ID CVE-2010-3389
Summary The (1) SAPDatabase and (2) SAPInstance scripts in OCF Resource Agents (aka resource-agents or cluster-agents) 1.0.3 in Linux-HA place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
References
Vulnerable Configurations
  • cpe:2.3:a:linux-ha:ocf_resource_agents:1.0.3
    cpe:2.3:a:linux-ha:ocf_resource_agents:1.0.3
CVSS
Base: 6.9 (as of 21-10-2010 - 14:33)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
LOCAL MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
nessus via4
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20110721_RGMANAGER_ON_SL5_X.NASL
    description The rgmanager package contains the Resource Group Manager, which provides the ability to create and manage high-availability server applications in the event of system downtime. It was discovered that certain resource agent scripts set the LD_LIBRARY_PATH environment variable to an insecure value containing empty path elements. A local user able to trick a user running those scripts to run them while working from an attacker-writable directory could use this flaw to escalate their privileges via a specially crafted dynamic library. (CVE-2010-3389) This update also fixes the following bugs : - The failover domain 'nofailback' option was not honored if a service was in the 'starting' state. This bug has been fixed. - PID files with white spaces in the file name are now handled correctly. - The /usr/sbin/rhev-check.sh script can now be used from within Cron. - The clustat utility now reports the correct version. - The oracledb.sh agent now attempts to try the 'shutdown immediate' command instead of using the 'shutdown abort' command. - The SAPInstance and SAPDatabase scripts now use proper directory name quoting so they no longer collide with directory names like '/u'. - The clufindhostname utility now returns the correct value in all cases. - The nfsclient resource agent now handles paths with trailing slashes correctly. - The last owner of a service is now reported correctly after a failover. - The /usr/share/cluster/fs.sh script no longer runs the 'quotaoff' command if quotas were not configured. - The 'listen' line in the /etc/httpd/conf/httpd.conf file generated by the Apache resource agent is now correct. - The tomcat-5 resource agent no longer generates incorrect configurations. - The time required to stop an NFS resource when the server is unavailable has been reduced. - When using exclusive prioritization, a higher priority service now preempts a lower priority service after status check failures. - The postgres-8 resource agent now correctly detects failed start operations. - The handling of reference counts passed by rgmanager to resource agents now works properly, as expected. As well, this update adds the following enhancements : - It is now possible to disable updates to static routes by the IP resource agent. - It is now possible to use XFS as a file system within a cluster service. - It is now possible to use the 'clustat' command as a non-root user, so long as that user is in the 'root' group. - It is now possible to migrate virtual machines when central processing is enabled. - The rgmanager init script will now delay after stopping services in order to allow time for other nodes to restart them. - The handling of failed independent subtrees has been corrected. All users of Resource Group Manager are advised to upgrade to this updated package, which contains backported patches to correct these issues and add these enhancements.
    last seen 2019-02-21
    modified 2018-12-31
    plugin id 61091
    published 2012-08-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=61091
    title Scientific Linux Security Update : rgmanager on SL5.x i386/x86_64
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201110-18.NASL
    description The remote host is affected by the vulnerability described in GLSA-201110-18 (rgmanager: Privilege escalation) A vulnerability has been discovered in rgmanager. Please review the CVE identifier referenced below for details. Impact : A local attacker could gain escalated privileges. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-07-11
    plugin id 56593
    published 2011-10-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=56593
    title GLSA-201110-18 : rgmanager: Privilege escalation
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2011-1000.NASL
    description An updated rgmanager package that fixes one security issue, several bugs, and adds multiple enhancements is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The rgmanager package contains the Red Hat Resource Group Manager, which provides the ability to create and manage high-availability server applications in the event of system downtime. It was discovered that certain resource agent scripts set the LD_LIBRARY_PATH environment variable to an insecure value containing empty path elements. A local user able to trick a user running those scripts to run them while working from an attacker-writable directory could use this flaw to escalate their privileges via a specially crafted dynamic library. (CVE-2010-3389) Red Hat would like to thank Raphael Geissert for reporting this issue. This update also fixes the following bugs : * The failover domain 'nofailback' option was not honored if a service was in the 'starting' state. This bug has been fixed. (BZ#669440) * PID files with white spaces in the file name are now handled correctly. (BZ#632704) * The /usr/sbin/rhev-check.sh script can now be used from within Cron. (BZ#634225) * The clustat utility now reports the correct version. (BZ#654160) * The oracledb.sh agent now attempts to try the 'shutdown immediate' command instead of using the 'shutdown abort' command. (BZ#633992) * The SAPInstance and SAPDatabase scripts now use proper directory name quoting so they no longer collide with directory names like '/u'. (BZ#637154) * The