The peel_netstring function in cl_netstring.c in the heartbeat subsystem in High-Availability Linux before 1.2.5, and 2.0 before 2.0.7, allows remote attackers to cause a denial of service (crash) via the length parameter in a heartbeat message.

Yan Rong Ge discovered that heartbeat did not sufficiently verify some packet input data, which could lead to an out-of-boundary memory access. A remote attacker could exploit this to crash the daemon (Denial of Service).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes both a local and a remote denial of service attack within heartbeat, as well as numerous other bugs in the messaging and membership layer, GUI, Cluster Resource Manager, Local Resource Manager and Resource Agents. (CVE-2006-3815,CVE-2006-3121)

Two vulnerabilities in heartbeat prior to 2.0.6 was discovered by Yan Rong Ge. The first is that heartbeat would set insecure permissions in an shmget call for shared memory, allowing a local attacker to cause an unspecified denial of service via unknown vectors (CVE-2006-3815).

The second is a remote vulnerability that could allow allow the master control process to read invalid memory due to a specially crafted heartbeat message and die of a SEGV, all prior to any authentication (CVE-2006-3121).

Updated packages have been patched to correct these issues.

Yan Rong Ge discovered out-of-boundary memory access in heartbeat, the subsystem for High-Availability Linux. This could be used by a remote attacker to cause a denial of service.

The remote host is affected by the vulnerability described in GLSA-200608-23 (Heartbeat: Denial of Service)

    Yan Rong Ge discovered that the peel_netstring() function in     cl_netstring.c does not validate the 'length' parameter of user input,     which can lead to an out-of-bounds memory access when processing     certain Heartbeat messages (CVE-2006-3121). Furthermore an unspecified     local DoS issue was fixed (CVE-2006-3815).
  Impact :

    By sending a malicious UDP Heartbeat message, even before     authentication, a remote attacker can crash the master control process     of the cluster.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
27914	Ubuntu 5.04 / 5.10 / 6.06 LTS : heartbeat vulnerability (USN-335-1)	Nessus	Ubuntu Local Security Checks	medium
27263	openSUSE 10 Security Update : heartbeat (heartbeat-2139)	Nessus	SuSE Local Security Checks	medium
23891	Mandrake Linux Security Advisory : heartbeat (MDKSA-2006:142)	Nessus	Mandriva Local Security Checks	medium
22693	Debian DSA-1151-1 : heartbeat - out-of-bounds read	Nessus	Debian Local Security Checks	medium
22285	GLSA-200608-23 : Heartbeat: Denial of Service	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2006-3121

high

Tenable Plugins

medium

medium

medium

medium

medium