The (1) SAPDatabase and (2) SAPInstance scripts in OCF Resource Agents (aka resource-agents or cluster-agents) 1.0.3 in Linux-HA place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2011-1000 advisory.

    [2.0.52-21]
    - rgmanager: Fix bad passing of SFL_FAILURE up       (fix_bad_passing_of_sfl_failure_up.patch)       Resolves: rhbz#711521

    [2.0.52-20]
    - resource-agents: Improve LD_LIBRARY_PATH handling by SAP*       (resource_agents_improve_ld_library_path_handling_by_sap*.patch)       Resolves: rhbz#710637

    [2.0.52-19]
    - Fix changelog format
    - rgmanager: Fix reference count handling       (fix_reference_count_handling.patch)       Resolves: rhbz#692771

    [2.0.52-18]
    - resource-agents: postgres-8 resource agent does not detect a failed       start of postgres server       (postgres-8-Fix_pid_files.patch)       Resolves: rhbz#663827

    [2.0.52-16]
    - rgmanager: Allow non-root clustat       (allow_non_root_clustat.patch)       Resolves: rhbz#510300
    - rgmanager: Initial commit of central proc + migration support       (central_proc_+_migration_support.patch)       Resolves: rhbz#525271
    - rgmanager: Make clufindhostname -i predictable       (make_clufindhostname_i_predictable.patch)       Resolves: rhbz#592613
    - resource-agents: Trim trailing slash for nfs clients       (trim_trailing_slash_for_nfs_clients.patch)       Resolves: rhbz#592624
    - rgmanager: Update last_owner on failover       (update_last_owner_on_failover.patch)       Resolves: rhbz#610483
    - rgmanager: Pause during exit if we stopped services       (pause_during_exit_if_we_stopped_services.patch)       Resolves: rhbz#619468
    - rgmanager: Fix quotaoff handling       (fix_quotaoff_handling.patch)       Resolves: rhbz#637678
    - resource-agents: Try force-unmount before fuser for netfs.sh       (try_force_unmount_before_fuser_for_netfs_sh.patch)       Resolves: rhbz#678494
    - rgmanager: Improve rgmanager's exclusive prioritization handling       (improve_rgmanager_s_exclusive_prioritization_handling.patch)       Resolves: rhbz#680256

    [2.0.52-15]
    - resource-agents: postgres-8 resource agent does not detect a failed       start of postgres server       (postgres-8-Do-not-send-TERM-signal-when-killing-post.patch)       (postgres-8-Improve-testing-if-postgres-started-succe.patch)       Resolves: rhbz#663827

    [2.0.52-14]
    - resource-agents: Fix problems when generating XML configuration file       (rgmanager-Fix-problems-in-generated-XML-config-file.patch)       Resolves: rhbz#637802

    [2.0.52-13]
    - resource-agents: Use literal quotes for tr calls       (resource_agents_use_literal_quotes_for_tr_calls.patch)       Resolves: rhbz#637154

    [2.0.52-12]
    - resource-agents: Use shutdown immediate in oracledb.sh       (use_shutdown_immediate_in_oracledb_sh.patch)       Resolves: rhbz#633992
    - rgmanager: Add path to rhev-check.sh       (add_path_to_rhev_check_sh.patch)       Resolves: rhbz#634225
    - rgmanager: Make clustat report correct version       (make_clustat_report_correct_version.patch)       Resolves: rhbz#654160

    [2.0.52-11]
    - resource-agents: Listen line in generated httpd.conf incorrect       (resource-agents-Remove-netmask-from-IP-address-when.patch)       Resolves: rhbz#675739
    - resource-agents: Disable updates to static routes by RHCS IP tooling       (resource-agents-Add-option-disable_rdisc-to-ip.sh.patch)       Resolves: rhbz#620700

    [2.0.52-10.1]
    - rgmanager: Fix nofailback when service is in 'starting' state       (fix_nofailback_when_service_is_in_starting_state.patch)       Resolves: rhbz#669440

    [2.0.52-10]
    - resource-agents: Problem with whitespace in mysql resource name       (resource_agents_fix_whitespace_in_names.patch)       Resolves: rhbz#632704

