Issued:

2009-04-22

Updated:

2009-04-22

RHBA-2009:0443 - audit bugfix update

Synopsis

audit bugfix update

Type/Severity

Bug Fix Advisory

Topic

Updated audit packages that resolve several issues are now available.

Description

The audit packages contain user-space utilities for storing and searching the audit records generated by the audit subsystem in the Linux 2.6 kernel.

These updated packages fix the following bugs in the auditd daemon and one of its utilities:

• when the log_format parameter was set to "NOLOG" in the auditd.conf configuration file, audit events which were queued in the internal message queue were not cleared after being written to dispatchers. This caused the internal message queue to grow over time, causing an auditd memory leak. With these updated packages the audit events in the internal message queue are properly cleared after being written, thus plugging the memory leak.

• certain audit rules failed parser checks even though they were specified correctly, which prevented those rules from being loaded into the kernel. With this update, all correctly-specified audit rules pass parser checks and can be loaded into the kernel, thus resolving the problem.

All users of audit are advised to upgrade to these updated packages, which resolve these issues.

Solution

Before applying this update, make sure that all previously-released errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at This content is not included.http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

Updated Packages

• audit-1.7.7-6.el5_3.2.src.rpm
• audit-1.7.7-6.el5_3.2.i386.rpm
• system-config-audit-0.4.8-7.el5_3.1.ppc.rpm
• audit-1.7.7-6.el5_3.2.ia64.rpm
• audit-1.7.7-6.el5_3.2.ppc.rpm
• audit-libs-devel-1.7.7-6.el5_3.2.ppc64.rpm
• system-config-audit-0.4.8-7.el5_3.1.s390x.rpm
• audispd-plugins-1.7.7-6.el5_3.2.s390x.rpm
• audit-1.7.7-6.el5_3.2.s390x.rpm
• audispd-plugins-1.7.7-6.el5_3.2.i386.rpm
• audispd-plugins-1.7.7-6.el5_3.2.ia64.rpm
• audispd-plugins-1.7.7-6.el5_3.2.x86_64.rpm
• audit-libs-1.7.7-6.el5_3.2.s390x.rpm
• system-config-audit-0.4.8-7.el5_3.1.x86_64.rpm
• audit-libs-devel-1.7.7-6.el5_3.2.i386.rpm
• audit-libs-devel-1.7.7-6.el5_3.2.ia64.rpm
• audit-1.7.7-6.el5_3.2.x86_64.rpm
• audit-libs-1.7.7-6.el5_3.2.ppc64.rpm
• audit-libs-devel-1.7.7-6.el5_3.2.s390x.rpm
• audit-libs-1.7.7-6.el5_3.2.x86_64.rpm
• audispd-plugins-1.7.7-6.el5_3.2.ppc.rpm
• audit-libs-1.7.7-6.el5_3.2.i386.rpm
• audit-libs-devel-1.7.7-6.el5_3.2.x86_64.rpm
• audit-libs-devel-1.7.7-6.el5_3.2.s390.rpm
• audit-libs-python-1.7.7-6.el5_3.2.i386.rpm
• audit-libs-python-1.7.7-6.el5_3.2.ppc.rpm
• audit-libs-1.7.7-6.el5_3.2.s390.rpm
• audit-libs-1.7.7-6.el5_3.2.ppc.rpm
• system-config-audit-0.4.8-7.el5_3.1.ia64.rpm
• audit-libs-python-1.7.7-6.el5_3.2.ia64.rpm
• audit-libs-devel-1.7.7-6.el5_3.2.ppc.rpm
• system-config-audit-0.4.8-7.el5_3.1.i386.rpm
• audit-libs-python-1.7.7-6.el5_3.2.s390x.rpm
• audit-libs-python-1.7.7-6.el5_3.2.x86_64.rpm
• audit-libs-1.7.7-6.el5_3.2.ia64.rpm

Fixes

• This content is not included.BZ - 494924
• This content is not included.BZ - 495711

CVEs

(none)

References

(none)

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.