PT-2009-2030 · Red Hat · Cman - The Cluster Manager

Tomas Hoger · Published 2009-03-31 · Updated 2017-08-17 · CVE-2008-6560

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions CMAN - The Cluster Manager versions prior to 2.03.09-1

Description A buffer overflow issue exists, allowing attackers to cause a denial of service through CPU consumption and memory corruption by using a cluster.conf file with many lines. It is unclear whether this issue can cross privilege boundaries in realistic uses of the product.

Recommendations For CMAN - The Cluster Manager versions prior to 2.03.09-1, update to version 2.03.09-1 or later to resolve the issue. As a temporary workaround, consider restricting access to the cluster.conf file to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2008-6560

Affected Products

Cman - The Cluster Manager

References · 8

• https://bugzilla.redhat.com/show_bug.cgi?id=468966 · Vendor Advisory
• http://redhat.com/archives/fedora-package-announce/2008-November/msg00163.html · Vendor Advisory
• http://ubuntu.com/usn/USN-875-1 · Vendor Advisory
• http://redhat.com/archives/fedora-package-announce/2008-November/msg00164.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-6560 · Security Note
• http://redhat.com/archives/fedora-package-announce/2008-November/msg00165.html · Vendor Advisory
• http://git.fedorahosted.org/git/cluster.git?p=cluster.git%3Ba=commitdiff%3Bh=67fee9128e54c6c3fc3eae306b5b501f3029c3be · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49832 · Note