The ricci daemon in Red Hat Conga 0.10.0 allows remote attackers to cause a denial of service (loss of new connections) by repeatedly sending data or attempting connections.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2007-0640 advisory.

    [0.10.0-6.el5.0.1]
    - Replaced Redhat copyrighted and trademarked images in the conga-0.10.0 tarball.

    [0.10.0-6]

    - Fixed bz253783
    - Fixed bz253914 (conga doesn't allow you to reuse nfs export and nfs client resources)
    - Fixed bz254038 (Impossible to set many valid quorum disk configurations via conga)
    - Fixed bz253994 (Cannot specify multicast address for a cluster)
    - Resolves: bz253783, bz253914, bz254038, bz253994

    [0.10.0-5]

    - Fixed bz249291 (delete node task fails to do all items listed in the help document)
    - Fixed bz253341 (failure to start cluster service which had been modifed for correction)
    - Related: bz253341
    - Resolves: bz249291

    [0.10.0-4]

    - Fixed bz230451 (fence_xvm.key file is not automatically created. Should have a least a default)
    - Fixed bz249097 (allow a space as a valid password char)
    - Fixed bz250834 (ZeroDivisionError when attempting to click an empty lvm volume group)
    - Fixed bz250443 (storage name warning utility produces a storm of warnings which can lock your browser)
    - Resolves: bz249097, bz250443, bz250834
    - Related: bz230451

    [0.10.0-3]

    - Fixed bz245947 (luci/Conga cluster configuration tool not initializing cluster node members)
    - Fixed bz249641 (conga is unable to do storage operations if there is an lvm snapshot present)
    - Fixed bz249342 (unknown ricci error when adding new node to cluster)
    - Fixed bz249291 (delete node task fails to do all items listed in the help document)
    - Fixed bz249091 (RFE: tell user they are about to kill all their nodes)
    - Fixed bz249066 (AttributeError when attempting to configure a fence device)
    - Fixed bz249086 (Unable to add a new fence device to cluster)
    - Fixed bz249868 (Use of failover domain not correctly shown)
    - Resolves bz245947, bz249641, bz249342, bz249291, bz249091,
    - Resolves bz249066, bz249086, bz249868
    - Related: bz249351

    [0.10.0-2]

    - Fixed bz245202 (Conga needs to support Internet Explorer 6.0 and later)
    - Fixed bz248317 (luci sets incorrect permissions on /usr/lib64/luci and /var/lib/luci)
    - Resolves: bz245202 bz248317

    [0.10.0-1]
    - Fixed bz238655 (conga does not set the 'nodename' attribute for manual fencing)
    - Fixed bz221899 (Node log displayed in partially random order)
    - Fixed bz225782 (Need more luci service information on startup - no info written to log about failed     start cause)
    - Fixed bz227743 (Intermittent/recurring problem - when cluster is deleted, sometimes a node is not     affected)
    - Fixed bz227682 (saslauthd[2274]: Deprecated pam_stack module called from service 'ricci')
    - Fixed bz238726 (Conga provides no way to remove a dead node from a cluster)
    - Fixed bz239389 (conga cluster: make 'enable shared storage' the default)
    - Fixed bz239596
    - Fixed bz240034 (rpm verify fails on luci)
    - Fixed bz240361 (Conga storage UI front-end is too slow rendering storage)
    - Fixed bz241415 (Installation using Conga shows 'error' in message during reboot cycle.)
    - Fixed bz241418 (Conga tries to configurage cluster snaps, though they are not available.)
    - Fixed bz241706 (Eliminate confusion in add fence flow)
    - Fixed bz241727 (can't set user permissions in luci)
    - Fixed bz242668 (luci init script can return non-LSB-compliant return codes)
    - Fixed bz243701 (ricci init script can exit with non-LSB-compliant return codes)
    - Fixed bz244146 (Add port number to message when ricci is not started/firewalled on cluster nodes.)
    - Fixed bz244878 (Successful login results in an infinite redirection loop with MSIE)
    - Fixed bz239388 (conga storage: default VG creation should be clustered if a cluster node)
    - Fixed bz239327 (Online User Manual needs modification)
    - Fixed bz227852 (Lack of debugging information in logs - support issue)
    - Fixed bz245025 (Conga does not accept '&' character in password field for Fence configuration)
    - Fixed bz225588 (luci web app does not enforce selection of fence port)
    - Fixed bz212022 (cannot create cluster using ip addresses)
    - Fixed bz223162 (Error trying to create a new fence device for a cluster node)
    - Upgraded to the latest Plone (2.5.3)
    - Added a 'reprobe storage' button that invalidates cached storage reports       and forces a new probe.
    - Resolves: bz238655, bz221899, bz225782, bz227682, bz227743, bz239389,
    - Resolves: bz239596, bz240034, bz240361, bz241415, bz241418, bz241706,
    - Resolves: bz241727, bz242668, bz243701, bz244146, bz244878, bz238726,
    - Resolves: bz239388, bz239327, bz227852, bz245025, bz225588, bz212022

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated conga packages that correct a security flaw and provide bug fixes and add enhancements are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Conga package is a web-based administration tool for remote cluster and storage management.

A flaw was found in ricci during a code audit. A remote attacker who is able to connect to ricci could cause ricci to temporarily refuse additional connections, a denial of service (CVE-2007-4136).

Fixes in this updated package include :

* The nodename is now set for manual fencing.

* The node log no longer displays in random order.

* A bug that prevented a node from responding when a cluster was deleted is now fixed.

* A PAM configuration that incorrectly called the deprecated module pam_stack was removed.

* A bug that prevented some quorum disk configurations from being accepted is now fixed.

* Setting multicast addresses now works properly.

* rpm -V on luci no longer fails.

