Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2008-6552 (GCVE-0-2008-6552)
Vulnerability from cvelistv5
Published
2009-03-30 16:00
Modified
2024-08-07 11:34
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T11:34:47.139Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "32616",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/32616"
},
{
"name": "ADV-2011-0416",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2011/0416"
},
{
"name": "RHSA-2009:1341",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://www.redhat.com/support/errata/RHSA-2009-1341.html"
},
{
"name": "RHSA-2011:0264",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://www.redhat.com/support/errata/RHSA-2011-0264.html"
},
{
"name": "36555",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/36555"
},
{
"name": "32179",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/32179"
},
{
"name": "FEDORA-2008-9458",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00163.html"
},
{
"name": "ADV-2011-0417",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2011/0417"
},
{
"name": "32602",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/32602"
},
{
"name": "43372",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/43372"
},
{
"name": "USN-875-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-875-1"
},
{
"name": "oval:org.mitre.oval:def:11404",
"tags": [
"vdb-entry",
"signature",
"x_refsource_OVAL",
"x_transferred"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11404"
},
{
"name": "FEDORA-2008-9458",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00165.html"
},
{
"name": "50300",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/50300"
},
{
"name": "RHSA-2009:1337",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2009-1337.html"
},
{
"name": "RHSA-2011:0265",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://www.redhat.com/support/errata/RHSA-2011-0265.html"
},
{
"name": "43367",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/43367"
},
{
"name": "FEDORA-2008-9458",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00164.html"
},
{
"name": "clusterproject-unspecified-priv-escalation(46412)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46412"
},
{
"name": "36530",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/36530"
},
{
"name": "50301",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/50301"
},
{
"name": "RHSA-2009:1339",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://www.redhat.com/support/errata/RHSA-2009-1339.html"
},
{
"name": "50299",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/50299"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-11-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "32616",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/32616"
},
{
"name": "ADV-2011-0416",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2011/0416"
},
{
"name": "RHSA-2009:1341",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://www.redhat.com/support/errata/RHSA-2009-1341.html"
},
{
"name": "RHSA-2011:0264",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://www.redhat.com/support/errata/RHSA-2011-0264.html"
},
{
"name": "36555",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/36555"
},
{
"name": "32179",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/32179"
},
{
"name": "FEDORA-2008-9458",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00163.html"
},
{
"name": "ADV-2011-0417",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2011/0417"
},
{
"name": "32602",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/32602"
},
{
"name": "43372",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/43372"
},
{
"name": "USN-875-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-875-1"
},
{
"name": "oval:org.mitre.oval:def:11404",
"tags": [
"vdb-entry",
"signature",
"x_refsource_OVAL"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11404"
},
{
"name": "FEDORA-2008-9458",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00165.html"
},
{
"name": "50300",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/50300"
},
{
"name": "RHSA-2009:1337",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2009-1337.html"
},
{
"name": "RHSA-2011:0265",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://www.redhat.com/support/errata/RHSA-2011-0265.html"
},
{
"name": "43367",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/43367"
},
{
"name": "FEDORA-2008-9458",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00164.html"
},
{
"name": "clusterproject-unspecified-priv-escalation(46412)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46412"
},
{
"name": "36530",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/36530"
},
{
"name": "50301",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/50301"
},
{
"name": "RHSA-2009:1339",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://www.redhat.com/support/errata/RHSA-2009-1339.html"
},
{
"name": "50299",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/50299"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-6552",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "32616",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/32616"
},
{
"name": "ADV-2011-0416",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2011/0416"
},
{
"name": "RHSA-2009:1341",
"refsource": "REDHAT",
"url": "http://www.redhat.com/support/errata/RHSA-2009-1341.html"
},
{
"name": "RHSA-2011:0264",
"refsource": "REDHAT",
"url": "http://www.redhat.com/support/errata/RHSA-2011-0264.html"
},
{
"name": "36555",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/36555"
},
{
"name": "32179",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/32179"
},
{
"name": "FEDORA-2008-9458",
"refsource": "FEDORA",
"url": "http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00163.html"
},
{
"name": "ADV-2011-0417",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2011/0417"
},
{
"name": "32602",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/32602"
},
{
"name": "43372",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/43372"
},
{
"name": "USN-875-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-875-1"
},
{
"name": "oval:org.mitre.oval:def:11404",
"refsource": "OVAL",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11404"
},
{
"name": "FEDORA-2008-9458",
"refsource": "FEDORA",
"url": "http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00165.html"
},
{
"name": "50300",
"refsource": "OSVDB",
"url": "http://osvdb.org/50300"
},
{
"name": "RHSA-2009:1337",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2009-1337.html"
},
{
"name": "RHSA-2011:0265",
"refsource": "REDHAT",
"url": "http://www.redhat.com/support/errata/RHSA-2011-0265.html"
},
{
"name": "43367",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/43367"
},
{
"name": "FEDORA-2008-9458",
"refsource": "FEDORA",
"url": "http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00164.html"
},
{
"name": "clusterproject-unspecified-priv-escalation(46412)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46412"
},
{
"name": "36530",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/36530"
},
{
"name": "50301",
"refsource": "OSVDB",
"url": "http://osvdb.org/50301"
},
{
"name": "RHSA-2009:1339",
"refsource": "REDHAT",
"url": "http://www.redhat.com/support/errata/RHSA-2009-1339.html"
},
{
"name": "50299",
"refsource": "OSVDB",
"url": "http://osvdb.org/50299"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-6552",
"datePublished": "2009-03-30T16:00:00",
"dateReserved": "2009-03-30T00:00:00",
"dateUpdated": "2024-08-07T11:34:47.139Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2008-6552\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2009-03-30T16:30:00.313\",\"lastModified\":\"2025-04-09T00:30:58.490\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9.\"},{\"lang\":\"es\",\"value\":\"Red Hat Cluster Project v2.x permite a usuarios locales modificar o sobrescribir ficheros de su elecci\u00f3n mediante ataques de enlaces simb\u00f3licos a ficheros en /tmp, implicando componentes no especificados en Resource Group Manager (tambi\u00e9n conocido como rgmanager) versiones anteriores a v2.03.09-1, en gfs2-utils versiones anteriore a v2.03.09-1, y en CMAN - The Cluster Manager versiones anteriores a v2.03.09-1 para Fedora 9.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:M/Au:N/C:C/I:C/A:C\",\"baseScore\":6.9,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":3.4,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-59\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cluster_project:2.00.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6C049531-EC84-456A-96C8-DA0A53343E51\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cluster_project:2.01.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6DF4752C-D8A9-4065-B562-FC264224E89A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cluster_project:2.02.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1E57EEC9-F0EE-4B13-A6DC-934974183DEB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cluster_project:2.03.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"57D5A467-CD50-43D0-B711-CB2DC4538A98\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cluster_project:2.03.01:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C534C075-8156-4431-BC5F-36D985C36C3C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cluster_project:2.03.03:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E01FC592-60D5-417F-A8AF-647AA7EC311D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cluster_project:2.03.04:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"589238CE-D4D1-425E-B43A-FA686E7F707D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cluster_project:2.03.05:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C69E61C3-DD71-4AFC-8895-BF03ABA72F9E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cluster_project:2.03.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7C37DAB7-3B1A-447F-ADC6-1011D66EC22A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cluster_project:2.03.08:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7B7789DD-D69F-4B00-89CA-8E5EFDFB8655\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cluster_project:2.03.09:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"25A87A44-1D4F-4192-8440-213A5C28FBAB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cluster_project:2.03.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"55342974-C2F5-4B2A-9B33-E863BF1C2F9C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cluster_project:2.03.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3A8EFE56-2267-4108-AF0E-642DE1C9F0DA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cluster_project:2.99.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7E5615C1-1FF5-4051-A608-32491B1E88B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cluster_project:2.99.01:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9C631CD9-92ED-4AF8-AFE9-5023C2BCA2E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cluster_project:2.99.02:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9CE29A34-4D4C-4242-8C2D-107A32FA70C8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cluster_project:2.99.03:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B3FBED0F-1959-422A-BDD5-6BC1E1DCEC7A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cluster_project:2.99.04:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3D34E256-54EF-4850-BE89-78F465247CF6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cluster_project:2.99.05:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2E3AD327-D339-47B2-8E92-15459FAFD607\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cluster_project:2.99.06:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7030912C-95C4-4147-9A1A-FF73D3561F10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cluster_project:2.99.07:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C8DAEB97-54E9-409C-9B5E-CE2A04DF8FF5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cluster_project:2.99.08:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CFC5BEA8-87B8-477F-8F13-F62ED1D48C1F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cluster_project:2.99.09:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6FFD0CCC-6C62-40A0-9795-DB50DF507F85\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cluster_project:2.99.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1B7810B2-4FAC-453B-A6AD-93C93BA7BDB1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cluster_project:2.99.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C27C14EE-D852-4C6C-9736-4201E8328658\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cluster_project:2.99.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6BE22AF1-608E-4783-B14D-3543FD89A741\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cluster_project:2.99.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4F734960-8098-4D02-9379-00E2FAF8A6D1\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cman:2.03.03-1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F12B9C5F-29A5-4B40-89E2-CD32477C087F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cman:2.03.04-1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"06ABB244-870D-4D5F-81FA-0D8D133A1B2D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cman:2.03.05-1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C31DAF4D-B7BB-43CE-87EC-33062475AF0C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cman:2.03.07-1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"25AD771F-0B14-4EC9-A425-3E49BE177402\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cman:2.03.08-1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"15DBBFE0-79B9-4776-BE5F-00B861350C93\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:rgmanager:2.03.03-1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"69DCA7E1-6DA3-45EB-861E-9E81772D2B1E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:rgmanager:2.03.04-1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"434FA1DD-2051-4D79-8C77-2A65BBAECD75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:rgmanager:2.03.05-1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BDEB8EE9-4CC1-4605-89A3-FF825F2FE850\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:rgmanager:2.03.07-1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"96CADCB9-566C-4B0F-9CD6-EB6C428486DA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:rgmanager:2.03.08-1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6FA6195C-7577-4602-BA42-CE3C966CC49D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"743CBBB1-C140-4FEF-B40E-FAE4511B1140\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:gfs2-utils:2.03.03-1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2C7CF4AF-CC1E-47F0-8B17-71DD6702A984\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:gfs2-utils:2.03.04-1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0ADCAF38-52C3-47A6-8C12-71B9F443F18F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:gfs2-utils:2.03.05-1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BB493A19-F941-45B0-BA19-8F3EEF91A97A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:gfs2-utils:2.03.07-1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0A1D95B2-55B7-4795-9F6C-A57F7C8411D7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:gfs2-utils:22.03.08-1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D45A7C07-4AF7-4E0D-ADF3-9487198A2D14\"}]}]}],\"references\":[{\"url\":\"http://osvdb.org/50299\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://osvdb.org/50300\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://osvdb.org/50301\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2009-1337.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/32602\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/32616\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/36530\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/36555\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/43367\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/43372\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00163.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00164.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00165.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2009-1339.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2009-1341.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2011-0264.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2011-0265.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/32179\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.ubuntu.com/usn/USN-875-1\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.vupen.com/english/advisories/2011/0416\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.vupen.com/english/advisories/2011/0417\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/46412\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11404\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://osvdb.org/50299\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://osvdb.org/50300\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://osvdb.org/50301\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2009-1337.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/32602\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/32616\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/36530\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/36555\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/43367\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/43372\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00163.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00164.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00165.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2009-1339.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2009-1341.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2011-0264.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2011-0265.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/32179\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.ubuntu.com/usn/USN-875-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.vupen.com/english/advisories/2011/0416\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.vupen.com/english/advisories/2011/0417\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/46412\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11404\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
