heartbeat.c in heartbeat before 2.0.6 sets insecure permissions in a shmget call for shared memory, which allows local users to cause an unspecified denial of service via unknown vectors, possibly during a short time window on startup.

Yan Rong Ge discovered that heartbeat did not set proper permissions for an allocated shared memory segment. A local attacker could exploit this to render the heartbeat service unavailable (Denial of Service).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes both a local and a remote denial of service attack within heartbeat, as well as numerous other bugs in the messaging and membership layer, GUI, Cluster Resource Manager, Local Resource Manager and Resource Agents. (CVE-2006-3815,CVE-2006-3121)

Two vulnerabilities in heartbeat prior to 2.0.6 was discovered by Yan Rong Ge. The first is that heartbeat would set insecure permissions in an shmget call for shared memory, allowing a local attacker to cause an unspecified denial of service via unknown vectors (CVE-2006-3815).

The second is a remote vulnerability that could allow allow the master control process to read invalid memory due to a specially crafted heartbeat message and die of a SEGV, all prior to any authentication (CVE-2006-3121).

Updated packages have been patched to correct these issues.

Yan Rong Ge discovered that wrong permissions on a shared memory page in heartbeat, the subsystem for High-Availability Linux could be exploited by a local attacker to cause a denial of service.

The remote host is affected by the vulnerability described in GLSA-200608-23 (Heartbeat: Denial of Service)

    Yan Rong Ge discovered that the peel_netstring() function in     cl_netstring.c does not validate the 'length' parameter of user input,     which can lead to an out-of-bounds memory access when processing     certain Heartbeat messages (CVE-2006-3121). Furthermore an unspecified     local DoS issue was fixed (CVE-2006-3815).
  Impact :

    By sending a malicious UDP Heartbeat message, even before     authentication, a remote attacker can crash the master control process     of the cluster.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
27904	Ubuntu 5.04 / 5.10 / 6.06 LTS : heartbeat vulnerability (USN-326-1)	Nessus	Ubuntu Local Security Checks	low
27263	openSUSE 10 Security Update : heartbeat (heartbeat-2139)	Nessus	SuSE Local Security Checks	medium
23891	Mandrake Linux Security Advisory : heartbeat (MDKSA-2006:142)	Nessus	Mandriva Local Security Checks	medium
22670	Debian DSA-1128-1 : heartbeat - permission error	Nessus	Debian Local Security Checks	low
22285	GLSA-200608-23 : Heartbeat: Denial of Service	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2006-3815

medium

Tenable Plugins

low

medium

medium

low

medium