Issued:
2011-02-16
Updated:
2011-02-16

RHSA-2011:0264 - Low: rgmanager security and bug fix update

Synopsis

Low: rgmanager security and bug fix update

Type/Severity

Security Advisory Low

Topic

An updated rgmanager package that fixes multiple security issues and several bugs is now available for Red Hat Cluster Suite 4.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Description

The rgmanager package contains the Red Hat Resource Group Manager, which provides high availability for critical server applications.

Multiple insecure temporary file use flaws were discovered in rgmanager and various resource scripts run by rgmanager. A local attacker could use these flaws to overwrite an arbitrary file writable by the rgmanager process (i.e. user root) with the output of rgmanager or a resource agent via a symbolic link attack. (CVE-2008-6552)

It was discovered that certain resource agent scripts set the LD_LIBRARY_PATH environment variable to an insecure value containing empty path elements. A local user able to trick a user running those scripts to run them while working from an attacker-writable directory could use this flaw to escalate their privileges via a specially-crafted dynamic library. (CVE-2010-3389)

Red Hat would like to thank Raphael Geissert for reporting the CVE-2010-3389 issue.

This update also fixes the following bugs:

  • Previously, starting threads could incorrectly include a reference to an exited thread if that thread exited when rgmanager received a request to start a new thread. Due to this issue, the new thread did not retry and entered an infinite loop. This update ensures that new threads do not reference old threads. Now, new threads no longer enter an infinite loop in which the rgmanager enables and disables services without failing gracefully. (BZ#502872)

  • Previously, nfsclient.sh left temporary nfsclient-status-cache-$$ files in /tmp/. (BZ#506152)

  • Previously, the function local_node_name in /resources/utils/member_util.sh did not correctly check whether magma_tool failed. Due to this issue, empty strings could be returned. This update checks the input and rejects empty strings. (BZ#516758)

  • Previously, the file system agent could kill a process when an application used a mount point with a similar name to a mount point managed by rgmanager using force_unmount. With this update, the file system agent kills only the processes that access the mount point managed by rgmanager. (BZ#555901)

  • Previously, simultaneous execution of "lvchange --deltag" from /etc/init.d/rgmanager caused a checksum error on High Availability Logical Volume Manager (HA-LVM). With this update, ownership of LVM tags is checked before removing them. (BZ#559582)

  • Previously, the isAlive check could fail if two nodes used the same file name. With this update, the isAlive function prevents two nodes from using the same file name. (BZ#469815)

  • Previously, the S/Lang code could lead to unwanted S/Lang stack leaks during event processing. (BZ#507430)

All users of rgmanager are advised to upgrade to this updated package, which corrects these issues.

Solution

Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at This content is not included.http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

ProductVersionArch
Red Hat Enterprise Linux High Availability for x86_644x86_64
Red Hat Enterprise Linux High Availability for x86_644ppc
Red Hat Enterprise Linux High Availability for x86_644ia64
Red Hat Enterprise Linux High Availability for x86_644i386

Updated Packages

  • rgmanager-1.9.88-2.el4.i386.rpm

Fixes

CVEs

References

Additional information