clufindhostname utility now returns the correct value in all cases. (BZ#592613) * The nfsclient resource agent now handles paths with trailing slashes correctly. (BZ#592624) * The last owner of a service is now reported correctly after a failover. (BZ#610483) * The /usr/share/cluster/fs.sh script no longer runs the 'quotaoff' command if quotas were not configured. (BZ#637678) * The 'listen' line in the /etc/httpd/conf/httpd.conf file generated by the Apache resource agent is now correct. (BZ#675739) * The tomcat-5 resource agent no longer generates incorrect configurations. (BZ#637802) * The time required to stop an NFS resource when the server is unavailable has been reduced. (BZ#678494) * When using exclusive prioritization, a higher priority service now preempts a lower priority service after status check failures. (BZ#680256) * The postgres-8 resource agent now correctly detects failed start operations. (BZ#663827) * The handling of reference counts passed by rgmanager to resource agents now works properly, as expected. (BZ#692771) As well, this update adds the following enhancements : * It is now possible to disable updates to static routes by the IP resource agent. (BZ#620700) * It is now possible to use XFS as a file system within a cluster service. (BZ#661893) * It is now possible to use the 'clustat' command as a non-root user, so long as that user is in the 'root' group. (BZ#510300) * It is now possible to migrate virtual machines when central processing is enabled. (BZ#525271) * The rgmanager init script will now delay after stopping services in order to allow time for other nodes to restart them. (BZ#619468) * The handling of failed independent subtrees has been corrected. (BZ#711521) All users of Red Hat Resource Group Manager are advised to upgrade to this updated package, which contains backported patches to correct these issues and add these enhancements.
    last seen 2019-02-21
    modified 2018-12-20
    plugin id 56262
    published 2011-09-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=56262
    title CentOS 5 : rgmanager (CESA-2011:1000)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20111206_RESOURCE_AGENTS_ON_SL6_X.NASL
    description The resource-agents package contains a set of scripts to interface with several services to operate in a High Availability environment for both Pacemaker and rgmanager service managers. It was discovered that certain resource agent scripts set the LD_LIBRARY_PATH environment variable to an insecure value containing empty path elements. A local user able to trick a user running those scripts to run them while working from an attacker-writable directory could use this flaw to escalate their privileges via a specially crafted dynamic library. (CVE-2010-3389) This update also fixes the following bugs : - When using the Sybase database and the ASEHAagent resource in the cluster.conf file, it was not possible to run more than one ASEHAagent per Sybase installation. Consequently, a second ASEHA (Sybase Adaptive Server Enterprise (ASE) with the High Availability Option) agent could not be run. This bug has been fixed and it is now possible to use two ASEHA agents using the same Sybase installation. - The s/lang scripts, which implement internal functionality for the rgmanager package, while the central_processing option is in use, were included in the wrong package. Now, the rgmanager and resource-agents packages require each other for installation to prevent problems when they are used separately. - Previously, the oracledb.sh script was using the 'shutdown abort' command as the first attempt to shut down a database. With this update, oracledb.sh first attempts a graceful shutdown via the 'shutdown immediate' command before forcing the shutdown. - Previously, when setting up a service on a cluster with a shared IP resource and an Apache resource, the generated httpd.conf file contained a bug in the line describing the shared IP address (the 'Listen' line). Now, the Apache resource agent generates the 'Listen' line properly. - If a high-availability (HA) cluster service was defined with an Apache resource and was named with two words, such as 'kickstart httpd', the service never started because it could not find a directory with the space character in its name escaped. Now, Apache resources work properly if a name contains a space as described above. - When inheritance was used in the cluster.conf file, a bug in the /usr/share/cluster/nfsclient.sh file prevented it from monitoring NFS exports properly. Consequently, monitoring of NFS exports to NFS clients resulted in an endless loop. This bug has been fixed and the monitoring now works as expected. - Previously, the postgres-8 resource agent did not detect when a PostgreSQL server failed to start. This bug has been fixed and postgres-8 now works as expected in the described scenario. - When using the Pacemaker resource manager, the fs.sh resource agent reported an error condition, if called with the 'monitor' parameter and the referenced device did not exist. Consequently, the error condition prevented the resource from being started. Now, fs.sh returns the proper response code in the described scenario, thus fixing this bug. - Previously, numerous RGManager resource agents returned incorrect response codes when coupled with the Pacemaker resource manager. Now, the agents have been updated to work with Pacemaker properly. This update also adds the following enhancement : - With this update, when the network is removed from a node using the netfs.sh resource agent, it now recovers faster than previously. As well, this update upgrades the resource-agents package to upstream version 3.9.2, which provides a number of bug fixes and enhancements over the previous version. All users of resource-agents are advised to upgrade to this updated package, which corrects these issues and adds these enhancements.
