-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2008-3012 2008-04-08 23:47:42 --------------------------------------------------------------------------------
Name : audit Product : Fedora 8 Version : 1.6.8 Release : 4.fc8 URL : http://people.redhat.com/sgrubb/audit/ Summary : User space tools for 2.6 kernel auditing Description : The audit package contains the user space utilities for storing and searching the audit records generate by the audit subsystem in the Linux 2.6 kernel. -------------------------------------------------------------------------------- Update Information: This release fixes the init script headers to not provide LSB info. This was causing audit to start too late. It also fixes a problem where saddr fields were not being decoded correctly on avc events in ausearch. This also fixes a buffer overflow in audit_log_user_command that is caught by FORTIFY_SOURCE, resulting in an application crash. sudo is the only application known to use this vulnerable function. -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 2 2008 Steve Grubb <[EMAIL PROTECTED]> 1.6.8-4 - Fix overflow in audit_log_user_command bz 438840 - Remove LSB headers from init scripts - Fix ausearch to not escape saddr in avcs * Fri Mar 14 2008 Steve Grubb <[EMAIL PROTECTED]> 1.6.8-3 - Better fix for memleak in audit event dispatcher * Sun Mar 2 2008 Steve Grubb <[EMAIL PROTECTED]> 1.6.8-2 - Fix memleak in audit event dispatcher * Fri Feb 15 2008 Steve Grubb <[EMAIL PROTECTED]> 1.6.8-1 - New upstream version - Cleanup descriptors in audispd before running plugin - Fix 'recent' keyword for aureport/search - Add detection of failed group authentication to audisp-prelude * Thu Jan 31 2008 Steve Grubb <[EMAIL PROTECTED]> 1.6.7-1 - New upstream version - Adds prelude IDS plugin for IDMEF alerts - In ausearch/report, add new command line option --input-logs (#428860) - Avoid touching auditd.conf most of the time (#408501) * Fri Jan 11 2008 Steve Grubb <[EMAIL PROTECTED]> 1.6.5-2 Updates from spec file review * Mon Jan 7 2008 Steve Grubb <[EMAIL PROTECTED]> 1.6.5-1 - New upstream version - Add RACF zos remote audispd plugin (Klaus Kiwi) - Fix audit log permissions on rotate. If group is root 0400, otherwise 0440 - Update system-config-audit to version 0.4.5 (Miloslav Trmac) - Fix keep_logs when num_logs option disabled (#325561) - Allow use of errno strings for exit codes in audit rules - If auditd logging was suspended, it can be resumed with SIGUSR2 (#251639) - Updated CAPP, LSPP, and NISPOM rules for new capabilities - Added aulastlog utility -------------------------------------------------------------------------------- References: [ 1 ] Bug #440275 - CVE-2008-1628 audit: audit_log_user_command() Buffer Overflow https://bugzilla.redhat.com/show_bug.cgi?id=440275 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update audit' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at http://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ Fedora-package-announce mailing list Fedora-package-announce@redhat.com http://www.redhat.com/mailman/listinfo/fedora-package-announce