RHBA-2010:0080 - Bug Fix Advisory

Topic

Updated audit packages that fix two bugs are now available.

Description

The audit packages contain user-space utilities for storing and searching
the audit records generated by the audit subsystem in the Linux 2.6 kernel.

These updated audit packages fix the following bugs:

• audit rules that filtered on auid or uid 4294967295 did not work

correctly due to a signed integer conversion. With this update, the string
in question is now converted to an unsigned long int, allowing rules
filtering as above to work as expected. Note: this bug only presented on
32-bit systems. (BZ#557032)

• audit rules that filtered on on a large inode number, such as one

returned by "ls -i /proc/cpuinfo", did not work correctly due to a signed
integer conversion. With this update, the string in question is now
converted to an unsigned long int, allowing rules filtering on large inode
numbers to work as expected. Note: this bug only presented on 32-bit
systems. (BZ#557035)

All audit users should upgrade to these updated audit packages, which
resolve these issues.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 4.8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 4.8 ia64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 4.8 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.8 ppc

Fixes

• BZ - 557032 - Problem with filtering based on auid
• BZ - 557035 - audit does not work for filtering a large inode number on i386

CVEs

(none)

References

(none)