    last seen 2019-02-21
    modified 2018-12-31
    plugin id 61196
    published 2012-08-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=61196
    title Scientific Linux Security Update : resource-agents on SL6.x i386/x86_64
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2011-1000.NASL
    description An updated rgmanager package that fixes one security issue, several bugs, and adds multiple enhancements is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The rgmanager package contains the Red Hat Resource Group Manager, which provides the ability to create and manage high-availability server applications in the event of system downtime. It was discovered that certain resource agent scripts set the LD_LIBRARY_PATH environment variable to an insecure value containing empty path elements. A local user able to trick a user running those scripts to run them while working from an attacker-writable directory could use this flaw to escalate their privileges via a specially crafted dynamic library. (CVE-2010-3389) Red Hat would like to thank Raphael Geissert for reporting this issue. This update also fixes the following bugs : * The failover domain 'nofailback' option was not honored if a service was in the 'starting' state. This bug has been fixed. (BZ#669440) * PID files with white spaces in the file name are now handled correctly. (BZ#632704) * The /usr/sbin/rhev-check.sh script can now be used from within Cron. (BZ#634225) * The clustat utility now reports the correct version. (BZ#654160) * The oracledb.sh agent now attempts to try the 'shutdown immediate' command instead of using the 'shutdown abort' command. (BZ#633992) * The SAPInstance and SAPDatabase scripts now use proper directory name quoting so they no longer collide with directory names like '/u'. (BZ#637154) * The clufindhostname utility now returns the correct value in all cases. (BZ#592613) * The nfsclient resource agent now handles paths with trailing slashes correctly. (BZ#592624) * The last owner of a service is now reported correctly after a failover. (BZ#610483) * The /usr/share/cluster/fs.sh script no longer runs the 'quotaoff' command if quotas were not configured. (BZ#637678) * The 'listen' line in the /etc/httpd/conf/httpd.conf file generated by the Apache resource agent is now correct. (BZ#675739) * The tomcat-5 resource agent no longer generates incorrect configurations. (BZ#637802) * The time required to stop an NFS resource when the server is unavailable has been reduced. (BZ#678494) * When using exclusive prioritization, a higher priority service now preempts a lower priority service after status check failures. (BZ#680256) * The postgres-8 resource agent now correctly detects failed start operations. (BZ#663827) * The handling of reference counts passed by rgmanager to resource agents now works properly, as expected. (BZ#692771) As well, this update adds the following enhancements : * It is now possible to disable updates to static routes by the IP resource agent. (BZ#620700) * It is now possible to use XFS as a file system within a cluster service. (BZ#661893) * It is now possible to use the 'clustat' command as a non-root user, so long as that user is in the 'root' group. (BZ#510300) * It is now possible to migrate virtual machines when central processing is enabled. (BZ#525271) * The rgmanager init script will now delay after stopping services in order to allow time for other nodes to restart them. (BZ#619468) * The handling of failed independent subtrees has been corrected. (BZ#711521) All users of Red Hat Resource Group Manager are advised to upgrade to this updated package, which contains backported patches to correct these issues and add these enhancements.