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201412-09 (Multiple packages, Multiple vulnerabilities fixed in 2011)

    Vulnerabilities have been discovered in the packages listed below.
      Please review the CVE identifiers in the Reference section for details.
      FMOD Studio       PEAR Mail       LVM2       GnuCash       xine-lib       Last.fm Scrobbler       WebKitGTK+       shadow tool suite       PEAR       unixODBC       Resource Agents       mrouted       rsync       XML Security Library       xrdb       Vino       OProfile       syslog-ng       sFlow Toolkit       GNOME Display Manager       libsoup       CA Certificates       Gitolite       QtCreator       Racer   Impact :

    A context-dependent attacker may be able to gain escalated privileges,       execute arbitrary code, cause Denial of Service, obtain sensitive       information, or otherwise bypass security restrictions.
  Workaround :

    There are no known workarounds at this time.

An updated resource-agents package that fixes one security issue, several bugs, and adds multiple enhancements is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The resource-agents package contains a set of scripts to interface with several services to operate in a High Availability environment for both Pacemaker and rgmanager service managers.

It was discovered that certain resource agent scripts set the LD_LIBRARY_PATH environment variable to an insecure value containing empty path elements. A local user able to trick a user running those scripts to run them while working from an attacker-writable directory could use this flaw to escalate their privileges via a specially crafted dynamic library. (CVE-2010-3389)

Red Hat would like to thank Raphael Geissert for reporting this issue.

This update also fixes the following bugs :

* When using the Sybase database and the ASEHAagent resource in the cluster.conf file, it was not possible to run more than one ASEHAagent per Sybase installation. Consequently, a second ASEHA (Sybase Adaptive Server Enterprise (ASE) with the High Availability Option) agent could not be run. This bug has been fixed and it is now possible to use two ASEHA agents using the same Sybase installation. (BZ#711852)

* The s/lang scripts, which implement internal functionality for the rgmanager package, while the central_processing option is in use, were included in the wrong package. Now, the rgmanager and resource-agents packages require each other for installation to prevent problems when they are used separately. (BZ#693518)

* Previously, the oracledb.sh script was using the 'shutdown abort' command as the first attempt to shut down a database. With this update, oracledb.sh first attempts a graceful shutdown via the 'shutdown immediate' command before forcing the shutdown. (BZ#689801)

* Previously, when setting up a service on a cluster with a shared IP resource and an Apache resource, the generated httpd.conf file contained a bug in the line describing the shared IP address (the 'Listen' line). Now, the Apache resource agent generates the 'Listen' line properly. (BZ#667217)

* If a high-availability (HA) cluster service was defined with an Apache resource and was named with two words, such as 'kickstart httpd', the service never started because it could not find a directory with the space character in its name escaped. Now, Apache resources work properly if a name contains a space as described above.
(BZ#667222)

* When inheritance was used in the cluster.conf file, a bug in the /usr/share/cluster/nfsclient.sh file prevented it from monitoring NFS exports properly. Consequently, monitoring of NFS exports to NFS clients resulted in an endless loop. This bug has been fixed and the monitoring now works as expected. (BZ#691814)

* Previously, the postgres-8 resource agent did not detect when a PostgreSQL server failed to start. This bug has been fixed and postgres-8 now works as expected in the described scenario.
(BZ#694816)

* When using the Pacemaker resource manager, the fs.sh resource agent reported an error condition, if called with the 'monitor' parameter and the referenced device did not exist. Consequently, the error condition prevented the resource from being started. Now, fs.sh returns the proper response code in the described scenario, thus fixing this bug. (BZ#709400)

* Previously, numerous RGManager resource agents returned incorrect response codes when coupled with the Pacemaker resource manager. Now, the agents have been updated to work with Pacemaker properly.
(BZ#727643)

This update also adds the following enhancement :

* With this update, when the network is removed from a node using the netfs.sh resource agent, it now recovers faster than previously.
(BZ#678497)

As well, this update upgrades the resource-agents package to upstream version 3.9.2, which provides a number of bug fixes and enhancements over the previous version. (BZ#707127)

All users of resource-agents are advised to upgrade to this updated package, which corrects these issues and adds these enhancements.

