__________________________________________________________ The U.S. Department of Energy Computer Incident Advisory Capability ___ __ __ _ ___ / | /_\ / \___ __|__ / \ \___ __________________________________________________________ INFORMATION BULLETIN cman Security Update [Red Hat RHSA:2007-0559-2] June 28, 2007 18:00 GMT Number R-290 ______________________________________________________________________________ PROBLEM: A flaw was found in the cman daemon. PLATFORM: RHEL Desktop Workstation (v. 5 client) Red Hat Enterprise Linux (v. 5 server) DAMAGE: Could trigger a static buffer overflow leading to a denial of service or potentially, an escalation of privileges. SOLUTION: Upgrade to the appropriate version. ______________________________________________________________________________ VULNERABILITY The risk is MEDIUM. A local user of the cluster manager could ASSESSMENT: trigger a buffer overflow and execute arbitrary commands as root. ______________________________________________________________________________ LINKS: CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/r-290.shtml ORIGINAL BULLETIN: https://rhn.redhat.com/errata/RHSA-2007-0559.html CVE: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name= CVE-2007-3374 ______________________________________________________________________________ [***** Start Red Hat RHSA:2007-0559-2 *****] Important: cman security update Advisory: RHSA-2007:0559-2 Type: Security Advisory Severity: Important Issued on: 2007-06-28 Last updated on: 2007-06-28 Affected Products: RHEL Desktop Workstation (v. 5 client) Red Hat Enterprise Linux (v. 5 server) OVAL: com.redhat.rhsa-20070559.xml CVEs (cve.mitre.org): CVE-2007-3374 Details Updated cman packages that correct a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. cman is the Red Hat Cluster Manager. A flaw was found in the cman daemon. A local attacker could connect to the cman daemon and trigger a static buffer overflow leading to a denial of service or, potentially, an escalation of privileges. (CVE-2007-3374) Users of Cluster Manager should upgrade to these updated packages, which contain a backported patch to correct this issue. Solution Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 Updated packages RHEL Desktop Workstation (v. 5 client) -------------------------------------------------------------------------------- SRPMS: cman-2.0.64-1.0.1.el5.src.rpm 1fcc797abeb94c5822f21ad4a851aab2 IA-32: cman-2.0.64-1.0.1.el5.i386.rpm fae8fdb3d0ce291b73e386013273e58e cman-devel-2.0.64-1.0.1.el5.i386.rpm 14b0724782b621886026c0cd342ba733 x86_64: cman-2.0.64-1.0.1.el5.x86_64.rpm de0045b6cf4b0b1965a06ae63272252e cman-devel-2.0.64-1.0.1.el5.i386.rpm 14b0724782b621886026c0cd342ba733 cman-devel-2.0.64-1.0.1.el5.x86_64.rpm 0310e2f5055a9e5b7fbb35dfdfa6f8bb Red Hat Enterprise Linux (v. 5 server) -------------------------------------------------------------------------------- SRPMS: cman-2.0.64-1.0.1.el5.src.rpm 1fcc797abeb94c5822f21ad4a851aab2 IA-32: cman-2.0.64-1.0.1.el5.i386.rpm fae8fdb3d0ce291b73e386013273e58e cman-devel-2.0.64-1.0.1.el5.i386.rpm 14b0724782b621886026c0cd342ba733 IA-64: cman-2.0.64-1.0.1.el5.ia64.rpm 9774f665b8af6b784660348b5b6dab64 cman-devel-2.0.64-1.0.1.el5.ia64.rpm bddaad0ff171cb92671d157309e44e7b PPC: cman-2.0.64-1.0.1.el5.ppc.rpm a89444882d12337cb6cb3a8a328f5c9b cman-devel-2.0.64-1.0.1.el5.ppc.rpm e9df7cfc0ed760455867b7a454f15beb cman-devel-2.0.64-1.0.1.el5.ppc64.rpm 1e035386019255d5e24724230d99dcbd s390x: cman-2.0.64-1.0.1.el5.s390x.rpm dd30779b292d16e80f6430ded4420cba cman-devel-2.0.64-1.0.1.el5.s390.rpm d7d6b697e58cf728a22d401155571d7a cman-devel-2.0.64-1.0.1.el5.s390x.rpm 8d7665f0a81ffa094d145ace6bec2218 x86_64: cman-2.0.64-1.0.1.el5.x86_64.rpm de0045b6cf4b0b1965a06ae63272252e cman-devel-2.0.64-1.0.1.el5.i386.rpm 14b0724782b621886026c0cd342ba733 cman-devel-2.0.64-1.0.1.el5.x86_64.rpm 0310e2f5055a9e5b7fbb35dfdfa6f8bb (The unlinked packages above are only available from the Red Hat Network) Bugs fixed (see bugzilla for more information) 244891 - CVE-2007-3374 possible buffer overflow could cause local DoS by crashing cman References http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3374 http://www.redhat.com/security/updates/classification/#important -------------------------------------------------------------------------------- These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from: https://www.redhat.com/security/team/key/#package The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/ [***** End Red Hat RHSA:2007-0559-2 *****] _______________________________________________________________________________ CIAC wishes to acknowledge the contributions of Red Hat for the information contained in this bulletin. _______________________________________________________________________________ CIAC, the Computer Incident Advisory Capability, is the computer security incident response team for the U.S. Department of Energy (DOE) and the emergency backup response team for the National Institutes of Health (NIH). CIAC is located at the Lawrence Livermore National Laboratory in Livermore, California. CIAC is also a founding member of FIRST, the Forum of Incident Response and Security Teams, a global organization established to foster cooperation and coordination among computer security teams worldwide. CIAC services are available to DOE, DOE contractors, and the NIH. CIAC can be contacted at: Voice: +1 925-422-8193 (7x24) FAX: +1 925-423-8002 STU-III: +1 925-423-2604 E-mail: ciac@ciac.org Previous CIAC notices, anti-virus software, and other information are available from the CIAC Computer Security Archive. World Wide Web: http://www.ciac.org/ Anonymous FTP: ftp.ciac.org PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing communities receive CIAC bulletins. If you are not part of these communities, please contact your agency's response team to report incidents. Your agency's team will coordinate with CIAC. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained via WWW at http://www.first.org/. This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes. LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC) R-280: MPlayer Vulnerability R-281: Apple Security Update 2007-006 R-282: libphp-phpmailer Security Vulnerability R-283: HP Help and Support Center Running on HP Notebook Computers VUlnerability R-284: Cerulean Studios Trillian Instant Messenger Vulnerability R-285: ClamAV R-286: 602pro Lan Suite 2003 Vulnerability R-287: kadmin Vulnerable R-288: RealNetworks Players SMIL "Wallclock" Vulnerability R-289: dtsession(1X) Contains a Buffer Overflow Vulnerability