230bb59eec0d37c766c752304229310fa1e724868c794d87
audit-libs-python-1.7.7-6.el5_3.2.x86_64.rpm SHA-256: d5519847304706e897435f340dbe5ee025703e88c755f829c7b7adb973b06121
system-config-audit-0.4.8-7.el5_3.1.x86_64.rpm SHA-256: ff1e1ec189dc90bb67b684dcdcb823732d7989b78299969dbd6e71d548f03c17
i386
audispd-plugins-1.7.7-6.el5_3.2.i386.rpm SHA-256: 8eb8b6038cc3e74ff27e7d1fb879da67016f12ccd43d1d9bc151388c55a3e4b7
audit-1.7.7-6.el5_3.2.i386.rpm SHA-256: 7bd5888f3b7cb0c68c0a33a3833c5d08249665444c6770b766f68b4e3bdd42b9
audit-libs-1.7.7-6.el5_3.2.i386.rpm SHA-256: 0902ab18d02855fb7edba699b7e2291e4e5a23a47b74bbb92e20510265a4a913
audit-libs-devel-1.7.7-6.el5_3.2.i386.rpm SHA-256: b2292ff42c33ca24e1d01bfa986c992cfeb888e46bb1f704be8adf85fa52d4c6
audit-libs-python-1.7.7-6.el5_3.2.i386.rpm SHA-256: 913e34c6403e71b24e68e1aa8dd24d5bdaf3c037797c87f887e7327424f13d88
system-config-audit-0.4.8-7.el5_3.1.i386.rpm SHA-256: a8177a2ef125f1373d7960a760e0d61c36e340db76541fe0ba8d2cbfe2d6485f

Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.3

SRPM
ppc

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.