The remote Redhat Enterprise Linux 5 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2011:1000 advisory.

  - rgmanager: insecure library loading vulnerability (CVE-2010-3389)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The resource-agents package contains a set of scripts to interface with several services to operate in a High Availability environment for both Pacemaker and rgmanager service managers.

It was discovered that certain resource agent scripts set the LD_LIBRARY_PATH environment variable to an insecure value containing empty path elements. A local user able to trick a user running those scripts to run them while working from an attacker-writable directory could use this flaw to escalate their privileges via a specially crafted dynamic library. (CVE-2010-3389)

This update also fixes the following bugs :

  - When using the Sybase database and the ASEHAagent     resource in the cluster.conf file, it was not possible     to run more than one ASEHAagent per Sybase installation.
    Consequently, a second ASEHA (Sybase Adaptive Server     Enterprise (ASE) with the High Availability Option)     agent could not be run. This bug has been fixed and it     is now possible to use two ASEHA agents using the same     Sybase installation.

  - The s/lang scripts, which implement internal     functionality for the rgmanager package, while the     central_processing option is in use, were included in     the wrong package. Now, the rgmanager and     resource-agents packages require each other for     installation to prevent problems when they are used     separately.

  - Previously, the oracledb.sh script was using the     'shutdown abort' command as the first attempt to shut     down a database. With this update, oracledb.sh first     attempts a graceful shutdown via the 'shutdown     immediate' command before forcing the shutdown.

  - Previously, when setting up a service on a cluster with     a shared IP resource and an Apache resource, the     generated httpd.conf file contained a bug in the line     describing the shared IP address (the 'Listen' line).
    Now, the Apache resource agent generates the 'Listen'     line properly.

  - If a high-availability (HA) cluster service was defined     with an Apache resource and was named with two words,     such as 'kickstart httpd', the service never started     because it could not find a directory with the space     character in its name escaped. Now, Apache resources     work properly if a name contains a space as described     above.

  - When inheritance was used in the cluster.conf file, a     bug in the /usr/share/cluster/nfsclient.sh file     prevented it from monitoring NFS exports properly.
    Consequently, monitoring of NFS exports to NFS clients     resulted in an endless loop. This bug has been fixed and     the monitoring now works as expected.

  - Previously, the postgres-8 resource agent did not detect     when a PostgreSQL server failed to start. This bug has     been fixed and postgres-8 now works as expected in the     described scenario.

  - When using the Pacemaker resource manager, the fs.sh     resource agent reported an error condition, if called     with the 'monitor' parameter and the referenced device     did not exist. Consequently, the error condition     prevented the resource from being started. Now, fs.sh     returns the proper response code in the described     scenario, thus fixing this bug.

  - Previously, numerous RGManager resource agents returned     incorrect response codes when coupled with the Pacemaker     resource manager. Now, the agents have been updated to     work with Pacemaker properly.

This update also adds the following enhancement :

  - With this update, when the network is removed from a     node using the netfs.sh resource agent, it now recovers     faster than previously.

As well, this update upgrades the resource-agents package to upstream version 3.9.2, which provides a number of bug fixes and enhancements over the previous version.

All users of resource-agents are advised to upgrade to this updated package, which corrects these issues and adds these enhancements.

The rgmanager package contains the Resource Group Manager, which provides the ability to create and manage high-availability server applications in the event of system downtime.

It was discovered that certain resource agent scripts set the LD_LIBRARY_PATH environment variable to an insecure value containing empty path elements. A local user able to trick a user running those scripts to run them while working from an attacker-writable directory could use this flaw to escalate their privileges via a specially crafted dynamic library. (CVE-2010-3389)

This update also fixes the following bugs :

  - The failover domain 'nofailback' option was not honored     if a service was in the 'starting' state. This bug has     been fixed.

  - PID files with white spaces in the file name are now     handled correctly.

  - The /usr/sbin/rhev-check.sh script can now be used from     within Cron.