}
}
gsd-2008-6552
Vulnerability from gsd
Modified
2023-12-13 01:23
Details
Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2008-6552",
"description": "Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9.",
"id": "GSD-2008-6552",
"references": [
"https://access.redhat.com/errata/RHSA-2011:0265",
"https://access.redhat.com/errata/RHSA-2011:0264",
"https://access.redhat.com/errata/RHSA-2009:1341",
"https://access.redhat.com/errata/RHSA-2009:1339",
"https://access.redhat.com/errata/RHSA-2009:1337",
"https://linux.oracle.com/cve/CVE-2008-6552.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2008-6552"
],
"details": "Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9.",
"id": "GSD-2008-6552",
"modified": "2023-12-13T01:23:01.765020Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-6552",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "32616",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/32616"
},
{
"name": "ADV-2011-0416",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2011/0416"
},
{
"name": "RHSA-2009:1341",
"refsource": "REDHAT",
"url": "http://www.redhat.com/support/errata/RHSA-2009-1341.html"
},
{
"name": "RHSA-2011:0264",
"refsource": "REDHAT",
"url": "http://www.redhat.com/support/errata/RHSA-2011-0264.html"
},
{
"name": "36555",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/36555"
},
{
"name": "32179",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/32179"
},
{
"name": "FEDORA-2008-9458",
"refsource": "FEDORA",
"url": "http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00163.html"
},
{
"name": "ADV-2011-0417",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2011/0417"
},
{
"name": "32602",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/32602"
},
{
"name": "43372",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/43372"
},
{
"name": "USN-875-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-875-1"
},
{
"name": "oval:org.mitre.oval:def:11404",
"refsource": "OVAL",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11404"
},
{
"name": "FEDORA-2008-9458",
"refsource": "FEDORA",
"url": "http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00165.html"
},
{
"name": "50300",
"refsource": "OSVDB",
"url": "http://osvdb.org/50300"
},
{
"name": "RHSA-2009:1337",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2009-1337.html"
},
{
"name": "RHSA-2011:0265",
"refsource": "REDHAT",
"url": "http://www.redhat.com/support/errata/RHSA-2011-0265.html"
},
{
"name": "43367",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/43367"
},
{
"name": "FEDORA-2008-9458",
"refsource": "FEDORA",
"url": "http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00164.html"
},
{
"name": "clusterproject-unspecified-priv-escalation(46412)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46412"
},
{
"name": "36530",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/36530"
},
{
"name": "50301",
"refsource": "OSVDB",
"url": "http://osvdb.org/50301"
},
{
"name": "RHSA-2009:1339",
"refsource": "REDHAT",
"url": "http://www.redhat.com/support/errata/RHSA-2009-1339.html"
},
{
"name": "50299",
"refsource": "OSVDB",
"url": "http://osvdb.org/50299"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:redhat:cluster_project:2.01.00:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:cluster_project:2.02.00:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:cluster_project:2.03.08:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:cluster_project:2.03.09:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:cluster_project:2.99.04:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:cluster_project:2.99.05:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:cluster_project:2.99.06:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:cluster_project:2.99.13:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:cluster_project:2.03.03:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:cluster_project:2.03.04:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:cluster_project:2.99.00:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:cluster_project:2.99.01:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:cluster_project:2.99.09:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:cluster_project:2.99.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:cluster_project:2.00.00:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:cluster_project:2.03.05:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:cluster_project:2.03.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:cluster_project:2.99.02:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:cluster_project:2.99.03:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:cluster_project:2.99.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:cluster_project:2.99.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:cluster_project:2.03.00:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:cluster_project:2.03.01:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:cluster_project:2.03.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:cluster_project:2.03.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:cluster_project:2.99.07:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:cluster_project:2.99.08:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:redhat:cman:2.03.08-1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:rgmanager:2.03.03-1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:cman:2.03.04-1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:cman:2.03.03-1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:rgmanager:2.03.07-1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:rgmanager:2.03.08-1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:cman:2.03.07-1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:cman:2.03.05-1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:rgmanager:2.03.04-1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:rgmanager:2.03.05-1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:redhat:gfs2-utils:2.03.04-1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:gfs2-utils:2.03.05-1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:gfs2-utils:2.03.07-1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:gfs2-utils:2.03.03-1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:gfs2-utils:22.03.08-1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-6552"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-59"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "FEDORA-2008-9458",
"refsource": "FEDORA",
"tags": [
"Vendor Advisory"
],
"url": "http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00163.html"
},
{
"name": "32602",
"refsource": "SECUNIA",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/32602"
},
{
"name": "FEDORA-2008-9458",
"refsource": "FEDORA",
"tags": [
"Vendor Advisory"
],
"url": "http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00164.html"
},
{
"name": "32179",
"refsource": "BID",
"tags": [],
"url": "http://www.securityfocus.com/bid/32179"
},
{
"name": "FEDORA-2008-9458",
"refsource": "FEDORA",
"tags": [
"Vendor Advisory"
],
"url": "http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00165.html"
},
{
"name": "32616",
"refsource": "SECUNIA",
"tags": [],
"url": "http://secunia.com/advisories/32616"
},
{
"name": "50299",
"refsource": "OSVDB",
"tags": [],
"url": "http://osvdb.org/50299"
},
{
"name": "50301",
"refsource": "OSVDB",
"tags": [],
"url": "http://osvdb.org/50301"
},
{
"name": "50300",
"refsource": "OSVDB",
"tags": [],
"url": "http://osvdb.org/50300"
},
{
"name": "USN-875-1",
"refsource": "UBUNTU",
"tags": [],
"url": "http://www.ubuntu.com/usn/USN-875-1"
},
{
"name": "RHSA-2011:0264",
"refsource": "REDHAT",
"tags": [],
"url": "http://www.redhat.com/support/errata/RHSA-2011-0264.html"
},
{
"name": "RHSA-2011:0265",
"refsource": "REDHAT",
"tags": [],
"url": "http://www.redhat.com/support/errata/RHSA-2011-0265.html"
},
{
"name": "ADV-2011-0416",
"refsource": "VUPEN",
"tags": [],
"url": "http://www.vupen.com/english/advisories/2011/0416"
},
{
"name": "43367",
"refsource": "SECUNIA",
"tags": [],
"url": "http://secunia.com/advisories/43367"
},
{
"name": "ADV-2011-0417",
"refsource": "VUPEN",
"tags": [],
"url": "http://www.vupen.com/english/advisories/2011/0417"
},
{
"name": "43372",
"refsource": "SECUNIA",
"tags": [],
"url": "http://secunia.com/advisories/43372"
},
{
"name": "RHSA-2009:1339",
"refsource": "REDHAT",
"tags": [],
"url": "http://www.redhat.com/support/errata/RHSA-2009-1339.html"
},
{
"name": "RHSA-2009:1337",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2009-1337.html"
},
{
"name": "36555",
"refsource": "SECUNIA",
"tags": [],
"url": "http://secunia.com/advisories/36555"
},
{
"name": "36530",
"refsource": "SECUNIA",
"tags": [],
"url": "http://secunia.com/advisories/36530"
},
{
"name": "RHSA-2009:1341",
"refsource": "REDHAT",
"tags": [],
"url": "http://www.redhat.com/support/errata/RHSA-2009-1341.html"
},
{
"name": "clusterproject-unspecified-priv-escalation(46412)",
"refsource": "XF",
"tags": [],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46412"
},
{
"name": "oval:org.mitre.oval:def:11404",
"refsource": "OVAL",
"tags": [],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11404"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.9,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.4,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
}
},
"lastModifiedDate": "2017-09-29T01:33Z",
"publishedDate": "2009-03-30T16:30Z"
}
}
}
rhsa-2009_1339
Vulnerability from csaf_redhat
Published
2009-09-02 08:00
Modified
2024-11-14 10:07
Summary
Red Hat Security Advisory: rgmanager security, bug fix, and enhancement update
Notes
Topic
An updated rgmanager package that fixes multiple security issues, various
bugs, and adds enhancements is now available for Red Hat Enterprise Linux
5.
This update has been rated as having low security impact by the Red Hat
Security Response Team.
Details
The rgmanager package contains the Red Hat Resource Group Manager, which
provides high availability for critical server applications in the event of
system downtime.
Multiple insecure temporary file use flaws were discovered in rgmanager and
various resource scripts run by rgmanager. A local attacker could use these
flaws to overwrite an arbitrary file writable by the rgmanager process
(i.e. user root) with the output of rgmanager or a resource agent via a
symbolic link attack. (CVE-2008-6552)
This update also fixes the following bugs:
* clulog now accepts '-' as the first character in messages.
* if expire_time is 0, max_restarts is no longer ignored.
* the SAP resource agents included in the rgmanager package shipped with
Red Hat Enterprise Linux 5.3 were outdated. This update includes the most
recent SAP resource agents and, consequently, improves SAP failover
support.
* empty PID files no longer cause resource start failures.
* recovery policy of type 'restart' now works properly when using a
resource based on ra-skelet.sh.
* samba.sh has been updated to kill the PID listed in the proper PID file.
* handling of the '-F' option has been improved to fix issues causing
rgmanager to crash if no members of a restricted failover domain were
online.
* the number of simultaneous status checks can now be limited to prevent
load spikes.
* forking and cloning during status checks has been optimized to reduce
load spikes.
* rg_test no longer hangs when run with large cluster configuration files.
* when rgmanager is used with a restricted failover domain it will no
longer occasionally segfault when some nodes are offline during a failover
event.
* virtual machine guests no longer restart after a cluster.conf update.
* nfsclient.sh no longer leaves temporary files after running.
* extra checks from the Oracle agents have been removed.
* vm.sh now uses libvirt.
* users can now define an explicit service processing order when
central_processing is enabled.
* virtual machine guests can no longer start on 2 nodes at the same time.
* in some cases a successfully migrated virtual machine guest could restart
when the cluster.conf file was updated.
* incorrect reporting of a service being started when it was not started
has been addressed.
As well, this update adds the following enhancements:
* a startup_wait option has been added to the MySQL resource agent.
* services can now be prioritized.
* rgmanager now checks to see if it has been killed by the OOM killer and
if so, reboots the node.
Users of rgmanager are advised to upgrade to this updated package, which
resolves these issues and adds these enhancements.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Low"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An updated rgmanager package that fixes multiple security issues, various\nbugs, and adds enhancements is now available for Red Hat Enterprise Linux\n5.\n\nThis update has been rated as having low security impact by the Red Hat\nSecurity Response Team.",
"title": "Topic"
},
{
"category": "general",
"text": "The rgmanager package contains the Red Hat Resource Group Manager, which\nprovides high availability for critical server applications in the event of\nsystem downtime.\n\nMultiple insecure temporary file use flaws were discovered in rgmanager and\nvarious resource scripts run by rgmanager. A local attacker could use these\nflaws to overwrite an arbitrary file writable by the rgmanager process\n(i.e. user root) with the output of rgmanager or a resource agent via a\nsymbolic link attack. (CVE-2008-6552)\n\nThis update also fixes the following bugs:\n\n* clulog now accepts \u0027-\u0027 as the first character in messages.\n\n* if expire_time is 0, max_restarts is no longer ignored.\n\n* the SAP resource agents included in the rgmanager package shipped with\nRed Hat Enterprise Linux 5.3 were outdated. This update includes the most\nrecent SAP resource agents and, consequently, improves SAP failover\nsupport.\n\n* empty PID files no longer cause resource start failures.\n\n* recovery policy of type \u0027restart\u0027 now works properly when using a\nresource based on ra-skelet.sh.\n\n* samba.sh has been updated to kill the PID listed in the proper PID file.\n\n* handling of the \u0027-F\u0027 option has been improved to fix issues causing\nrgmanager to crash if no members of a restricted failover domain were\nonline.\n\n* the number of simultaneous status checks can now be limited to prevent\nload spikes.\n\n* forking and cloning during status checks has been optimized to reduce\nload spikes.\n\n* rg_test no longer hangs when run with large cluster configuration files.\n\n* when rgmanager is used with a restricted failover domain it will no\nlonger occasionally segfault when some nodes are offline during a failover\nevent.\n\n* virtual machine guests no longer restart after a cluster.conf update.\n\n* nfsclient.sh no longer leaves temporary files after running.\n\n* extra checks from the Oracle agents have been removed.\n\n* vm.sh now uses libvirt.\n\n* users can now define an explicit service processing order when\ncentral_processing is enabled.\n\n* virtual machine guests can no longer start on 2 nodes at the same time.\n\n* in some cases a successfully migrated virtual machine guest could restart\nwhen the cluster.conf file was updated.\n\n* incorrect reporting of a service being started when it was not started\nhas been addressed.\n\nAs well, this update adds the following enhancements:\n\n* a startup_wait option has been added to the MySQL resource agent.\n\n* services can now be prioritized.\n\n* rgmanager now checks to see if it has been killed by the OOM killer and\nif so, reboots the node.\n\nUsers of rgmanager are advised to upgrade to this updated package, which\nresolves these issues and adds these enhancements.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2009:1339",
