Synopsis

Low: quota security and bug fix update

Type/Severity

Security Advisory: Low

Topic

An updated quota package that fixes one security issue and multiple bugs is
now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Description

The quota package provides system administration tools for monitoring
and limiting user and group disk usage on file systems.

It was discovered that the rpc.rquotad service did not use tcp_wrappers
correctly. Certain hosts access rules defined in "/etc/hosts.allow" and
"/etc/hosts.deny" may not have been honored, possibly allowing remote
attackers to bypass intended access restrictions. (CVE-2012-3417)

This issue was discovered by the Red Hat Security Response Team.

This update also fixes the following bugs:

• Prior to this update, values were not properly transported via the remote
  procedure call (RPC) and interpreted by the client when querying the quota
  usage or limits for network-mounted file systems if the quota values were
  2^32 kilobytes or greater. As a consequence, the client reported mangled
  values. This update modifies the underlying code so that such values are
  correctly interpreted by the client. (BZ#667360)
  
• Prior to this update, warnquota sent messages about exceeded quota limits
  from a valid domain name if the warnquota tool was enabled to send warning
  e-mails and the superuser did not change the default warnquota
  configuration. As a consequence, the recipient could reply to invalid
  addresses. This update modifies the default warnquota configuration to use
  the reserved example.com. domain. Now, warnings about exceeded quota limits
  are sent from the reserved domain that inform the superuser to change to
  the correct value. (BZ#680429)
  
• Previously, quota utilities could not recognize the file system as having
  quotas enabled and refused to operate on it due to incorrect updating of
  /etc/mtab. This update prefers /proc/mounts to get a list of file systems
  with enabled quotas. Now, quota utilities recognize file systems with
  enabled quotas as expected. (BZ#689822)
  
• Prior to this update, the setquota(8) tool on XFS file systems failed
  to set disk limits to values greater than 2^31 kilobytes. This update
  modifies the integer conversion in the setquota(8) tool to use a 64-bit
  variable big enough to store such values. (BZ#831520)
  

All users of quota are advised to upgrade to this updated package, which
contains backported patches to resolve these issues.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 566717 - CVE-2012-3417 quota: incorrect use of tcp_wrappers
• BZ - 667360 - rpc.rquotad can't handle quotas >4TB

CVEs

• CVE-2012-3417

References

• https://access.redhat.com/security/updates/classification/#low

Red Hat Enterprise Linux Server 5

SRPM
quota-3.13-8.el5.src.rpm	SHA-256: 85c1d39dd6a09d92dcf2b0205961c3f53ad58f6dcb7f023196b43833279bd024
x86_64
quota-3.13-8.el5.x86_64.rpm	SHA-256: 5f1cbdb7a87d3b3a583a60a5ad6fbfe83cc5cf20b30312144e48d0bc119df8ae
quota-debuginfo-3.13-8.el5.x86_64.rpm	SHA-256: 768c625ef138e6ce17a1ba076f9e0193e559add35dc0e454d3cdec2f6120b60f
ia64
quota-3.13-8.el5.ia64.rpm	SHA-256: 466acd65dfd202e48bb4c84494fbec14cad0c992fb292a0f9f31db4e47b93ea3
quota-debuginfo-3.13-8.el5.ia64.rpm	SHA-256: 53bf848506df759cd4aee3c93d1b0e128e2447cd3d38cc7eb2d5f4bf08ba30b3
i386
quota-3.13-8.el5.i386.rpm	SHA-256: 648fb4d6a83bfb7969b2043f7a666285bf2c403cd482ab9cb4e3559fd0bfabdc
quota-debuginfo-3.13-8.el5.i386.rpm	SHA-256: 03bd196c680b7ea18f9c8d92fa9f9cad1cfb409d18a1ff91bdbda304475173a3

