RHSA-2005:583 - Security Advisory

Topic

Updated dump packages that address two security issues are now available
for Red Hat Enterprise Linux 2.1.

This update has been rated as having low security impact by the Red Hat
Security Response Team.

Description

Dump examines files in a file system, determines which ones need to be
backed up, and copies those files to a specified disk, tape, or other
storage medium.

A flaw was found with dump file locking. A malicious local user could
manipulate the file lock in such a way as to prevent dump from running.
The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned
the name CAN-2002-1914 to this issue.

Users of dump should upgrade to these erratum packages, which contain a
patch to resolve this issue.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

• Red Hat Enterprise Linux Server 2 ia64
• Red Hat Enterprise Linux Server 2 i386
• Red Hat Enterprise Linux Workstation 2 ia64
• Red Hat Enterprise Linux Workstation 2 i386

Fixes

• BZ - 162903 - CAN-2002-1914 dump denial of service

CVEs

• CVE-2002-1914

References

(none)