"url": "https://access.redhat.com/errata/RHSA-2009:1339"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#low",
"url": "https://access.redhat.com/security/updates/classification/#low"
},
{
"category": "external",
"summary": "250718",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=250718"
},
{
"category": "external",
"summary": "412911",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=412911"
},
{
"category": "external",
"summary": "449394",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=449394"
},
{
"category": "external",
"summary": "468691",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=468691"
},
{
"category": "external",
"summary": "470917",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=470917"
},
{
"category": "external",
"summary": "471066",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=471066"
},
{
"category": "external",
"summary": "471226",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=471226"
},
{
"category": "external",
"summary": "471431",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=471431"
},
{
"category": "external",
"summary": "474444",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=474444"
},
{
"category": "external",
"summary": "475826",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=475826"
},
{
"category": "external",
"summary": "481058",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=481058"
},
{
"category": "external",
"summary": "482858",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=482858"
},
{
"category": "external",
"summary": "483093",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=483093"
},
{
"category": "external",
"summary": "486349",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=486349"
},
{
"category": "external",
"summary": "486717",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=486717"
},
{
"category": "external",
"summary": "488714",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=488714"
},
{
"category": "external",
"summary": "489785",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=489785"
},
{
"category": "external",
"summary": "490449",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=490449"
},
{
"category": "external",
"summary": "490455",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=490455"
},
{
"category": "external",
"summary": "492828",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=492828"
},
{
"category": "external",
"summary": "494977",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=494977"
},
{
"category": "external",
"summary": "505340",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=505340"
},
{
"category": "external",
"summary": "514044",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=514044"
},
{
"category": "external",
"summary": "519436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=519436"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1339.json"
}
],
"title": "Red Hat Security Advisory: rgmanager security, bug fix, and enhancement update",
"tracking": {
"current_release_date": "2024-11-14T10:07:26+00:00",
"generator": {
"date": "2024-11-14T10:07:26+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.0"
}
},
"id": "RHSA-2009:1339",
"initial_release_date": "2009-09-02T08:00:00+00:00",
"revision_history": [
{
"date": "2009-09-02T08:00:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2009-09-01T06:42:29+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T10:07:26+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Clustering (v. 5 server)",
"product": {
"name": "Red Hat Enterprise Linux Clustering (v. 5 server)",
"product_id": "5Server-Cluster",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_cluster:5"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.ia64",
"product": {
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.ia64",
"product_id": "rgmanager-debuginfo-0:2.0.52-1.el5.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager-debuginfo@2.0.52-1.el5?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "rgmanager-0:2.0.52-1.el5.ia64",
"product": {
"name": "rgmanager-0:2.0.52-1.el5.ia64",
"product_id": "rgmanager-0:2.0.52-1.el5.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager@2.0.52-1.el5?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.ppc",
"product": {
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.ppc",
"product_id": "rgmanager-debuginfo-0:2.0.52-1.el5.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager-debuginfo@2.0.52-1.el5?arch=ppc"
}
}
},
{
"category": "product_version",
"name": "rgmanager-0:2.0.52-1.el5.ppc",
"product": {
"name": "rgmanager-0:2.0.52-1.el5.ppc",
"product_id": "rgmanager-0:2.0.52-1.el5.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager@2.0.52-1.el5?arch=ppc"
}
}
}
],
"category": "architecture",
"name": "ppc"
},
{
"branches": [
{
"category": "product_version",
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.x86_64",
"product": {
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.x86_64",
"product_id": "rgmanager-debuginfo-0:2.0.52-1.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager-debuginfo@2.0.52-1.el5?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rgmanager-0:2.0.52-1.el5.x86_64",
"product": {
"name": "rgmanager-0:2.0.52-1.el5.x86_64",
"product_id": "rgmanager-0:2.0.52-1.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager@2.0.52-1.el5?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.i386",
"product": {
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.i386",
"product_id": "rgmanager-debuginfo-0:2.0.52-1.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager-debuginfo@2.0.52-1.el5?arch=i386"
}
}
},
{
"category": "product_version",
"name": "rgmanager-0:2.0.52-1.el5.i386",
"product": {
"name": "rgmanager-0:2.0.52-1.el5.i386",
"product_id": "rgmanager-0:2.0.52-1.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager@2.0.52-1.el5?arch=i386"
}
}
}
],
"category": "architecture",
"name": "i386"
},
{
"branches": [
{
"category": "product_version",
"name": "rgmanager-0:2.0.52-1.el5.src",
"product": {
"name": "rgmanager-0:2.0.52-1.el5.src",
"product_id": "rgmanager-0:2.0.52-1.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager@2.0.52-1.el5?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:2.0.52-1.el5.i386 as a component of Red Hat Enterprise Linux Clustering (v. 5 server)",
"product_id": "5Server-Cluster:rgmanager-0:2.0.52-1.el5.i386"
},
"product_reference": "rgmanager-0:2.0.52-1.el5.i386",
"relates_to_product_reference": "5Server-Cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:2.0.52-1.el5.ia64 as a component of Red Hat Enterprise Linux Clustering (v. 5 server)",
"product_id": "5Server-Cluster:rgmanager-0:2.0.52-1.el5.ia64"
},
"product_reference": "rgmanager-0:2.0.52-1.el5.ia64",
"relates_to_product_reference": "5Server-Cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:2.0.52-1.el5.ppc as a component of Red Hat Enterprise Linux Clustering (v. 5 server)",
"product_id": "5Server-Cluster:rgmanager-0:2.0.52-1.el5.ppc"
},
"product_reference": "rgmanager-0:2.0.52-1.el5.ppc",
"relates_to_product_reference": "5Server-Cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:2.0.52-1.el5.src as a component of Red Hat Enterprise Linux Clustering (v. 5 server)",
"product_id": "5Server-Cluster:rgmanager-0:2.0.52-1.el5.src"
},
"product_reference": "rgmanager-0:2.0.52-1.el5.src",
"relates_to_product_reference": "5Server-Cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:2.0.52-1.el5.x86_64 as a component of Red Hat Enterprise Linux Clustering (v. 5 server)",
"product_id": "5Server-Cluster:rgmanager-0:2.0.52-1.el5.x86_64"
},
"product_reference": "rgmanager-0:2.0.52-1.el5.x86_64",
"relates_to_product_reference": "5Server-Cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.i386 as a component of Red Hat Enterprise Linux Clustering (v. 5 server)",
"product_id": "5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.i386"
},
"product_reference": "rgmanager-debuginfo-0:2.0.52-1.el5.i386",
"relates_to_product_reference": "5Server-Cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.ia64 as a component of Red Hat Enterprise Linux Clustering (v. 5 server)",
"product_id": "5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.ia64"
},
"product_reference": "rgmanager-debuginfo-0:2.0.52-1.el5.ia64",
"relates_to_product_reference": "5Server-Cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.ppc as a component of Red Hat Enterprise Linux Clustering (v. 5 server)",
"product_id": "5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.ppc"
},
"product_reference": "rgmanager-debuginfo-0:2.0.52-1.el5.ppc",
"relates_to_product_reference": "5Server-Cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.x86_64 as a component of Red Hat Enterprise Linux Clustering (v. 5 server)",
"product_id": "5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.x86_64"
},
"product_reference": "rgmanager-debuginfo-0:2.0.52-1.el5.x86_64",
"relates_to_product_reference": "5Server-Cluster"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2008-6552",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2008-10-31T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "519436"
}
],
"notes": [
{
"category": "description",
"text": "Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rgmanager: multiple insecure temporary file use issues",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.i386",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.ia64",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.ppc",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.src",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.x86_64",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.i386",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.ia64",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.ppc",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2008-6552"
},
{
"category": "external",
"summary": "RHBZ#519436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=519436"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2008-6552",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-6552"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-6552",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-6552"
}
],
"release_date": "2008-10-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2009-09-02T08:00:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.i386",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.ia64",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.ppc",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.src",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.x86_64",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.i386",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.ia64",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.ppc",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2009:1339"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 5.4,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:C",
"version": "2.0"
},
"products": [
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.i386",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.ia64",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.ppc",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.src",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.x86_64",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.i386",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.ia64",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.ppc",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "rgmanager: multiple insecure temporary file use issues"
}
]
}
RHSA-2009:1337
Vulnerability from csaf_redhat
Published
2009-09-02 08:00
Modified
2025-11-08 03:24
Summary
Red Hat Security Advisory: gfs2-utils security and bug fix update
Notes
Topic
An updated gfs2-utils package that fixes multiple security issues and
various bugs is now available for Red Hat Enterprise Linux 5.
This update has been rated as having low security impact by the Red Hat
Security Response Team.
Details
The gfs2-utils package provides the user-space tools necessary to mount,
create, maintain, and test GFS2 file systems.
Multiple insecure temporary file use flaws were discovered in GFS2 user
level utilities. A local attacker could use these flaws to overwrite an
arbitrary file writable by a victim running those utilities (typically
root) with the output of the utilities via a symbolic link attack.
(CVE-2008-6552)
This update also fixes the following bugs:
* gfs2_fsck now properly detects and repairs problems with sequence numbers
on GFS2 file systems.
* GFS2 user utilities now use the file system UUID.
* gfs2_grow now properly updates the file system size during operation.
* gfs2_fsck now returns the proper exit codes.
* gfs2_convert now properly frees blocks when removing free blocks up to
height 2.
* the gfs2_fsck manual page has been renamed to fsck.gfs2 to match current
standards.
* the 'gfs2_tool df' command now provides human-readable output.
* mounting GFS2 file systems with the noatime or noquota option now works
properly.
* new capabilities have been added to the gfs2_edit tool to help in testing
and debugging GFS and GFS2 issues.
* the 'gfs2_tool df' command no longer segfaults on file systems with a
block size other than 4k.
* the gfs2_grow manual page no longer references the '-r' option, which has
been removed.
* the 'gfs2_tool unfreeze' command no longer hangs during use.
* gfs2_convert no longer corrupts file systems when converting from GFS to
GFS2.
* gfs2_fsck no longer segfaults when encountering a block which is listed
as both a data and stuffed directory inode.
* gfs2_fsck can now fix file systems even if the journal is already locked
for use.
* a GFS2 file system's metadata is now properly copied with 'gfs2_edit
savemeta' and 'gfs2_edit restoremeta'.
* the gfs2_edit savemeta function now properly saves blocks of type 2.
* 'gfs2_convert -vy' now works properly on the PowerPC architecture.
* when mounting a GFS2 file system as '/', mount_gfs2 no longer fails after
being unable to find the file system in '/proc/mounts'.
* gfs2_fsck no longer segfaults when fixing 'EA leaf block type' problems.
All gfs2-utils users should upgrade to this updated package, which resolves
these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Low"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An updated gfs2-utils package that fixes multiple security issues and\nvarious bugs is now available for Red Hat Enterprise Linux 5.\n\nThis update has been rated as having low security impact by the Red Hat\nSecurity Response Team.",
"title": "Topic"
},
{
"category": "general",