Red Hat Enterprise Linux Workstation 5

SRPM
quota-3.13-8.el5.src.rpm	SHA-256: 85c1d39dd6a09d92dcf2b0205961c3f53ad58f6dcb7f023196b43833279bd024
x86_64
quota-3.13-8.el5.x86_64.rpm	SHA-256: 5f1cbdb7a87d3b3a583a60a5ad6fbfe83cc5cf20b30312144e48d0bc119df8ae
quota-debuginfo-3.13-8.el5.x86_64.rpm	SHA-256: 768c625ef138e6ce17a1ba076f9e0193e559add35dc0e454d3cdec2f6120b60f
i386
quota-3.13-8.el5.i386.rpm	SHA-256: 648fb4d6a83bfb7969b2043f7a666285bf2c403cd482ab9cb4e3559fd0bfabdc
quota-debuginfo-3.13-8.el5.i386.rpm	SHA-256: 03bd196c680b7ea18f9c8d92fa9f9cad1cfb409d18a1ff91bdbda304475173a3

Red Hat Enterprise Linux Desktop 5

SRPM
quota-3.13-8.el5.src.rpm	SHA-256: 85c1d39dd6a09d92dcf2b0205961c3f53ad58f6dcb7f023196b43833279bd024
x86_64
quota-3.13-8.el5.x86_64.rpm	SHA-256: 5f1cbdb7a87d3b3a583a60a5ad6fbfe83cc5cf20b30312144e48d0bc119df8ae
quota-debuginfo-3.13-8.el5.x86_64.rpm	SHA-256: 768c625ef138e6ce17a1ba076f9e0193e559add35dc0e454d3cdec2f6120b60f
i386
quota-3.13-8.el5.i386.rpm	SHA-256: 648fb4d6a83bfb7969b2043f7a666285bf2c403cd482ab9cb4e3559fd0bfabdc
quota-debuginfo-3.13-8.el5.i386.rpm	SHA-256: 03bd196c680b7ea18f9c8d92fa9f9cad1cfb409d18a1ff91bdbda304475173a3

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
quota-3.13-8.el5.src.rpm	SHA-256: 85c1d39dd6a09d92dcf2b0205961c3f53ad58f6dcb7f023196b43833279bd024
s390x
quota-3.13-8.el5.s390x.rpm	SHA-256: 1d29455846686f22dc413167b65ba6908492902536b3a4d6ff4d862697cd083e
quota-debuginfo-3.13-8.el5.s390x.rpm	SHA-256: e33642c5be23334e739a3dadea8c12e53651db75822df76c8720bed36b127191

Red Hat Enterprise Linux for Power, big endian 5

SRPM
quota-3.13-8.el5.src.rpm	SHA-256: 85c1d39dd6a09d92dcf2b0205961c3f53ad58f6dcb7f023196b43833279bd024
ppc
quota-3.13-8.el5.ppc.rpm	SHA-256: e02364f0dc867d3898bdb3e59bbceb12218b8c996c43e691ef69b0d5ad4c4e41
quota-debuginfo-3.13-8.el5.ppc.rpm	SHA-256: 234db0a734a9842d7a578e97783e8de3a314ea23e530ee4054d8b1d03282c1a7

Red Hat Enterprise Linux Server from RHUI 5

SRPM
quota-3.13-8.el5.src.rpm	SHA-256: 85c1d39dd6a09d92dcf2b0205961c3f53ad58f6dcb7f023196b43833279bd024
x86_64
quota-3.13-8.el5.x86_64.rpm	SHA-256: 5f1cbdb7a87d3b3a583a60a5ad6fbfe83cc5cf20b30312144e48d0bc119df8ae
quota-debuginfo-3.13-8.el5.x86_64.rpm	SHA-256: 768c625ef138e6ce17a1ba076f9e0193e559add35dc0e454d3cdec2f6120b60f
i386
quota-3.13-8.el5.i386.rpm	SHA-256: 648fb4d6a83bfb7969b2043f7a666285bf2c403cd482ab9cb4e3559fd0bfabdc
quota-debuginfo-3.13-8.el5.i386.rpm	SHA-256: 03bd196c680b7ea18f9c8d92fa9f9cad1cfb409d18a1ff91bdbda304475173a3