PT-2009-2022 · Red Hat · Red Hat Cluster Project+4

Published 2009-03-30 · Updated 2017-09-29 · CVE-2008-6552

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Red Hat Cluster Project versions 2.x Resource Group Manager (rgmanager) versions prior to 2.03.09-1 gfs2-utils versions prior to 2.03.09-1 CMAN - The Cluster Manager versions prior to 2.03.09-1

Description The issue allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp. This involves unspecified components in the affected software.

Recommendations For Red Hat Cluster Project version 2.x, update to a version later than 2.x. For Resource Group Manager (rgmanager) version prior to 2.03.09-1, update to version 2.03.09-1 or later. For gfs2-utils version prior to 2.03.09-1, update to version 2.03.09-1 or later. For CMAN - The Cluster Manager version prior to 2.03.09-1, update to version 2.03.09-1 or later.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2008-6552

RHSA-2009:1337

RHSA-2009:1339

RHSA-2009:1341

RHSA-2009_1337

RHSA-2009_1339

RHSA-2009_1341

RHSA-2011:0264

RHSA-2011:0265

Affected Products

Cman - The Cluster Manager

Red Hat

Red Hat Cluster Project

Resource Group Manager

Gfs2-Utils

References · 29

• http://redhat.com/support/errata/RHSA-2009-1339.html · Vendor Advisory
• http://ubuntu.com/usn/USN-875-1 · Vendor Advisory
• http://redhat.com/archives/fedora-package-announce/2008-November/msg00164.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2011-0264.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2009-1341.html · Vendor Advisory
• http://redhat.com/archives/fedora-package-announce/2008-November/msg00165.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-6552 · Security Note
• http://redhat.com/archives/fedora-package-announce/2008-November/msg00163.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2011-0265.html · Vendor Advisory
• http://secunia.com/advisories/32602 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2009-1337.html · Vendor Advisory
• http://secunia.com/advisories/43372 · Note
• https://access.redhat.com/security/cve/CVE-2008-4579 · Note
• http://secunia.com/advisories/32616 · Note
• https://access.redhat.com/errata/RHSA-2009:1341 · Note