    last seen 2019-02-21
    modified 2018-07-25
    plugin id 63992
    published 2013-01-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=63992
    title RHEL 5 : rgmanager (RHSA-2011:1000)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2011-1580.NASL
    description An updated resource-agents package that fixes one security issue, several bugs, and adds multiple enhancements is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The resource-agents package contains a set of scripts to interface with several services to operate in a High Availability environment for both Pacemaker and rgmanager service managers. It was discovered that certain resource agent scripts set the LD_LIBRARY_PATH environment variable to an insecure value containing empty path elements. A local user able to trick a user running those scripts to run them while working from an attacker-writable directory could use this flaw to escalate their privileges via a specially crafted dynamic library. (CVE-2010-3389) Red Hat would like to thank Raphael Geissert for reporting this issue. This update also fixes the following bugs : * When using the Sybase database and the ASEHAagent resource in the cluster.conf file, it was not possible to run more than one ASEHAagent per Sybase installation. Consequently, a second ASEHA (Sybase Adaptive Server Enterprise (ASE) with the High Availability Option) agent could not be run. This bug has been fixed and it is now possible to use two ASEHA agents using the same Sybase installation. (BZ#711852) * The s/lang scripts, which implement internal functionality for the rgmanager package, while the central_processing option is in use, were included in the wrong package. Now, the rgmanager and resource-agents packages require each other for installation to prevent problems when they are used separately. (BZ#693518) * Previously, the oracledb.sh script was using the 'shutdown abort' command as the first attempt to shut down a database. With this update, oracledb.sh first attempts a graceful shutdown via the 'shutdown immediate' command before forcing the shutdown. (BZ#689801) * Previously, when setting up a service on a cluster with a shared IP resource and an Apache resource, the generated httpd.conf file contained a bug in the line describing the shared IP address (the 'Listen' line). Now, the Apache resource agent generates the 'Listen' line properly. (BZ#667217) * If a high-availability (HA) cluster service was defined with an Apache resource and was named with two words, such as 'kickstart httpd', the service never started because it could not find a directory with the space character in its name escaped. Now, Apache resources work properly if a name contains a space as described above. (BZ#667222) * When inheritance was used in the cluster.conf file, a bug in the /usr/share/cluster/nfsclient.sh file prevented it from monitoring NFS exports properly. Consequently, monitoring of NFS exports to NFS clients resulted in an endless loop. This bug has been fixed and the monitoring now works as expected. (BZ#691814) * Previously, the postgres-8 resource agent did not detect when a PostgreSQL server failed to start. This bug has been fixed and postgres-8 now works as expected in the described scenario. (BZ#694816) * When using the Pacemaker resource manager, the fs.sh resource agent reported an error condition, if called with the 'monitor' parameter and the referenced device did not exist. Consequently, the error condition prevented the resource from being started. Now, fs.sh returns the proper response code in the described scenario, thus fixing this bug. (BZ#709400) * Previously, numerous RGManager resource agents returned incorrect response codes when coupled with the Pacemaker resource manager. Now, the agents have been updated to work with Pacemaker properly. (BZ#727643) This update also adds the following enhancement : * With this update, when the network is removed from a node using the netfs.sh resource agent, it now recovers faster than previously. (BZ#678497) As well, this update upgrades the resource-agents package to upstream version 3.9.2, which provides a number of bug fixes and enhancements over the previous version. (BZ#707127) All users of resource-agents are advised to upgrade to this updated package, which corrects these issues and adds these enhancements.
    last seen 2019-02-21
    modified 2018-11-26
    plugin id 64007
    published 2013-01-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=64007
    title RHEL 6 : resource-agents (RHSA-2011:1580)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201412-09.NASL
    description The remote host is affected by the vulnerability described in GLSA-201412-09 (Multiple packages, Multiple vulnerabilities fixed in 2011) Vulnerabilities have been discovered in the packages listed below. Please review the CVE identifiers in the Reference section for details. FMOD Studio PEAR Mail LVM2 GnuCash xine-lib Last.fm Scrobbler WebKitGTK+ shadow tool suite PEAR unixODBC Resource Agents mrouted rsync XML Security Library xrdb Vino OProfile syslog-ng sFlow Toolkit GNOME Display Manager libsoup CA Certificates Gitolite QtCreator Racer Impact : A context-dependent attacker may be able to gain escalated privileges, execute arbitrary code, cause Denial of Service, obtain sensitive information, or otherwise bypass security restrictions. Workaround : There are no known workarounds at this time.