* The user interface rendering time for storage interface is now faster.

* An error message that incorrectly appeared when rebooting nodes during cluster creation was removed.

* Cluster snaps configuration (an unsupported feature) has been removed altogether to prevent user confusion.

* A user permission bug resulting from a luci code error is now fixed.

* luci and ricci init script return codes are now LSB-compliant.

* VG creation on cluster nodes now defaults to 'clustered'.

* An SELinux AVC bug that prevented users from setting up shared storage on nodes is now fixed.

* An access error that occurred when attempting to access a cluster node after its cluster was deleted is now fixed.

* IP addresses can now be used to create clusters.

* Attempting to configure a fence device no longer results in an AttributeError.

* Attempting to create a new fence device to a valid cluster no longer results in a KeyError.

* Several minor user interface validation errors have been fixed, such as enforcing cluster name length and fence port, etc.

* A browser lock-up that could occur during storage configuration has been fixed.

* Virtual service creation now works without error.

* The fence_xvm tag is no longer misspelled in the cluster.conf file.

* Luci failover forms are complete and working. * Rebooting a fresh cluster install no longer generates an error message.

* A bug that prevented failed cluster services from being started is now fixed.

* A bug that caused some cluster operations (e.g., node delete) to fail on clusters with mixed-cased cluster names is now fixed.

* Global cluster resources can be reused when constructing cluster services.

Enhancements in this updated package include :

* Users can now access Conga through Internet Explorer 6.

* Dead nodes can now be evicted from a cluster.

* Shared storage on new clusters is now enabled by default.

* The fence user-interface flow is now simpler.

* A port number is now shown in ricci error messages.

* The kmod-gfs-xen kernel module is now installed when creating a cluster.

* Cluster creation status is now shown visually.

* User names are now sorted for display.

* The fence_xvmd tag can now be added from the dom0 cluster nodes.

* The ampersand character (&) can now be used in fence names.

* All packaged files are now installed with proper owners and permissions.

* New cluster node members are now properly initialized.

* Storage operations can now be completed even if an LVM snapshot is present.

* Users are now informed via dialog when nodes are rebooted as part of a cluster operation.

* Failover domains are now properly listed for virtual services and traditional clustered services.

* Luci can now create and distribute keys for fence_xvmd.

All Conga users are advised to upgrade to this update, which applies these fixes and enhancements.

A flaw was found in ricci during a code audit. A remote attacker who is able to connect to ricci could cause ricci to temporarily refuse additional connections, a denial of service (CVE-2007-4136).

Fixes in this updated package include :

  - The nodename is now set for manual fencing.

  - The node log no longer displays in random order.

  - A bug that prevented a node from responding when a     cluster was deleted is now fixed.

  - A PAM configuration that incorrectly called the     deprecated module pam_stack was removed.

  - A bug that prevented some quorum disk configurations     from being accepted is now fixed.

  - Setting multicast addresses now works properly.

  - rpm -V on luci no longer fails.

  - The user interface rendering time for storage interface     is now faster.

  - An error message that incorrectly appeared when     rebooting nodes during cluster creation was removed.

  - Cluster snaps configuration (an unsupported feature) has     been removed altogether to prevent user confusion.

  - A user permission bug resulting from a luci code error     is now fixed.

  - luci and ricci init script return codes are now     LSB-compliant.

  - VG creation on cluster nodes now defaults to     'clustered'.

  - An SELinux AVC bug that prevented users from setting up     shared storage on nodes is now fixed.

  - An access error that occurred when attempting to access     a cluster node after its cluster was deleted is now     fixed.

  - IP addresses can now be used to create clusters.

  - Attempting to configure a fence device no longer results     in an AttributeError.

  - Attempting to create a new fence device to a valid     cluster no longer results in a KeyError.

  - Several minor user interface validation errors have been     fixed, such as enforcing cluster name length and fence     port, etc.

  - A browser lock-up that could occur during storage     configuration has been fixed.

  - Virtual service creation now works without error.

  - The fence_xvm tag is no longer misspelled in the     cluster.conf file.

  - Luci failover forms are complete and working.

  - Rebooting a fresh cluster install no longer generates an     error message.

  - A bug that prevented failed cluster services from being     started is now fixed.

  - A bug that caused some cluster operations (e.g., node     delete) to fail on clusters with mixed-cased cluster     names is now fixed.

  - Global cluster resources can be reused when constructing     cluster services.

Enhancements in this updated package include :

  - Users can now access Conga through Internet Explorer 6.

  - Dead nodes can now be evicted from a cluster.

  - Shared storage on new clusters is now enabled by     default.

  - The fence user-interface flow is now simpler.

  - A port number is now shown in ricci error messages.

  - The kmod-gfs-xen kernel module is now installed when     creating a cluster.

  - Cluster creation status is now shown visually.

  - User names are now sorted for display.

  - The fence_xvmd tag can now be added from the dom0     cluster nodes.

  - The ampersand character (&amp;) can now be used in fence     names.

  - All packaged files are now installed with proper owners     and permissions.

  - New cluster node members are now properly initialized.

  - Storage operations can now be completed even if an LVM     snapshot is present.

  - Users are now informed via dialog when nodes are     rebooted as part of a cluster operation.

  - Failover domains are now properly listed for virtual     services and traditional clustered services.

  - Luci can now create and distribute keys for fence_xvmd.

ID	Name	Product	Family	Severity
180618	Oracle Linux 5 : conga (ELSA-2007-0640)	Nessus	Oracle Linux Local Security Checks	high
63842	RHEL 5 : conga (RHSA-2007:0640)	Nessus	Red Hat Local Security Checks	medium
60284	Scientific Linux Security Update : conga on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium

Detections

Analytics

CVE-2007-4136

high

Tenable Plugins

high

medium

medium