"text": "The gfs2-utils package provides the user-space tools necessary to mount,\ncreate, maintain, and test GFS2 file systems.\n\nMultiple insecure temporary file use flaws were discovered in GFS2 user\nlevel utilities. A local attacker could use these flaws to overwrite an\narbitrary file writable by a victim running those utilities (typically\nroot) with the output of the utilities via a symbolic link attack.\n(CVE-2008-6552)\n\nThis update also fixes the following bugs:\n\n* gfs2_fsck now properly detects and repairs problems with sequence numbers\non GFS2 file systems.\n\n* GFS2 user utilities now use the file system UUID.\n\n* gfs2_grow now properly updates the file system size during operation.\n\n* gfs2_fsck now returns the proper exit codes.\n\n* gfs2_convert now properly frees blocks when removing free blocks up to\nheight 2.\n\n* the gfs2_fsck manual page has been renamed to fsck.gfs2 to match current\nstandards.\n\n* the \u0027gfs2_tool df\u0027 command now provides human-readable output.\n\n* mounting GFS2 file systems with the noatime or noquota option now works\nproperly.\n\n* new capabilities have been added to the gfs2_edit tool to help in testing\nand debugging GFS and GFS2 issues.\n\n* the \u0027gfs2_tool df\u0027 command no longer segfaults on file systems with a\nblock size other than 4k.\n\n* the gfs2_grow manual page no longer references the \u0027-r\u0027 option, which has\nbeen removed.\n\n* the \u0027gfs2_tool unfreeze\u0027 command no longer hangs during use.\n\n* gfs2_convert no longer corrupts file systems when converting from GFS to\nGFS2.\n\n* gfs2_fsck no longer segfaults when encountering a block which is listed\nas both a data and stuffed directory inode.\n\n* gfs2_fsck can now fix file systems even if the journal is already locked\nfor use.\n\n* a GFS2 file system\u0027s metadata is now properly copied with \u0027gfs2_edit\nsavemeta\u0027 and \u0027gfs2_edit restoremeta\u0027.\n\n* the gfs2_edit savemeta function now properly saves blocks of type 2.\n\n* \u0027gfs2_convert -vy\u0027 now works properly on the PowerPC architecture.\n\n* when mounting a GFS2 file system as \u0027/\u0027, mount_gfs2 no longer fails after\nbeing unable to find the file system in \u0027/proc/mounts\u0027.\n\n* gfs2_fsck no longer segfaults when fixing \u0027EA leaf block type\u0027 problems.\n\nAll gfs2-utils users should upgrade to this updated package, which resolves\nthese issues.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2009:1337",
"url": "https://access.redhat.com/errata/RHSA-2009:1337"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#low",
"url": "https://access.redhat.com/security/updates/classification/#low"
},
{
"category": "external",
"summary": "242701",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=242701"
},
{
"category": "external",
"summary": "469773",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=469773"
},
{
"category": "external",
"summary": "474705",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=474705"
},
{
"category": "external",
"summary": "474707",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=474707"
},
{
"category": "external",
"summary": "477072",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=477072"
},
{
"category": "external",
"summary": "481762",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=481762"
},
{
"category": "external",
"summary": "483799",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=483799"
},
{
"category": "external",
"summary": "485761",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=485761"
},
{
"category": "external",
"summary": "486034",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=486034"
},
{
"category": "external",
"summary": "487608",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=487608"
},
{
"category": "external",
"summary": "498646",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=498646"
},
{
"category": "external",
"summary": "501732",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=501732"
},
{
"category": "external",
"summary": "502056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=502056"
},
{
"category": "external",
"summary": "506629",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=506629"
},
{
"category": "external",
"summary": "510758",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=510758"
},
{
"category": "external",
"summary": "519436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=519436"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1337.json"
}
],
"title": "Red Hat Security Advisory: gfs2-utils security and bug fix update",
"tracking": {
"current_release_date": "2025-11-08T03:24:12+00:00",
"generator": {
"date": "2025-11-08T03:24:12+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2009:1337",
"initial_release_date": "2009-09-02T08:00:00+00:00",
"revision_history": [
{
"date": "2009-09-02T08:00:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2009-09-01T06:41:56+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-08T03:24:12+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop (v. 5 client)",
"product": {
"name": "Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:5::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux (v. 5 server)",
"product": {
"name": "Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:5::server"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64",
"product": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64",
"product_id": "gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils-debuginfo@0.1.62-1.el5?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "gfs2-utils-0:0.1.62-1.el5.x86_64",
"product": {
"name": "gfs2-utils-0:0.1.62-1.el5.x86_64",
"product_id": "gfs2-utils-0:0.1.62-1.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils@0.1.62-1.el5?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"product": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"product_id": "gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils-debuginfo@0.1.62-1.el5?arch=i386"
}
}
},
{
"category": "product_version",
"name": "gfs2-utils-0:0.1.62-1.el5.i386",
"product": {
"name": "gfs2-utils-0:0.1.62-1.el5.i386",
"product_id": "gfs2-utils-0:0.1.62-1.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils@0.1.62-1.el5?arch=i386"
}
}
}
],
"category": "architecture",
"name": "i386"
},
{
"branches": [
{
"category": "product_version",
"name": "gfs2-utils-0:0.1.62-1.el5.src",
"product": {
"name": "gfs2-utils-0:0.1.62-1.el5.src",
"product_id": "gfs2-utils-0:0.1.62-1.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils@0.1.62-1.el5?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"product": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"product_id": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils-debuginfo@0.1.62-1.el5?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "gfs2-utils-0:0.1.62-1.el5.ia64",
"product": {
"name": "gfs2-utils-0:0.1.62-1.el5.ia64",
"product_id": "gfs2-utils-0:0.1.62-1.el5.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils@0.1.62-1.el5?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"product": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"product_id": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils-debuginfo@0.1.62-1.el5?arch=ppc"
}
}
},
{
"category": "product_version",
"name": "gfs2-utils-0:0.1.62-1.el5.ppc",
"product": {
"name": "gfs2-utils-0:0.1.62-1.el5.ppc",
"product_id": "gfs2-utils-0:0.1.62-1.el5.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils@0.1.62-1.el5?arch=ppc"
}
}
}
],
"category": "architecture",
"name": "ppc"
},
{
"branches": [
{
"category": "product_version",
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"product": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"product_id": "gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils-debuginfo@0.1.62-1.el5?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "gfs2-utils-0:0.1.62-1.el5.s390x",
"product": {
"name": "gfs2-utils-0:0.1.62-1.el5.s390x",
"product_id": "gfs2-utils-0:0.1.62-1.el5.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils@0.1.62-1.el5?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-0:0.1.62-1.el5.i386"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.i386",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-0:0.1.62-1.el5.ia64"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.ia64",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-0:0.1.62-1.el5.ppc"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.ppc",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-0:0.1.62-1.el5.s390x"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.s390x",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.src as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-0:0.1.62-1.el5.src"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.src",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-0:0.1.62-1.el5.x86_64"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.x86_64",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.i386"
},
"product_reference": "gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64"
},
"product_reference": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc"
},
"product_reference": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x"
},
"product_reference": "gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64"
},
"product_reference": "gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-0:0.1.62-1.el5.i386"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.i386",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-0:0.1.62-1.el5.ia64"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.ia64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-0:0.1.62-1.el5.ppc"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.ppc",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-0:0.1.62-1.el5.s390x"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.s390x",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.src as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-0:0.1.62-1.el5.src"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.src",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-0:0.1.62-1.el5.x86_64"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.x86_64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.i386"
},
"product_reference": "gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64"
},
"product_reference": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc"
},
"product_reference": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x"
},
"product_reference": "gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64"
},
"product_reference": "gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64",
"relates_to_product_reference": "5Server"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2008-6552",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2008-10-31T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "519436"
}
],
"notes": [
{
"category": "description",
"text": "Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rgmanager: multiple insecure temporary file use issues",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client:gfs2-utils-0:0.1.62-1.el5.i386",
"5Client:gfs2-utils-0:0.1.62-1.el5.ia64",
"5Client:gfs2-utils-0:0.1.62-1.el5.ppc",
"5Client:gfs2-utils-0:0.1.62-1.el5.s390x",
"5Client:gfs2-utils-0:0.1.62-1.el5.src",
"5Client:gfs2-utils-0:0.1.62-1.el5.x86_64",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64",
"5Server:gfs2-utils-0:0.1.62-1.el5.i386",
"5Server:gfs2-utils-0:0.1.62-1.el5.ia64",
"5Server:gfs2-utils-0:0.1.62-1.el5.ppc",
"5Server:gfs2-utils-0:0.1.62-1.el5.s390x",
"5Server:gfs2-utils-0:0.1.62-1.el5.src",
"5Server:gfs2-utils-0:0.1.62-1.el5.x86_64",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2008-6552"
},
{
"category": "external",
"summary": "RHBZ#519436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=519436"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2008-6552",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-6552"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-6552",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-6552"
}
],
"release_date": "2008-10-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2009-09-02T08:00:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Client:gfs2-utils-0:0.1.62-1.el5.i386",
"5Client:gfs2-utils-0:0.1.62-1.el5.ia64",
"5Client:gfs2-utils-0:0.1.62-1.el5.ppc",
"5Client:gfs2-utils-0:0.1.62-1.el5.s390x",
"5Client:gfs2-utils-0:0.1.62-1.el5.src",
"5Client:gfs2-utils-0:0.1.62-1.el5.x86_64",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64",
"5Server:gfs2-utils-0:0.1.62-1.el5.i386",
"5Server:gfs2-utils-0:0.1.62-1.el5.ia64",
"5Server:gfs2-utils-0:0.1.62-1.el5.ppc",
"5Server:gfs2-utils-0:0.1.62-1.el5.s390x",
"5Server:gfs2-utils-0:0.1.62-1.el5.src",
"5Server:gfs2-utils-0:0.1.62-1.el5.x86_64",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2009:1337"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 5.4,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:C",
"version": "2.0"
},
"products": [
"5Client:gfs2-utils-0:0.1.62-1.el5.i386",
"5Client:gfs2-utils-0:0.1.62-1.el5.ia64",
"5Client:gfs2-utils-0:0.1.62-1.el5.ppc",
"5Client:gfs2-utils-0:0.1.62-1.el5.s390x",
"5Client:gfs2-utils-0:0.1.62-1.el5.src",
"5Client:gfs2-utils-0:0.1.62-1.el5.x86_64",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64",
"5Server:gfs2-utils-0:0.1.62-1.el5.i386",
"5Server:gfs2-utils-0:0.1.62-1.el5.ia64",
"5Server:gfs2-utils-0:0.1.62-1.el5.ppc",
"5Server:gfs2-utils-0:0.1.62-1.el5.s390x",
"5Server:gfs2-utils-0:0.1.62-1.el5.src",
"5Server:gfs2-utils-0:0.1.62-1.el5.x86_64",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "rgmanager: multiple insecure temporary file use issues"
}
]
}
rhsa-2009_1341
Vulnerability from csaf_redhat
Published
2009-09-02 08:00
Modified
2024-11-22 02:44
Summary
Red Hat Security Advisory: cman security, bug fix, and enhancement update
Notes
Topic
Updated cman packages that fix several security issues, various bugs, and
add enhancements are now available for Red Hat Enterprise Linux 5.
This update has been rated as having low security impact by the Red Hat
Security Response Team.
Details
The Cluster Manager (cman) utility provides services for managing a Linux
cluster.
Multiple insecure temporary file use flaws were found in fence_apc_snmp and
ccs_tool. A local attacker could use these flaws to overwrite an arbitrary
file writable by a victim running those utilities (typically root) with
the output of the utilities via a symbolic link attack. (CVE-2008-4579,
CVE-2008-6552)
Bug fixes:
* a buffer could overflow if cluster.conf had more than 52 entries per
block inside the <cman> block. The limit is now 1024.
* the output of the group_tool dump subcommands were NULL padded.
* using device="" instead of label="" no longer causes qdiskd to
incorrectly exit.
* the IPMI fencing agent has been modified to time out after 10 seconds. It
is also now possible to specify a different timeout value with the '-t'
option.
* the IPMI fencing agent now allows punctuation in passwords.
* quickly starting and stopping the cman service no longer causes the
cluster membership to become inconsistent across the cluster.
* an issue with lock syncing caused 'receive_own from' errors to be logged
to '/var/log/messages'.
* an issue which caused gfs_controld to segfault when mounting hundreds of
file systems has been fixed.
* the LPAR fencing agent now properly reports status when an LPAR is in
Open Firmware mode.
* the LPAR fencing agent now works properly with systems using the
Integrated Virtualization Manager (IVM).
* the APC SNMP fencing agent now properly recognizes outletStatusOn and
outletStatusOff return codes from the SNMP agent.
* the WTI fencing agent can now connect to fencing devices with no
password.
* the rps-10 fencing agent now properly performs a reboot when run with no
options.
* the IPMI fencing agent now supports different cipher types with the '-C'
option.
* qdisk now properly scans devices and partitions.
* cman now checks to see if a new node has state to prevent killing the
first node during cluster setup.
* 'service qdiskd start' now works properly.
* the McData fence agent now works properly with the McData Sphereon 4500
Fabric Switch.
* the Egenera fence agent can now specify an SSH login name.
* the APC fence agent now works with non-admin accounts when using the
3.5.x firmware.
* fence_xvmd now tries two methods to reboot a virtual machine.
* connections to OpenAIS are now allowed from unprivileged CPG clients with
the user and group of 'ais'.
* groupd no longer allows the default fence domain to be '0', which
previously caused rgmanager to hang. Now, rgmanager no longer hangs.
* the RSA fence agent now supports SSH enabled RSA II devices.
* the DRAC fence agent now works with the Integrated Dell Remote Access
Controller (iDRAC) on Dell PowerEdge M600 blade servers.
* fixed a memory leak in cman.
* qdisk now displays a warning if more than one label is found with the
same name.
* the DRAC5 fencing agent now shows proper usage instructions for the '-D'
option.
* cman no longer uses the wrong node name when getnameinfo() fails.
* the SCSI fence agent now verifies that sg_persist is installed.
* the DRAC5 fencing agent now properly handles modulename.
* QDisk now logs warning messages if it appears its I/O to shared storage
is hung.
* fence_apc no longer fails with a pexpect exception.
* removing a node from the cluster using 'cman_tool leave remove' now
properly reduces the expected_votes and quorum.
* a semaphore leak in cman has been fixed.
* 'cman_tool nodes -F name' no longer segfaults when a node is out of
membership.
Enhancements:
* support for: ePowerSwitch 8+ and LPAR/HMC v3 devices, Cisco MDS 9124 and
MDS 9134 SAN switches, the virsh fencing agent, and broadcast communication
with cman.
* fence_scsi limitations added to fence_scsi man page.