    last seen 2019-02-21
    modified 2017-04-15
    plugin id 79962
    published 2014-12-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79962
    title GLSA-201412-09 : Multiple packages, Multiple vulnerabilities fixed in 2011
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20110216_RGMANAGER_ON_SL4_X.NASL
    description Multiple insecure temporary file use flaws were discovered in rgmanager and various resource scripts run by rgmanager. A local attacker could use these flaws to overwrite an arbitrary file writable by the rgmanager process (i.e. user root) with the output of rgmanager or a resource agent via a symbolic link attack. (CVE-2008-6552) It was discovered that certain resource agent scripts set the LD_LIBRARY_PATH environment variable to an insecure value containing empty path elements. A local user able to trick a user running those scripts to run them while working from an attacker-writable directory could use this flaw to escalate their privileges via a specially crafted dynamic library. (CVE-2010-3389) This update also fixes the following bugs : - Previously, starting threads could incorrectly include a reference to an exited thread if that thread exited when rgmanager received a request to start a new thread. Due to this issue, the new thread did not retry and entered an infinite loop. This update ensures that new threads do not reference old threads. Now, new threads no longer enter an infinite loop in which the rgmanager enables and disables services without failing gracefully. (BZ#502872) - Previously, nfsclient.sh left temporary nfsclient-status-cache-$$ files in /tmp/. (BZ#506152) - Previously, the function local_node_name in /resources/utils/member_util.sh did not correctly check whether magma_tool failed. Due to this issue, empty strings could be returned. This update checks the input and rejects empty strings. (BZ#516758) - Previously, the file system agent could kill a process when an application used a mount point with a similar name to a mount point managed by rgmanager using force_unmount. With this update, the file system agent kills only the processes that access the mount point managed by rgmanager. (BZ#555901) - Previously, simultaneous execution of 'lvchange --deltag' from /etc/init.d/rgmanager caused a checksum error on High Availability Logical Volume Manager (HA-LVM). With this update, ownership of LVM tags is checked before removing them. (BZ#559582) - Previously, the isAlive check could fail if two nodes used the same file name. With this update, the isAlive function prevents two nodes from using the same file name. (BZ#469815) - Previously, the S/Lang code could lead to unwanted S/Lang stack leaks during event processing. (BZ#507430)
    last seen 2019-02-21
    modified 2018-12-31
    plugin id 60961
    published 2012-08-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=60961
    title Scientific Linux Security Update : rgmanager on SL4.x i386/x86_64
redhat via4
advisories
  • bugzilla
    id 711521
    title Dependencies in independent_tree resources does not work as expected
    oval
    AND
    • comment Red Hat Enterprise Linux 5 is installed
      oval oval:com.redhat.rhsa:tst:20070055001
    • comment rgmanager is earlier than 0:2.0.52-21.el5
      oval oval:com.redhat.rhsa:tst:20111000002
    • comment rgmanager is signed with Red Hat redhatrelease key
      oval oval:com.redhat.rhsa:tst:20091339003
    rhsa
    id RHSA-2011:1000
    released 2011-07-21
    severity Low
    title RHSA-2011:1000: rgmanager security, bug fix, and enhancement update (Low)
  • bugzilla
    id 727643
    title Modify major resource-agent agents to provide proper return codes to pacemaker
    oval
    AND
    • comment resource-agents is earlier than 0:3.9.2-7.el6
      oval oval:com.redhat.rhsa:tst:20111580005
    • comment resource-agents is signed with Red Hat redhatrelease2 key
      oval oval:com.redhat.rhsa:tst:20111580006
    • OR
      • comment Red Hat Enterprise Linux 6 Client is installed
        oval oval:com.redhat.rhsa:tst:20100842001
      • comment Red Hat Enterprise Linux 6 Server is installed
        oval oval:com.redhat.rhsa:tst:20100842002
      • comment Red Hat Enterprise Linux 6 Workstation is installed
        oval oval:com.redhat.rhsa:tst:20100842003
      • comment Red Hat Enterprise Linux 6 ComputeNode is installed
        oval oval:com.redhat.rhsa:tst:20100842004
    rhsa
    id RHSA-2011:1580
    released 2011-12-06
    severity Low
    title RHSA-2011:1580: resource-agents security, bug fix, and enhancement update (Low)
  • rhsa
    id RHSA-2011:0264
rpms
  • rgmanager-0:2.0.52-21.el5
  • resource-agents-0:3.9.2-7.el6
refmap via4
confirm
gentoo GLSA-201110-18
secunia 43372
vupen ADV-2011-0416
Last major update 01-02-2012 - 22:58
Published 20-10-2010 - 14:00
Back to Top