  - The clustat utility now reports the correct version.

  - The oracledb.sh agent now attempts to try the 'shutdown     immediate' command instead of using the 'shutdown abort'     command.

  - The SAPInstance and SAPDatabase scripts now use proper     directory name quoting so they no longer collide with     directory names like '/u'.

  - The clufindhostname utility now returns the correct     value in all cases.

  - The nfsclient resource agent now handles paths with     trailing slashes correctly.

  - The last owner of a service is now reported correctly     after a failover.

  - The /usr/share/cluster/fs.sh script no longer runs the     'quotaoff' command if quotas were not configured.

  - The 'listen' line in the /etc/httpd/conf/httpd.conf file     generated by the Apache resource agent is now correct.

  - The tomcat-5 resource agent no longer generates     incorrect configurations.

  - The time required to stop an NFS resource when the     server is unavailable has been reduced.

  - When using exclusive prioritization, a higher priority     service now preempts a lower priority service after     status check failures.

  - The postgres-8 resource agent now correctly detects     failed start operations.

  - The handling of reference counts passed by rgmanager to     resource agents now works properly, as expected.

As well, this update adds the following enhancements :

  - It is now possible to disable updates to static routes     by the IP resource agent.

  - It is now possible to use XFS as a file system within a     cluster service.

  - It is now possible to use the 'clustat' command as a     non-root user, so long as that user is in the 'root'     group.

  - It is now possible to migrate virtual machines when     central processing is enabled.

  - The rgmanager init script will now delay after stopping     services in order to allow time for other nodes to     restart them.

  - The handling of failed independent subtrees has been     corrected.

All users of Resource Group Manager are advised to upgrade to this updated package, which contains backported patches to correct these issues and add these enhancements.

Multiple insecure temporary file use flaws were discovered in rgmanager and various resource scripts run by rgmanager. A local attacker could use these flaws to overwrite an arbitrary file writable by the rgmanager process (i.e. user root) with the output of rgmanager or a resource agent via a symbolic link attack. (CVE-2008-6552)

It was discovered that certain resource agent scripts set the LD_LIBRARY_PATH environment variable to an insecure value containing empty path elements. A local user able to trick a user running those scripts to run them while working from an attacker-writable directory could use this flaw to escalate their privileges via a specially crafted dynamic library. (CVE-2010-3389)

This update also fixes the following bugs :

  - Previously, starting threads could incorrectly include a     reference to an exited thread if that thread exited when     rgmanager received a request to start a new thread. Due     to this issue, the new thread did not retry and entered     an infinite loop. This update ensures that new threads     do not reference old threads. Now, new threads no longer     enter an infinite loop in which the rgmanager enables     and disables services without failing gracefully.
    (BZ#502872)

  - Previously, nfsclient.sh left temporary     nfsclient-status-cache-$$ files in /tmp/. (BZ#506152)

  - Previously, the function local_node_name in     /resources/utils/member_util.sh did not correctly check     whether magma_tool failed. Due to this issue, empty     strings could be returned. This update checks the input     and rejects empty strings. (BZ#516758)

  - Previously, the file system agent could kill a process     when an application used a mount point with a similar     name to a mount point managed by rgmanager using     force_unmount. With this update, the file system agent     kills only the processes that access the mount point     managed by rgmanager. (BZ#555901)

  - Previously, simultaneous execution of 'lvchange
    --deltag' from /etc/init.d/rgmanager caused a checksum     error on High Availability Logical Volume Manager     (HA-LVM). With this update, ownership of LVM tags is     checked before removing them. (BZ#559582)

  - Previously, the isAlive check could fail if two nodes     used the same file name. With this update, the isAlive     function prevents two nodes from using the same file     name. (BZ#469815)

  - Previously, the S/Lang code could lead to unwanted     S/Lang stack leaks during event processing. (BZ#507430)

The remote host is affected by the vulnerability described in GLSA-201110-18 (rgmanager: Privilege escalation)

    A vulnerability has been discovered in rgmanager. Please review the CVE       identifier referenced below for details.
  Impact :

    A local attacker could gain escalated privileges.
  Workaround :

    There is no known workaround at this time.