Users of cman are advised to upgrade to these updated packages, which
resolve these issues and add these enhancements.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Low"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated cman packages that fix several security issues, various bugs, and\nadd enhancements are now available for Red Hat Enterprise Linux 5.\n\nThis update has been rated as having low security impact by the Red Hat\nSecurity Response Team.",
"title": "Topic"
},
{
"category": "general",
"text": "The Cluster Manager (cman) utility provides services for managing a Linux\ncluster.\n\nMultiple insecure temporary file use flaws were found in fence_apc_snmp and\nccs_tool. A local attacker could use these flaws to overwrite an arbitrary\nfile writable by a victim running those utilities (typically root) with\nthe output of the utilities via a symbolic link attack. (CVE-2008-4579,\nCVE-2008-6552)\n\nBug fixes:\n\n* a buffer could overflow if cluster.conf had more than 52 entries per\nblock inside the \u003ccman\u003e block. The limit is now 1024.\n\n* the output of the group_tool dump subcommands were NULL padded.\n\n* using device=\"\" instead of label=\"\" no longer causes qdiskd to\nincorrectly exit.\n\n* the IPMI fencing agent has been modified to time out after 10 seconds. It\nis also now possible to specify a different timeout value with the \u0027-t\u0027\noption.\n\n* the IPMI fencing agent now allows punctuation in passwords.\n\n* quickly starting and stopping the cman service no longer causes the\ncluster membership to become inconsistent across the cluster.\n\n* an issue with lock syncing caused \u0027receive_own from\u0027 errors to be logged\nto \u0027/var/log/messages\u0027.\n\n* an issue which caused gfs_controld to segfault when mounting hundreds of\nfile systems has been fixed.\n\n* the LPAR fencing agent now properly reports status when an LPAR is in\nOpen Firmware mode.\n\n* the LPAR fencing agent now works properly with systems using the\nIntegrated Virtualization Manager (IVM).\n\n* the APC SNMP fencing agent now properly recognizes outletStatusOn and\noutletStatusOff return codes from the SNMP agent.\n\n* the WTI fencing agent can now connect to fencing devices with no\npassword.\n\n* the rps-10 fencing agent now properly performs a reboot when run with no\noptions.\n\n* the IPMI fencing agent now supports different cipher types with the \u0027-C\u0027\noption.\n\n* qdisk now properly scans devices and partitions.\n\n* cman now checks to see if a new node has state to prevent killing the\nfirst node during cluster setup.\n\n* \u0027service qdiskd start\u0027 now works properly.\n\n* the McData fence agent now works properly with the McData Sphereon 4500\nFabric Switch.\n\n* the Egenera fence agent can now specify an SSH login name.\n\n* the APC fence agent now works with non-admin accounts when using the\n3.5.x firmware.\n\n* fence_xvmd now tries two methods to reboot a virtual machine.\n\n* connections to OpenAIS are now allowed from unprivileged CPG clients with\nthe user and group of \u0027ais\u0027.\n\n* groupd no longer allows the default fence domain to be \u00270\u0027, which\npreviously caused rgmanager to hang. Now, rgmanager no longer hangs.\n\n* the RSA fence agent now supports SSH enabled RSA II devices.\n\n* the DRAC fence agent now works with the Integrated Dell Remote Access\nController (iDRAC) on Dell PowerEdge M600 blade servers.\n\n* fixed a memory leak in cman.\n\n* qdisk now displays a warning if more than one label is found with the\nsame name.\n\n* the DRAC5 fencing agent now shows proper usage instructions for the \u0027-D\u0027\noption.\n\n* cman no longer uses the wrong node name when getnameinfo() fails.\n\n* the SCSI fence agent now verifies that sg_persist is installed.\n\n* the DRAC5 fencing agent now properly handles modulename.\n\n* QDisk now logs warning messages if it appears its I/O to shared storage\nis hung.\n\n* fence_apc no longer fails with a pexpect exception.\n\n* removing a node from the cluster using \u0027cman_tool leave remove\u0027 now\nproperly reduces the expected_votes and quorum.\n\n* a semaphore leak in cman has been fixed.\n\n* \u0027cman_tool nodes -F name\u0027 no longer segfaults when a node is out of\nmembership.\n\nEnhancements:\n\n* support for: ePowerSwitch 8+ and LPAR/HMC v3 devices, Cisco MDS 9124 and\nMDS 9134 SAN switches, the virsh fencing agent, and broadcast communication\nwith cman.\n\n* fence_scsi limitations added to fence_scsi man page.\n\nUsers of cman are advised to upgrade to these updated packages, which\nresolve these issues and add these enhancements.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2009:1341",
"url": "https://access.redhat.com/errata/RHSA-2009:1341"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#low",
"url": "https://access.redhat.com/security/updates/classification/#low"
},
{
"category": "external",
"summary": "276541",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=276541"
},
{
"category": "external",
"summary": "322291",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=322291"
},
{
"category": "external",
"summary": "447497",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=447497"
},
{
"category": "external",
"summary": "447964",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=447964"
},
{
"category": "external",
"summary": "467386",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=467386"
},
{
"category": "external",
"summary": "468966",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=468966"
},
{
"category": "external",
"summary": "472460",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=472460"
},
{
"category": "external",
"summary": "472786",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=472786"
},
{
"category": "external",
"summary": "473961",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=473961"
},
{
"category": "external",
"summary": "474163",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=474163"
},
{
"category": "external",
"summary": "480178",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=480178"
},
{
"category": "external",
"summary": "480401",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=480401"
},
{
"category": "external",
"summary": "480836",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=480836"
},
{
"category": "external",
"summary": "481566",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=481566"
},
{
"category": "external",
"summary": "481664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=481664"
},
{
"category": "external",
"summary": "484095",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=484095"
},
{
"category": "external",
"summary": "484956",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=484956"
},
{
"category": "external",
"summary": "485026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=485026"
},
{
"category": "external",
"summary": "485199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=485199"
},
{
"category": "external",
"summary": "485469",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=485469"
},
{
"category": "external",
"summary": "485700",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=485700"
},
{
"category": "external",
"summary": "487436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=487436"
},
{
"category": "external",
"summary": "487501",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=487501"
},
{
"category": "external",
"summary": "488565",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=488565"
},
{
"category": "external",
"summary": "488958",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=488958"
},
{
"category": "external",
"summary": "491640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=491640"
},
{
"category": "external",
"summary": "493165",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=493165"
},
{
"category": "external",
"summary": "493207",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=493207"
},
{
"category": "external",
"summary": "493802",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=493802"
},
{
"category": "external",
"summary": "496629",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=496629"
},
{
"category": "external",
"summary": "496724",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=496724"
},
{
"category": "external",
"summary": "498329",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=498329"
},
{
"category": "external",
"summary": "499767",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=499767"
},
{
"category": "external",
"summary": "500450",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=500450"
},
{
"category": "external",
"summary": "500567",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=500567"
},
{
"category": "external",
"summary": "501586",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=501586"
},
{
"category": "external",
"summary": "502674",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=502674"
},
{
"category": "external",
"summary": "504705",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=504705"
},
{
"category": "external",
"summary": "505258",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=505258"
},
{
"category": "external",
"summary": "505594",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=505594"
},
{
"category": "external",
"summary": "512998",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=512998"
},
{
"category": "external",
"summary": "514758",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=514758"
},
{
"category": "external",
"summary": "519436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=519436"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1341.json"
}
],
"title": "Red Hat Security Advisory: cman security, bug fix, and enhancement update",
"tracking": {
"current_release_date": "2024-11-22T02:44:45+00:00",
"generator": {
"date": "2024-11-22T02:44:45+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2009:1341",
"initial_release_date": "2009-09-02T08:00:00+00:00",
"revision_history": [
{
"date": "2009-09-02T08:00:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2009-09-01T06:43:16+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T02:44:45+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product": {
"name": "Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:5::client_workstation"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux (v. 5 server)",
"product": {
"name": "Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:5::server"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "cman-0:2.0.115-1.el5.src",
"product": {
"name": "cman-0:2.0.115-1.el5.src",
"product_id": "cman-0:2.0.115-1.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman@2.0.115-1.el5?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "cman-0:2.0.115-1.el5.x86_64",
"product": {
"name": "cman-0:2.0.115-1.el5.x86_64",
"product_id": "cman-0:2.0.115-1.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman@2.0.115-1.el5?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "cman-devel-0:2.0.115-1.el5.x86_64",
"product": {
"name": "cman-devel-0:2.0.115-1.el5.x86_64",
"product_id": "cman-devel-0:2.0.115-1.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-devel@2.0.115-1.el5?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "cman-debuginfo-0:2.0.115-1.el5.x86_64",
"product": {
"name": "cman-debuginfo-0:2.0.115-1.el5.x86_64",
"product_id": "cman-debuginfo-0:2.0.115-1.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-debuginfo@2.0.115-1.el5?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "cman-devel-0:2.0.115-1.el5.i386",
"product": {
"name": "cman-devel-0:2.0.115-1.el5.i386",
"product_id": "cman-devel-0:2.0.115-1.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-devel@2.0.115-1.el5?arch=i386"
}
}
},
{
"category": "product_version",
"name": "cman-debuginfo-0:2.0.115-1.el5.i386",
"product": {
"name": "cman-debuginfo-0:2.0.115-1.el5.i386",
"product_id": "cman-debuginfo-0:2.0.115-1.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-debuginfo@2.0.115-1.el5?arch=i386"
}
}
},
{
"category": "product_version",
"name": "cman-0:2.0.115-1.el5.i386",
"product": {
"name": "cman-0:2.0.115-1.el5.i386",
"product_id": "cman-0:2.0.115-1.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman@2.0.115-1.el5?arch=i386"
}
}
}
],
"category": "architecture",
"name": "i386"
},
{
"branches": [
{
"category": "product_version",
"name": "cman-0:2.0.115-1.el5.ia64",
"product": {
"name": "cman-0:2.0.115-1.el5.ia64",
"product_id": "cman-0:2.0.115-1.el5.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman@2.0.115-1.el5?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "cman-devel-0:2.0.115-1.el5.ia64",
"product": {
"name": "cman-devel-0:2.0.115-1.el5.ia64",
"product_id": "cman-devel-0:2.0.115-1.el5.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-devel@2.0.115-1.el5?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "cman-debuginfo-0:2.0.115-1.el5.ia64",
"product": {
"name": "cman-debuginfo-0:2.0.115-1.el5.ia64",
"product_id": "cman-debuginfo-0:2.0.115-1.el5.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-debuginfo@2.0.115-1.el5?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "cman-0:2.0.115-1.el5.ppc",
"product": {
"name": "cman-0:2.0.115-1.el5.ppc",
"product_id": "cman-0:2.0.115-1.el5.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman@2.0.115-1.el5?arch=ppc"
}
}
},
{
"category": "product_version",
"name": "cman-devel-0:2.0.115-1.el5.ppc",
"product": {
"name": "cman-devel-0:2.0.115-1.el5.ppc",
"product_id": "cman-devel-0:2.0.115-1.el5.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-devel@2.0.115-1.el5?arch=ppc"
}
}
},
{
"category": "product_version",
"name": "cman-debuginfo-0:2.0.115-1.el5.ppc",
"product": {
"name": "cman-debuginfo-0:2.0.115-1.el5.ppc",
"product_id": "cman-debuginfo-0:2.0.115-1.el5.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-debuginfo@2.0.115-1.el5?arch=ppc"
}
}
}
],
"category": "architecture",
"name": "ppc"
},
{
"branches": [
{
"category": "product_version",
"name": "cman-devel-0:2.0.115-1.el5.ppc64",
"product": {
"name": "cman-devel-0:2.0.115-1.el5.ppc64",
"product_id": "cman-devel-0:2.0.115-1.el5.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-devel@2.0.115-1.el5?arch=ppc64"
}
}
},
{
"category": "product_version",
"name": "cman-debuginfo-0:2.0.115-1.el5.ppc64",
"product": {
"name": "cman-debuginfo-0:2.0.115-1.el5.ppc64",
"product_id": "cman-debuginfo-0:2.0.115-1.el5.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-debuginfo@2.0.115-1.el5?arch=ppc64"
}
}
}
],
"category": "architecture",
"name": "ppc64"
},
{
"branches": [
{
"category": "product_version",
"name": "cman-0:2.0.115-1.el5.s390x",
"product": {
"name": "cman-0:2.0.115-1.el5.s390x",
"product_id": "cman-0:2.0.115-1.el5.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman@2.0.115-1.el5?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "cman-devel-0:2.0.115-1.el5.s390x",
"product": {
"name": "cman-devel-0:2.0.115-1.el5.s390x",
"product_id": "cman-devel-0:2.0.115-1.el5.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-devel@2.0.115-1.el5?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "cman-debuginfo-0:2.0.115-1.el5.s390x",
"product": {
"name": "cman-debuginfo-0:2.0.115-1.el5.s390x",
"product_id": "cman-debuginfo-0:2.0.115-1.el5.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-debuginfo@2.0.115-1.el5?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "cman-devel-0:2.0.115-1.el5.s390",
"product": {
"name": "cman-devel-0:2.0.115-1.el5.s390",
"product_id": "cman-devel-0:2.0.115-1.el5.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-devel@2.0.115-1.el5?arch=s390"
}
}
},
{
"category": "product_version",
"name": "cman-debuginfo-0:2.0.115-1.el5.s390",
"product": {
"name": "cman-debuginfo-0:2.0.115-1.el5.s390",
"product_id": "cman-debuginfo-0:2.0.115-1.el5.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-debuginfo@2.0.115-1.el5?arch=s390"
}
}
}
],
"category": "architecture",
"name": "s390"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-0:2.0.115-1.el5.i386"
},
"product_reference": "cman-0:2.0.115-1.el5.i386",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-0:2.0.115-1.el5.ia64"
