The pserver_shutdown function in fence_egenera in cman 2.20080629 and 2.20080801 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/eglog temporary file.

Insecure temporary file use flaws were found in fence_egenera, fence_apc, and fence_apc_snmp. A local attacker could use these flaws to overwrite an arbitrary file writable by the victim running those utilities via a symbolic link attack. (CVE-2008-4192, CVE-2008-4579)

This update also fixes the following bugs :

  - fence_apc_snmp now waits for five seconds after fencing     to properly get status. (BZ#494587)

  - The fence_drac5 help output now shows the proper     commands. (BZ#498870)

  - fence_scsi_test.pl now verifies that sg_persist is in     the path before running. (BZ#500172)

  - fence_drac5 is now more consistent with other agents and     uses module_name instead of modulename. (BZ#500546)

  - fence_apc and fence_wti no longer fail with a pexpect     exception. (BZ#501890, BZ#504589)

  - fence_wti no longer issues a traceback when an option is     missing. (BZ#508258)

  - fence_sanbox2 is now able to properly obtain the status     after fencing. (BZ#510279)

  - Fencing no longer fails if fence_wti is used without     telnet. (BZ#510335)

  - fence_scsi get_scsi_devices no longer hangs with various     devices. (BZ#545193)

  - fence_ilo no longer fails to reboot with ilo2 firmware     1.70. (BZ#545682)

  - Fixed an issue with fence_ilo not rebooting in some     implementations. (BZ#576036)

  - fence_ilo no longer throws exceptions if the user does     not have power privileges. (BZ#576178)

As well, this update adds the following enhancements :

  - Support has been added for SSH-enabled RSA II fence     devices. (BZ#476161)

  - The APC fence agent will now work with a non-root     account. (BZ#491643)

Multiple insecure temporary file handling vulnerabilities were discovered in Red Hat Cluster. A local attacker could exploit these to overwrite arbitrary local files via symlinks. (CVE-2008-4192, CVE-2008-4579, CVE-2008-4580, CVE-2008-6552)

It was discovered that CMAN did not properly handle malformed configuration files. An attacker could cause a denial of service (via CPU consumption and memory corruption) in a node if the attacker were able to modify the cluster configuration for the node. (CVE-2008-6560).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update includes security fixes for: CVE-2008-4192 CVE-2008-4579 among many other upstream bug fixes.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
60958	Scientific Linux Security Update : fence on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
43368	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 : redhat-cluster, redhat-cluster-suite vulnerabilities (USN-875-1)	Nessus	Ubuntu Local Security Checks	high
34482	Fedora 9 : cman-2.03.08-1.fc9 / gfs2-utils-2.03.08-1.fc9 / rgmanager-2.03.08-1.fc9 (2008-9042)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2008-4192

medium

Tenable Plugins

medium

high

medium