An updated rgmanager package that fixes one security issue, several bugs, and adds multiple enhancements is now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The rgmanager package contains the Red Hat Resource Group Manager, which provides the ability to create and manage high-availability server applications in the event of system downtime.

It was discovered that certain resource agent scripts set the LD_LIBRARY_PATH environment variable to an insecure value containing empty path elements. A local user able to trick a user running those scripts to run them while working from an attacker-writable directory could use this flaw to escalate their privileges via a specially crafted dynamic library. (CVE-2010-3389)

Red Hat would like to thank Raphael Geissert for reporting this issue.

This update also fixes the following bugs :

* The failover domain 'nofailback' option was not honored if a service was in the 'starting' state. This bug has been fixed. (BZ#669440)

* PID files with white spaces in the file name are now handled correctly. (BZ#632704)

* The /usr/sbin/rhev-check.sh script can now be used from within Cron.
(BZ#634225)

* The clustat utility now reports the correct version. (BZ#654160)

* The oracledb.sh agent now attempts to try the 'shutdown immediate' command instead of using the 'shutdown abort' command. (BZ#633992)

* The SAPInstance and SAPDatabase scripts now use proper directory name quoting so they no longer collide with directory names like '/u'.
(BZ#637154)

* The clufindhostname utility now returns the correct value in all cases. (BZ#592613)

* The nfsclient resource agent now handles paths with trailing slashes correctly. (BZ#592624)

* The last owner of a service is now reported correctly after a failover. (BZ#610483)

* The /usr/share/cluster/fs.sh script no longer runs the 'quotaoff' command if quotas were not configured. (BZ#637678)

* The 'listen' line in the /etc/httpd/conf/httpd.conf file generated by the Apache resource agent is now correct. (BZ#675739)

* The tomcat-5 resource agent no longer generates incorrect configurations. (BZ#637802)

* The time required to stop an NFS resource when the server is unavailable has been reduced. (BZ#678494)

* When using exclusive prioritization, a higher priority service now preempts a lower priority service after status check failures.
(BZ#680256)

* The postgres-8 resource agent now correctly detects failed start operations. (BZ#663827)

* The handling of reference counts passed by rgmanager to resource agents now works properly, as expected. (BZ#692771)

As well, this update adds the following enhancements :

* It is now possible to disable updates to static routes by the IP resource agent. (BZ#620700)

* It is now possible to use XFS as a file system within a cluster service. (BZ#661893)

* It is now possible to use the 'clustat' command as a non-root user, so long as that user is in the 'root' group. (BZ#510300)

* It is now possible to migrate virtual machines when central processing is enabled. (BZ#525271)

* The rgmanager init script will now delay after stopping services in order to allow time for other nodes to restart them. (BZ#619468)

* The handling of failed independent subtrees has been corrected.
(BZ#711521)

All users of Red Hat Resource Group Manager are advised to upgrade to this updated package, which contains backported patches to correct these issues and add these enhancements.

ID	Name	Product	Family	Severity
181107	Oracle Linux 5 : rgmanager (ELSA-2011-1000)	Nessus	Oracle Linux Local Security Checks	high
79962	GLSA-201412-09 : Multiple packages, Multiple vulnerabilities fixed in 2011	Nessus	Gentoo Local Security Checks	critical
64007	RHEL 6 : resource-agents (RHSA-2011:1580)	Nessus	Red Hat Local Security Checks	medium
63992	RHEL 5 : rgmanager (RHSA-2011:1000)	Nessus	Red Hat Local Security Checks	high
61196	Scientific Linux Security Update : resource-agents on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
61091	Scientific Linux Security Update : rgmanager on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
60961	Scientific Linux Security Update : rgmanager on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
56593	GLSA-201110-18 : rgmanager: Privilege escalation	Nessus	Gentoo Local Security Checks	medium
56262	CentOS 5 : rgmanager (CESA-2011:1000)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2010-3389

high

Tenable Plugins

high

critical

medium

high

medium

medium

medium

medium

medium