},
"product_reference": "cman-0:2.0.115-1.el5.ia64",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-0:2.0.115-1.el5.ppc"
},
"product_reference": "cman-0:2.0.115-1.el5.ppc",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-0:2.0.115-1.el5.s390x"
},
"product_reference": "cman-0:2.0.115-1.el5.s390x",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.src as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-0:2.0.115-1.el5.src"
},
"product_reference": "cman-0:2.0.115-1.el5.src",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-0:2.0.115-1.el5.x86_64"
},
"product_reference": "cman-0:2.0.115-1.el5.x86_64",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.i386"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.i386",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ia64"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.ia64",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.ppc",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.ppc64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc64"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.ppc64",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.s390 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.s390",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390x"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.s390x",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.x86_64"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.x86_64",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-devel-0:2.0.115-1.el5.i386"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.i386",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-devel-0:2.0.115-1.el5.ia64"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.ia64",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.ppc",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.ppc64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc64"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.ppc64",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.s390 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.s390",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390x"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.s390x",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-devel-0:2.0.115-1.el5.x86_64"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.x86_64",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-0:2.0.115-1.el5.i386"
},
"product_reference": "cman-0:2.0.115-1.el5.i386",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-0:2.0.115-1.el5.ia64"
},
"product_reference": "cman-0:2.0.115-1.el5.ia64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-0:2.0.115-1.el5.ppc"
},
"product_reference": "cman-0:2.0.115-1.el5.ppc",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-0:2.0.115-1.el5.s390x"
},
"product_reference": "cman-0:2.0.115-1.el5.s390x",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.src as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-0:2.0.115-1.el5.src"
},
"product_reference": "cman-0:2.0.115-1.el5.src",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-0:2.0.115-1.el5.x86_64"
},
"product_reference": "cman-0:2.0.115-1.el5.x86_64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-debuginfo-0:2.0.115-1.el5.i386"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.i386",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-debuginfo-0:2.0.115-1.el5.ia64"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.ia64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-debuginfo-0:2.0.115-1.el5.ppc"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.ppc",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.ppc64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-debuginfo-0:2.0.115-1.el5.ppc64"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.ppc64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.s390 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-debuginfo-0:2.0.115-1.el5.s390"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.s390",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-debuginfo-0:2.0.115-1.el5.s390x"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.s390x",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-debuginfo-0:2.0.115-1.el5.x86_64"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.x86_64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-devel-0:2.0.115-1.el5.i386"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.i386",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-devel-0:2.0.115-1.el5.ia64"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.ia64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-devel-0:2.0.115-1.el5.ppc"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.ppc",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.ppc64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-devel-0:2.0.115-1.el5.ppc64"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.ppc64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.s390 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-devel-0:2.0.115-1.el5.s390"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.s390",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-devel-0:2.0.115-1.el5.s390x"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.s390x",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-devel-0:2.0.115-1.el5.x86_64"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.x86_64",
"relates_to_product_reference": "5Server"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2008-4579",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2008-10-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "467386"
}
],
"notes": [
{
"category": "description",
"text": "The (1) fence_apc and (2) fence_apc_snmp programs, as used in (a) fence 2.02.00-r1 and possibly (b) cman, when running in verbose mode, allows local users to append to arbitrary files via a symlink attack on the apclog temporary file.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cman/fence: insecure temporary file usage in the apc fence agents",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-Workstation:cman-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-0:2.0.115-1.el5.src",
"5Client-Workstation:cman-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.x86_64",
"5Server:cman-0:2.0.115-1.el5.i386",
"5Server:cman-0:2.0.115-1.el5.ia64",
"5Server:cman-0:2.0.115-1.el5.ppc",
"5Server:cman-0:2.0.115-1.el5.s390x",
"5Server:cman-0:2.0.115-1.el5.src",
"5Server:cman-0:2.0.115-1.el5.x86_64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Server:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Server:cman-devel-0:2.0.115-1.el5.i386",
"5Server:cman-devel-0:2.0.115-1.el5.ia64",
"5Server:cman-devel-0:2.0.115-1.el5.ppc",
"5Server:cman-devel-0:2.0.115-1.el5.ppc64",
"5Server:cman-devel-0:2.0.115-1.el5.s390",
"5Server:cman-devel-0:2.0.115-1.el5.s390x",
"5Server:cman-devel-0:2.0.115-1.el5.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2008-4579"
},
{
"category": "external",
"summary": "RHBZ#467386",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=467386"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2008-4579",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-4579"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-4579",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-4579"
}
],
"release_date": "2008-10-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2009-09-02T08:00:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Client-Workstation:cman-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-0:2.0.115-1.el5.src",
"5Client-Workstation:cman-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.x86_64",
"5Server:cman-0:2.0.115-1.el5.i386",
"5Server:cman-0:2.0.115-1.el5.ia64",
"5Server:cman-0:2.0.115-1.el5.ppc",
"5Server:cman-0:2.0.115-1.el5.s390x",
"5Server:cman-0:2.0.115-1.el5.src",
"5Server:cman-0:2.0.115-1.el5.x86_64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Server:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Server:cman-devel-0:2.0.115-1.el5.i386",
"5Server:cman-devel-0:2.0.115-1.el5.ia64",
"5Server:cman-devel-0:2.0.115-1.el5.ppc",
"5Server:cman-devel-0:2.0.115-1.el5.ppc64",
"5Server:cman-devel-0:2.0.115-1.el5.s390",
"5Server:cman-devel-0:2.0.115-1.el5.s390x",
"5Server:cman-devel-0:2.0.115-1.el5.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2009:1341"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 1.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"5Client-Workstation:cman-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-0:2.0.115-1.el5.src",
"5Client-Workstation:cman-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.x86_64",
"5Server:cman-0:2.0.115-1.el5.i386",
"5Server:cman-0:2.0.115-1.el5.ia64",
"5Server:cman-0:2.0.115-1.el5.ppc",
"5Server:cman-0:2.0.115-1.el5.s390x",
"5Server:cman-0:2.0.115-1.el5.src",
"5Server:cman-0:2.0.115-1.el5.x86_64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Server:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Server:cman-devel-0:2.0.115-1.el5.i386",
"5Server:cman-devel-0:2.0.115-1.el5.ia64",
"5Server:cman-devel-0:2.0.115-1.el5.ppc",
"5Server:cman-devel-0:2.0.115-1.el5.ppc64",
"5Server:cman-devel-0:2.0.115-1.el5.s390",
"5Server:cman-devel-0:2.0.115-1.el5.s390x",
"5Server:cman-devel-0:2.0.115-1.el5.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "cman/fence: insecure temporary file usage in the apc fence agents"
},
{
"cve": "CVE-2008-6552",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2008-10-31T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "519436"
}
],
"notes": [
{
"category": "description",
"text": "Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rgmanager: multiple insecure temporary file use issues",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-Workstation:cman-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-0:2.0.115-1.el5.src",
"5Client-Workstation:cman-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.x86_64",
"5Server:cman-0:2.0.115-1.el5.i386",
"5Server:cman-0:2.0.115-1.el5.ia64",
"5Server:cman-0:2.0.115-1.el5.ppc",
"5Server:cman-0:2.0.115-1.el5.s390x",
"5Server:cman-0:2.0.115-1.el5.src",
"5Server:cman-0:2.0.115-1.el5.x86_64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Server:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Server:cman-devel-0:2.0.115-1.el5.i386",
"5Server:cman-devel-0:2.0.115-1.el5.ia64",
"5Server:cman-devel-0:2.0.115-1.el5.ppc",
"5Server:cman-devel-0:2.0.115-1.el5.ppc64",
"5Server:cman-devel-0:2.0.115-1.el5.s390",
"5Server:cman-devel-0:2.0.115-1.el5.s390x",
"5Server:cman-devel-0:2.0.115-1.el5.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2008-6552"
},
{
"category": "external",
"summary": "RHBZ#519436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=519436"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2008-6552",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-6552"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-6552",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-6552"
}
],
"release_date": "2008-10-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2009-09-02T08:00:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Client-Workstation:cman-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-0:2.0.115-1.el5.src",
"5Client-Workstation:cman-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.x86_64",
"5Server:cman-0:2.0.115-1.el5.i386",
"5Server:cman-0:2.0.115-1.el5.ia64",
"5Server:cman-0:2.0.115-1.el5.ppc",
"5Server:cman-0:2.0.115-1.el5.s390x",
"5Server:cman-0:2.0.115-1.el5.src",
"5Server:cman-0:2.0.115-1.el5.x86_64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Server:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Server:cman-devel-0:2.0.115-1.el5.i386",
"5Server:cman-devel-0:2.0.115-1.el5.ia64",
"5Server:cman-devel-0:2.0.115-1.el5.ppc",
"5Server:cman-devel-0:2.0.115-1.el5.ppc64",
"5Server:cman-devel-0:2.0.115-1.el5.s390",
"5Server:cman-devel-0:2.0.115-1.el5.s390x",
"5Server:cman-devel-0:2.0.115-1.el5.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2009:1341"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 5.4,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:C",
"version": "2.0"
},
"products": [
"5Client-Workstation:cman-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-0:2.0.115-1.el5.src",
"5Client-Workstation:cman-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.x86_64",
"5Server:cman-0:2.0.115-1.el5.i386",
"5Server:cman-0:2.0.115-1.el5.ia64",
"5Server:cman-0:2.0.115-1.el5.ppc",
"5Server:cman-0:2.0.115-1.el5.s390x",
"5Server:cman-0:2.0.115-1.el5.src",
"5Server:cman-0:2.0.115-1.el5.x86_64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Server:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Server:cman-devel-0:2.0.115-1.el5.i386",
"5Server:cman-devel-0:2.0.115-1.el5.ia64",
"5Server:cman-devel-0:2.0.115-1.el5.ppc",
"5Server:cman-devel-0:2.0.115-1.el5.ppc64",
"5Server:cman-devel-0:2.0.115-1.el5.s390",
"5Server:cman-devel-0:2.0.115-1.el5.s390x",
"5Server:cman-devel-0:2.0.115-1.el5.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "rgmanager: multiple insecure temporary file use issues"
}
]
}
rhsa-2009:1339
Vulnerability from csaf_redhat
Published
2009-09-02 08:00
Modified
2025-11-08 03:24
Summary
Red Hat Security Advisory: rgmanager security, bug fix, and enhancement update
Notes
Topic
An updated rgmanager package that fixes multiple security issues, various
bugs, and adds enhancements is now available for Red Hat Enterprise Linux
5.
This update has been rated as having low security impact by the Red Hat
Security Response Team.
Details
The rgmanager package contains the Red Hat Resource Group Manager, which
provides high availability for critical server applications in the event of
system downtime.
Multiple insecure temporary file use flaws were discovered in rgmanager and
various resource scripts run by rgmanager. A local attacker could use these
flaws to overwrite an arbitrary file writable by the rgmanager process
(i.e. user root) with the output of rgmanager or a resource agent via a
symbolic link attack. (CVE-2008-6552)
This update also fixes the following bugs:
* clulog now accepts '-' as the first character in messages.
* if expire_time is 0, max_restarts is no longer ignored.
* the SAP resource agents included in the rgmanager package shipped with
Red Hat Enterprise Linux 5.3 were outdated. This update includes the most
recent SAP resource agents and, consequently, improves SAP failover
support.
* empty PID files no longer cause resource start failures.
* recovery policy of type 'restart' now works properly when using a
resource based on ra-skelet.sh.
* samba.sh has been updated to kill the PID listed in the proper PID file.
* handling of the '-F' option has been improved to fix issues causing
rgmanager to crash if no members of a restricted failover domain were
online.
* the number of simultaneous status checks can now be limited to prevent
load spikes.
* forking and cloning during status checks has been optimized to reduce
load spikes.
* rg_test no longer hangs when run with large cluster configuration files.
* when rgmanager is used with a restricted failover domain it will no
longer occasionally segfault when some nodes are offline during a failover
event.
* virtual machine guests no longer restart after a cluster.conf update.
* nfsclient.sh no longer leaves temporary files after running.
* extra checks from the Oracle agents have been removed.
* vm.sh now uses libvirt.
* users can now define an explicit service processing order when
central_processing is enabled.
* virtual machine guests can no longer start on 2 nodes at the same time.
* in some cases a successfully migrated virtual machine guest could restart
when the cluster.conf file was updated.
* incorrect reporting of a service being started when it was not started
has been addressed.
As well, this update adds the following enhancements:
* a startup_wait option has been added to the MySQL resource agent.
* services can now be prioritized.
* rgmanager now checks to see if it has been killed by the OOM killer and
if so, reboots the node.
