PT-2009-2030 · Red Hat · Cman - The Cluster Manager

Tomas Hoger · Publicado 2009-03-31 · Atualizado 2017-08-17 · CVE-2008-6560

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions CMAN - The Cluster Manager versions prior to 2.03.09-1

Description A buffer overflow issue exists, allowing attackers to cause a denial of service through CPU consumption and memory corruption by using a cluster.conf file with many lines. It is unclear whether this issue can cross privilege boundaries in realistic uses of the product.

Recommendations For CMAN - The Cluster Manager versions prior to 2.03.09-1, update to version 2.03.09-1 or later to resolve the issue. As a temporary workaround, consider restricting access to the cluster.conf file to minimize the risk of exploitation.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2008-6560

Produtos afetados

Cman - The Cluster Manager

Referências · 8

• https://bugzilla.redhat.com/show_bug.cgi?id=468966 · Aviso do Fabricante
• http://git.fedorahosted.org/git/cluster.git?p=cluster.git%3Ba=commitdiff%3Bh=67fee9128e54c6c3fc3eae306b5b501f3029c3be · Nota
• http://redhat.com/archives/fedora-package-announce/2008-November/msg00163.html · Aviso do Fabricante
• http://ubuntu.com/usn/USN-875-1 · Aviso do Fabricante
• http://redhat.com/archives/fedora-package-announce/2008-November/msg00164.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-6560 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49832 · Nota
• http://redhat.com/archives/fedora-package-announce/2008-November/msg00165.html · Aviso do Fabricante