RHEA-2008:0358 - Product Enhancement Advisory

Topic

Enhanced audit packages that fix a bug are now available.

Description

The audit package contains the user space utilities for storing and
searching the audit records generated by the audit subsystem in the Linux
2.6 kernel.

These updated audit packages add the following enhancements:

• audit has been updated to the newer 1.6.5 version.
• the system-config-audit GUI configuration tool, for easy audit

administration, has been added.

• auditd now supports group permissions on audit logs.
• audit now has a new multi-threaded event dispatcher which supports plugins.
• the "node"/"machine" field can now be added to audit events.
• the RACF zos remote-logging plugin for IBM systems has been added.
• the "week-ago" keyword has been added to aureport and ausearch.
• auditctl now supports errno abbreviations as the syscall exit code ("-F

exit=-EPERM").

• audit logging can now be resumed with SIGUSR2.
• a new utility, aulastlog, has been added.
• TTY audit support has been added.

In addition, these updated audit packages fix a buffer overflow in the
audit_log_user_command() function. Note that this issue was assigned a
Common Vulnerabilities and Exposures number, CVE-2008-1628, by the Mitre
CVE project. However, we are not treating this issue as a security
vulnerability, as it can only result in a controlled application
termination when overflow is detected by the FORTIFY_SOURCE protection
mechanism. Moreover, no application in Red Hat Enterprise Linux 5.1 uses
this vulnerable interface.

Users of audit are advised to upgrade to these updated packages, which add
these enhancements and resolve this issue.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 244349 - TTY audit support
• BZ - 435329 - [RHEL5.2] audit tests cause oom-kills
• BZ - 435947 - system-config-audit does not run
• BZ - 438844 - buffer overflow in audit_log_user_command
• BZ - 442556 - audit rules with >= get corrupted

CVEs

(none)

References

(none)