Users of rgmanager are advised to upgrade to this updated package, which
resolves these issues and adds these enhancements.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Low"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An updated rgmanager package that fixes multiple security issues, various\nbugs, and adds enhancements is now available for Red Hat Enterprise Linux\n5.\n\nThis update has been rated as having low security impact by the Red Hat\nSecurity Response Team.",
"title": "Topic"
},
{
"category": "general",
"text": "The rgmanager package contains the Red Hat Resource Group Manager, which\nprovides high availability for critical server applications in the event of\nsystem downtime.\n\nMultiple insecure temporary file use flaws were discovered in rgmanager and\nvarious resource scripts run by rgmanager. A local attacker could use these\nflaws to overwrite an arbitrary file writable by the rgmanager process\n(i.e. user root) with the output of rgmanager or a resource agent via a\nsymbolic link attack. (CVE-2008-6552)\n\nThis update also fixes the following bugs:\n\n* clulog now accepts \u0027-\u0027 as the first character in messages.\n\n* if expire_time is 0, max_restarts is no longer ignored.\n\n* the SAP resource agents included in the rgmanager package shipped with\nRed Hat Enterprise Linux 5.3 were outdated. This update includes the most\nrecent SAP resource agents and, consequently, improves SAP failover\nsupport.\n\n* empty PID files no longer cause resource start failures.\n\n* recovery policy of type \u0027restart\u0027 now works properly when using a\nresource based on ra-skelet.sh.\n\n* samba.sh has been updated to kill the PID listed in the proper PID file.\n\n* handling of the \u0027-F\u0027 option has been improved to fix issues causing\nrgmanager to crash if no members of a restricted failover domain were\nonline.\n\n* the number of simultaneous status checks can now be limited to prevent\nload spikes.\n\n* forking and cloning during status checks has been optimized to reduce\nload spikes.\n\n* rg_test no longer hangs when run with large cluster configuration files.\n\n* when rgmanager is used with a restricted failover domain it will no\nlonger occasionally segfault when some nodes are offline during a failover\nevent.\n\n* virtual machine guests no longer restart after a cluster.conf update.\n\n* nfsclient.sh no longer leaves temporary files after running.\n\n* extra checks from the Oracle agents have been removed.\n\n* vm.sh now uses libvirt.\n\n* users can now define an explicit service processing order when\ncentral_processing is enabled.\n\n* virtual machine guests can no longer start on 2 nodes at the same time.\n\n* in some cases a successfully migrated virtual machine guest could restart\nwhen the cluster.conf file was updated.\n\n* incorrect reporting of a service being started when it was not started\nhas been addressed.\n\nAs well, this update adds the following enhancements:\n\n* a startup_wait option has been added to the MySQL resource agent.\n\n* services can now be prioritized.\n\n* rgmanager now checks to see if it has been killed by the OOM killer and\nif so, reboots the node.\n\nUsers of rgmanager are advised to upgrade to this updated package, which\nresolves these issues and adds these enhancements.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2009:1339",
"url": "https://access.redhat.com/errata/RHSA-2009:1339"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#low",
"url": "https://access.redhat.com/security/updates/classification/#low"
},
{
"category": "external",
"summary": "250718",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=250718"
},
{
"category": "external",
"summary": "412911",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=412911"
},
{
"category": "external",
"summary": "449394",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=449394"
},
{
"category": "external",
"summary": "468691",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=468691"
},
{
"category": "external",
"summary": "470917",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=470917"
},
{
"category": "external",
"summary": "471066",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=471066"
},
{
"category": "external",
"summary": "471226",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=471226"
},
{
"category": "external",
"summary": "471431",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=471431"
},
{
"category": "external",
"summary": "474444",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=474444"
},
{
"category": "external",
"summary": "475826",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=475826"
},
{
"category": "external",
"summary": "481058",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=481058"
},
{
"category": "external",
"summary": "482858",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=482858"
},
{
"category": "external",
"summary": "483093",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=483093"
},
{
"category": "external",
"summary": "486349",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=486349"
},
{
"category": "external",
"summary": "486717",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=486717"
},
{
"category": "external",
"summary": "488714",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=488714"
},
{
"category": "external",
"summary": "489785",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=489785"
},
{
"category": "external",
"summary": "490449",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=490449"
},
{
"category": "external",
"summary": "490455",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=490455"
},
{
"category": "external",
"summary": "492828",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=492828"
},
{
"category": "external",
"summary": "494977",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=494977"
},
{
"category": "external",
"summary": "505340",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=505340"
},
{
"category": "external",
"summary": "514044",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=514044"
},
{
"category": "external",
"summary": "519436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=519436"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1339.json"
}
],
"title": "Red Hat Security Advisory: rgmanager security, bug fix, and enhancement update",
"tracking": {
"current_release_date": "2025-11-08T03:24:14+00:00",
"generator": {
"date": "2025-11-08T03:24:14+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2009:1339",
"initial_release_date": "2009-09-02T08:00:00+00:00",
"revision_history": [
{
"date": "2009-09-02T08:00:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2009-09-01T06:42:29+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-08T03:24:14+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Clustering (v. 5 server)",
"product": {
"name": "Red Hat Enterprise Linux Clustering (v. 5 server)",
"product_id": "5Server-Cluster",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_cluster:5"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.ia64",
"product": {
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.ia64",
"product_id": "rgmanager-debuginfo-0:2.0.52-1.el5.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager-debuginfo@2.0.52-1.el5?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "rgmanager-0:2.0.52-1.el5.ia64",
"product": {
"name": "rgmanager-0:2.0.52-1.el5.ia64",
"product_id": "rgmanager-0:2.0.52-1.el5.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager@2.0.52-1.el5?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.ppc",
"product": {
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.ppc",
"product_id": "rgmanager-debuginfo-0:2.0.52-1.el5.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager-debuginfo@2.0.52-1.el5?arch=ppc"
}
}
},
{
"category": "product_version",
"name": "rgmanager-0:2.0.52-1.el5.ppc",
"product": {
"name": "rgmanager-0:2.0.52-1.el5.ppc",
"product_id": "rgmanager-0:2.0.52-1.el5.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager@2.0.52-1.el5?arch=ppc"
}
}
}
],
"category": "architecture",
"name": "ppc"
},
{
"branches": [
{
"category": "product_version",
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.x86_64",
"product": {
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.x86_64",
"product_id": "rgmanager-debuginfo-0:2.0.52-1.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager-debuginfo@2.0.52-1.el5?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rgmanager-0:2.0.52-1.el5.x86_64",
"product": {
"name": "rgmanager-0:2.0.52-1.el5.x86_64",
"product_id": "rgmanager-0:2.0.52-1.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager@2.0.52-1.el5?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.i386",
"product": {
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.i386",
"product_id": "rgmanager-debuginfo-0:2.0.52-1.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager-debuginfo@2.0.52-1.el5?arch=i386"
}
}
},
{
"category": "product_version",
"name": "rgmanager-0:2.0.52-1.el5.i386",
"product": {
"name": "rgmanager-0:2.0.52-1.el5.i386",
"product_id": "rgmanager-0:2.0.52-1.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager@2.0.52-1.el5?arch=i386"
}
}
}
],
"category": "architecture",
"name": "i386"
},
{
"branches": [
{
"category": "product_version",
"name": "rgmanager-0:2.0.52-1.el5.src",
"product": {
"name": "rgmanager-0:2.0.52-1.el5.src",
"product_id": "rgmanager-0:2.0.52-1.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager@2.0.52-1.el5?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:2.0.52-1.el5.i386 as a component of Red Hat Enterprise Linux Clustering (v. 5 server)",
"product_id": "5Server-Cluster:rgmanager-0:2.0.52-1.el5.i386"
},
"product_reference": "rgmanager-0:2.0.52-1.el5.i386",
"relates_to_product_reference": "5Server-Cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:2.0.52-1.el5.ia64 as a component of Red Hat Enterprise Linux Clustering (v. 5 server)",
"product_id": "5Server-Cluster:rgmanager-0:2.0.52-1.el5.ia64"
},
"product_reference": "rgmanager-0:2.0.52-1.el5.ia64",
"relates_to_product_reference": "5Server-Cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:2.0.52-1.el5.ppc as a component of Red Hat Enterprise Linux Clustering (v. 5 server)",
"product_id": "5Server-Cluster:rgmanager-0:2.0.52-1.el5.ppc"
},
"product_reference": "rgmanager-0:2.0.52-1.el5.ppc",
"relates_to_product_reference": "5Server-Cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:2.0.52-1.el5.src as a component of Red Hat Enterprise Linux Clustering (v. 5 server)",
"product_id": "5Server-Cluster:rgmanager-0:2.0.52-1.el5.src"
},
"product_reference": "rgmanager-0:2.0.52-1.el5.src",
"relates_to_product_reference": "5Server-Cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:2.0.52-1.el5.x86_64 as a component of Red Hat Enterprise Linux Clustering (v. 5 server)",
"product_id": "5Server-Cluster:rgmanager-0:2.0.52-1.el5.x86_64"
},
"product_reference": "rgmanager-0:2.0.52-1.el5.x86_64",
"relates_to_product_reference": "5Server-Cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.i386 as a component of Red Hat Enterprise Linux Clustering (v. 5 server)",
"product_id": "5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.i386"
},
"product_reference": "rgmanager-debuginfo-0:2.0.52-1.el5.i386",
"relates_to_product_reference": "5Server-Cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.ia64 as a component of Red Hat Enterprise Linux Clustering (v. 5 server)",
"product_id": "5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.ia64"
},
"product_reference": "rgmanager-debuginfo-0:2.0.52-1.el5.ia64",
"relates_to_product_reference": "5Server-Cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.ppc as a component of Red Hat Enterprise Linux Clustering (v. 5 server)",
"product_id": "5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.ppc"
},
"product_reference": "rgmanager-debuginfo-0:2.0.52-1.el5.ppc",
"relates_to_product_reference": "5Server-Cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.x86_64 as a component of Red Hat Enterprise Linux Clustering (v. 5 server)",
"product_id": "5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.x86_64"
},
"product_reference": "rgmanager-debuginfo-0:2.0.52-1.el5.x86_64",
"relates_to_product_reference": "5Server-Cluster"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2008-6552",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2008-10-31T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "519436"
}
],
"notes": [
{
"category": "description",
"text": "Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rgmanager: multiple insecure temporary file use issues",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.i386",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.ia64",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.ppc",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.src",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.x86_64",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.i386",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.ia64",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.ppc",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2008-6552"
},
{
"category": "external",
"summary": "RHBZ#519436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=519436"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2008-6552",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-6552"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-6552",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-6552"
}
],
"release_date": "2008-10-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2009-09-02T08:00:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.i386",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.ia64",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.ppc",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.src",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.x86_64",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.i386",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.ia64",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.ppc",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2009:1339"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 5.4,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:C",
"version": "2.0"
},
"products": [
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.i386",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.ia64",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.ppc",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.src",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.x86_64",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.i386",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.ia64",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.ppc",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "rgmanager: multiple insecure temporary file use issues"
}
]
}
rhsa-2009:1341
Vulnerability from csaf_redhat
Published
2009-09-02 08:00
Modified
2025-11-08 03:24
Summary
Red Hat Security Advisory: cman security, bug fix, and enhancement update
Notes
Topic
Updated cman packages that fix several security issues, various bugs, and
add enhancements are now available for Red Hat Enterprise Linux 5.
This update has been rated as having low security impact by the Red Hat
Security Response Team.
Details
The Cluster Manager (cman) utility provides services for managing a Linux
cluster.
Multiple insecure temporary file use flaws were found in fence_apc_snmp and
ccs_tool. A local attacker could use these flaws to overwrite an arbitrary
file writable by a victim running those utilities (typically root) with
the output of the utilities via a symbolic link attack. (CVE-2008-4579,
CVE-2008-6552)
Bug fixes:
* a buffer could overflow if cluster.conf had more than 52 entries per
block inside the <cman> block. The limit is now 1024.
* the output of the group_tool dump subcommands were NULL padded.
* using device="" instead of label="" no longer causes qdiskd to
incorrectly exit.
* the IPMI fencing agent has been modified to time out after 10 seconds. It
is also now possible to specify a different timeout value with the '-t'
option.
* the IPMI fencing agent now allows punctuation in passwords.
* quickly starting and stopping the cman service no longer causes the
cluster membership to become inconsistent across the cluster.
* an issue with lock syncing caused 'receive_own from' errors to be logged
to '/var/log/messages'.
* an issue which caused gfs_controld to segfault when mounting hundreds of
file systems has been fixed.
* the LPAR fencing agent now properly reports status when an LPAR is in
Open Firmware mode.
* the LPAR fencing agent now works properly with systems using the
Integrated Virtualization Manager (IVM).
* the APC SNMP fencing agent now properly recognizes outletStatusOn and
outletStatusOff return codes from the SNMP agent.
* the WTI fencing agent can now connect to fencing devices with no
password.
* the rps-10 fencing agent now properly performs a reboot when run with no
options.
* the IPMI fencing agent now supports different cipher types with the '-C'
option.
* qdisk now properly scans devices and partitions.
* cman now checks to see if a new node has state to prevent killing the
first node during cluster setup.
* 'service qdiskd start' now works properly.
* the McData fence agent now works properly with the McData Sphereon 4500
Fabric Switch.
* the Egenera fence agent can now specify an SSH login name.
* the APC fence agent now works with non-admin accounts when using the
3.5.x firmware.
* fence_xvmd now tries two methods to reboot a virtual machine.
* connections to OpenAIS are now allowed from unprivileged CPG clients with
the user and group of 'ais'.
* groupd no longer allows the default fence domain to be '0', which
previously caused rgmanager to hang. Now, rgmanager no longer hangs.
* the RSA fence agent now supports SSH enabled RSA II devices.
* the DRAC fence agent now works with the Integrated Dell Remote Access
Controller (iDRAC) on Dell PowerEdge M600 blade servers.
* fixed a memory leak in cman.
* qdisk now displays a warning if more than one label is found with the
same name.
* the DRAC5 fencing agent now shows proper usage instructions for the '-D'
option.
* cman no longer uses the wrong node name when getnameinfo() fails.
* the SCSI fence agent now verifies that sg_persist is installed.
* the DRAC5 fencing agent now properly handles modulename.
* QDisk now logs warning messages if it appears its I/O to shared storage
is hung.
* fence_apc no longer fails with a pexpect exception.
* removing a node from the cluster using 'cman_tool leave remove' now
properly reduces the expected_votes and quorum.
* a semaphore leak in cman has been fixed.
* 'cman_tool nodes -F name' no longer segfaults when a node is out of
membership.
Enhancements:
* support for: ePowerSwitch 8+ and LPAR/HMC v3 devices, Cisco MDS 9124 and
MDS 9134 SAN switches, the virsh fencing agent, and broadcast communication
with cman.
* fence_scsi limitations added to fence_scsi man page.
Users of cman are advised to upgrade to these updated packages, which
resolve these issues and add these enhancements.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Low"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated cman packages that fix several security issues, various bugs, and\nadd enhancements are now available for Red Hat Enterprise Linux 5.\n\nThis update has been rated as having low security impact by the Red Hat\nSecurity Response Team.",
"title": "Topic"
},
{
"category": "general",
"text": "The Cluster Manager (cman) utility provides services for managing a Linux\ncluster.\n\nMultiple insecure temporary file use flaws were found in fence_apc_snmp and\nccs_tool. A local attacker could use these flaws to overwrite an arbitrary\nfile writable by a victim running those utilities (typically root) with\nthe output of the utilities via a symbolic link attack. (CVE-2008-4579,\nCVE-2008-6552)\n\nBug fixes:\n\n* a buffer could overflow if cluster.conf had more than 52 entries per\nblock inside the \u003ccman\u003e block. The limit is now 1024.\n\n* the output of the group_tool dump subcommands were NULL padded.\n\n* using device=\"\" instead of label=\"\" no longer causes qdiskd to\nincorrectly exit.\n\n* the IPMI fencing agent has been modified to time out after 10 seconds. It\nis also now possible to specify a different timeout value with the \u0027-t\u0027\noption.\n\n* the IPMI fencing agent now allows punctuation in passwords.\n\n* quickly starting and stopping the cman service no longer causes the\ncluster membership to become inconsistent across the cluster.\n\n* an issue with lock syncing caused \u0027receive_own from\u0027 errors to be logged\nto \u0027/var/log/messages\u0027.\n\n* an issue which caused gfs_controld to segfault when mounting hundreds of\nfile systems has been fixed.\n\n* the LPAR fencing agent now properly reports status when an LPAR is in\nOpen Firmware mode.\n\n* the LPAR fencing agent now works properly with systems using the\nIntegrated Virtualization Manager (IVM).\n\n* the APC SNMP fencing agent now properly recognizes outletStatusOn and\noutletStatusOff return codes from the SNMP agent.\n\n* the WTI fencing agent can now connect to fencing devices with no\npassword.\n\n* the rps-10 fencing agent now properly performs a reboot when run with no\noptions.\n\n* the IPMI fencing agent now supports different cipher types with the \u0027-C\u0027\noption.\n\n* qdisk now properly scans devices and partitions.\n\n* cman now checks to see if a new node has state to prevent killing the\nfirst node during cluster setup.\n\n* \u0027service qdiskd start\u0027 now works properly.\n\n* the McData fence agent now works properly with the McData Sphereon 4500\nFabric Switch.\n\n* the Egenera fence agent can now specify an SSH login name.\n\n* the APC fence agent now works with non-admin accounts when using the\n3.5.x firmware.\n\n* fence_xvmd now tries two methods to reboot a virtual machine.\n\n* connections to OpenAIS are now allowed from unprivileged CPG clients with\nthe user and group of \u0027ais\u0027.\n\n* groupd no longer allows the default fence domain to be \u00270\u0027, which\npreviously caused rgmanager to hang. Now, rgmanager no longer hangs.\n\n* the RSA fence agent now supports SSH enabled RSA II devices.\n\n* the DRAC fence agent now works with the Integrated Dell Remote Access\nController (iDRAC) on Dell PowerEdge M600 blade servers.\n\n* fixed a memory leak in cman.\n\n* qdisk now displays a warning if more than one label is found with the\nsame name.\n\n* the DRAC5 fencing agent now shows proper usage instructions for the \u0027-D\u0027\noption.\n\n* cman no longer uses the wrong node name when getnameinfo() fails.\n\n* the SCSI fence agent now verifies that sg_persist is installed.\n\n* the DRAC5 fencing agent now properly handles modulename.\n\n* QDisk now logs warning messages if it appears its I/O to shared storage\nis hung.\n\n* fence_apc no longer fails with a pexpect exception.\n\n* removing a node from the cluster using \u0027cman_tool leave remove\u0027 now\nproperly reduces the expected_votes and quorum.\n\n* a semaphore leak in cman has been fixed.\n\n* \u0027cman_tool nodes -F name\u0027 no longer segfaults when a node is out of\nmembership.\n\nEnhancements:\n\n* support for: ePowerSwitch 8+ and LPAR/HMC v3 devices, Cisco MDS 9124 and\nMDS 9134 SAN switches, the virsh fencing agent, and broadcast communication\nwith cman.\n\n* fence_scsi limitations added to fence_scsi man page.\n\nUsers of cman are advised to upgrade to these updated packages, which\nresolve these issues and add these enhancements.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2009:1341",
"url": "https://access.redhat.com/errata/RHSA-2009:1341"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#low",
"url": "https://access.redhat.com/security/updates/classification/#low"
},
{
"category": "external",
"summary": "276541",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=276541"
},
{
"category": "external",
"summary": "322291",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=322291"
},
{
"category": "external",
"summary": "447497",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=447497"
},
{
"category": "external",
"summary": "447964",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=447964"
},
{
"category": "external",
"summary": "467386",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=467386"
},
{
"category": "external",
"summary": "468966",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=468966"
},
{
"category": "external",
"summary": "472460",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=472460"
},
{
"category": "external",
"summary": "472786",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=472786"
},
{
"category": "external",
"summary": "473961",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=473961"
},
{
"category": "external",
"summary": "474163",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=474163"
},
{
"category": "external",
"summary": "480178",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=480178"
},
{
"category": "external",
"summary": "480401",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=480401"
},
{
"category": "external",
"summary": "480836",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=480836"
},
{
"category": "external",
"summary": "481566",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=481566"
},
{
"category": "external",
"summary": "481664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=481664"
},
{
"category": "external",
"summary": "484095",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=484095"
},
{
"category": "external",
"summary": "484956",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=484956"
},
{
"category": "external",
"summary": "485026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=485026"
},
{
"category": "external",
"summary": "485469",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=485469"
},
{
"category": "external",
"summary": "485700",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=485700"
},
{
"category": "external",
"summary": "487436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=487436"
},
{
"category": "external",
"summary": "487501",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=487501"
},
{
"category": "external",
"summary": "488565",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=488565"
},
{
"category": "external",
"summary": "488958",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=488958"
},
{
"category": "external",
"summary": "491640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=491640"
},
{
"category": "external",
"summary": "493165",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=493165"
},
{
"category": "external",
"summary": "493207",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=493207"
},
{
"category": "external",
"summary": "493802",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=493802"
},
{
"category": "external",
"summary": "496629",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=496629"
},
{
"category": "external",
"summary": "496724",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=496724"
},
{
"category": "external",
"summary": "498329",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=498329"
},
{
"category": "external",
"summary": "499767",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=499767"
},
{
"category": "external",
"summary": "500450",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=500450"
},
{
"category": "external",
"summary": "500567",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=500567"
},
{
"category": "external",
"summary": "501586",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=501586"
},
{
"category": "external",
"summary": "502674",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=502674"
},
{
"category": "external",
"summary": "504705",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=504705"
},
{
"category": "external",
"summary": "505258",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=505258"
},
{
"category": "external",
"summary": "505594",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=505594"
},
{
"category": "external",
"summary": "512998",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=512998"
},
{
"category": "external",
"summary": "514758",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=514758"
},
{
"category": "external",
"summary": "485199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=485199"
},
{
"category": "external",
"summary": "519436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=519436"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1341.json"
}
],
"title": "Red Hat Security Advisory: cman security, bug fix, and enhancement update",
"tracking": {
"current_release_date": "2025-11-08T03:24:14+00:00",
"generator": {
"date": "2025-11-08T03:24:14+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2009:1341",
"initial_release_date": "2009-09-02T08:00:00+00:00",
"revision_history": [
{
"date": "2009-09-02T08:00:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2009-09-01T06:43:16+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-08T03:24:14+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product": {
"name": "Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:5::client_workstation"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux (v. 5 server)",
"product": {
"name": "Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:5::server"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "cman-0:2.0.115-1.el5.src",
"product": {
"name": "cman-0:2.0.115-1.el5.src",
"product_id": "cman-0:2.0.115-1.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman@2.0.115-1.el5?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "cman-0:2.0.115-1.el5.x86_64",
"product": {
"name": "cman-0:2.0.115-1.el5.x86_64",
"product_id": "cman-0:2.0.115-1.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman@2.0.115-1.el5?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "cman-devel-0:2.0.115-1.el5.x86_64",
"product": {
"name": "cman-devel-0:2.0.115-1.el5.x86_64",
"product_id": "cman-devel-0:2.0.115-1.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-devel@2.0.115-1.el5?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "cman-debuginfo-0:2.0.115-1.el5.x86_64",
"product": {
"name": "cman-debuginfo-0:2.0.115-1.el5.x86_64",
"product_id": "cman-debuginfo-0:2.0.115-1.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-debuginfo@2.0.115-1.el5?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "cman-devel-0:2.0.115-1.el5.i386",
"product": {
"name": "cman-devel-0:2.0.115-1.el5.i386",
"product_id": "cman-devel-0:2.0.115-1.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-devel@2.0.115-1.el5?arch=i386"
}
}
},
{
"category": "product_version",
"name": "cman-debuginfo-0:2.0.115-1.el5.i386",
"product": {
"name": "cman-debuginfo-0:2.0.115-1.el5.i386",
"product_id": "cman-debuginfo-0:2.0.115-1.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-debuginfo@2.0.115-1.el5?arch=i386"
}
}
},
{
"category": "product_version",
"name": "cman-0:2.0.115-1.el5.i386",
"product": {
"name": "cman-0:2.0.115-1.el5.i386",
"product_id": "cman-0:2.0.115-1.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman@2.0.115-1.el5?arch=i386"
}
}
}
],
"category": "architecture",
"name": "i386"
},
{
"branches": [
{
"category": "product_version",
"name": "cman-0:2.0.115-1.el5.ia64",
"product": {
"name": "cman-0:2.0.115-1.el5.ia64",
"product_id": "cman-0:2.0.115-1.el5.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman@2.0.115-1.el5?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "cman-devel-0:2.0.115-1.el5.ia64",
"product": {
"name": "cman-devel-0:2.0.115-1.el5.ia64",
"product_id": "cman-devel-0:2.0.115-1.el5.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-devel@2.0.115-1.el5?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "cman-debuginfo-0:2.0.115-1.el5.ia64",
"product": {
"name": "cman-debuginfo-0:2.0.115-1.el5.ia64",
"product_id": "cman-debuginfo-0:2.0.115-1.el5.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-debuginfo@2.0.115-1.el5?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "cman-0:2.0.115-1.el5.ppc",
"product": {
"name": "cman-0:2.0.115-1.el5.ppc",
"product_id": "cman-0:2.0.115-1.el5.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman@2.0.115-1.el5?arch=ppc"
}
}
},
{
"category": "product_version",
"name": "cman-devel-0:2.0.115-1.el5.ppc",
"product": {
"name": "cman-devel-0:2.0.115-1.el5.ppc",
"product_id": "cman-devel-0:2.0.115-1.el5.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-devel@2.0.115-1.el5?arch=ppc"
}
}
},
{
"category": "product_version",
"name": "cman-debuginfo-0:2.0.115-1.el5.ppc",
"product": {
"name": "cman-debuginfo-0:2.0.115-1.el5.ppc",
"product_id": "cman-debuginfo-0:2.0.115-1.el5.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-debuginfo@2.0.115-1.el5?arch=ppc"
}
}
}
],
"category": "architecture",
"name": "ppc"
},
{
"branches": [
{
"category": "product_version",
"name": "cman-devel-0:2.0.115-1.el5.ppc64",
"product": {
"name": "cman-devel-0:2.0.115-1.el5.ppc64",
"product_id": "cman-devel-0:2.0.115-1.el5.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-devel@2.0.115-1.el5?arch=ppc64"
}
}
},
{
"category": "product_version",
"name": "cman-debuginfo-0:2.0.115-1.el5.ppc64",
"product": {
"name": "cman-debuginfo-0:2.0.115-1.el5.ppc64",
"product_id": "cman-debuginfo-0:2.0.115-1.el5.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-debuginfo@2.0.115-1.el5?arch=ppc64"
}
}
}
],
"category": "architecture",
"name": "ppc64"
},
{
"branches": [
{
"category": "product_version",
"name": "cman-0:2.0.115-1.el5.s390x",
"product": {
"name": "cman-0:2.0.115-1.el5.s390x",
"product_id": "cman-0:2.0.115-1.el5.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman@2.0.115-1.el5?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "cman-devel-0:2.0.115-1.el5.s390x",
"product": {
"name": "cman-devel-0:2.0.115-1.el5.s390x",
"product_id": "cman-devel-0:2.0.115-1.el5.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-devel@2.0.115-1.el5?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "cman-debuginfo-0:2.0.115-1.el5.s390x",
"product": {
"name": "cman-debuginfo-0:2.0.115-1.el5.s390x",
"product_id": "cman-debuginfo-0:2.0.115-1.el5.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-debuginfo@2.0.115-1.el5?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "cman-devel-0:2.0.115-1.el5.s390",
"product": {
"name": "cman-devel-0:2.0.115-1.el5.s390",
"product_id": "cman-devel-0:2.0.115-1.el5.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-devel@2.0.115-1.el5?arch=s390"
}
}
},
{
"category": "product_version",
"name": "cman-debuginfo-0:2.0.115-1.el5.s390",
"product": {
"name": "cman-debuginfo-0:2.0.115-1.el5.s390",
"product_id": "cman-debuginfo-0:2.0.115-1.el5.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-debuginfo@2.0.115-1.el5?arch=s390"
}
}
}
],
"category": "architecture",
"name": "s390"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-0:2.0.115-1.el5.i386"
},
"product_reference": "cman-0:2.0.115-1.el5.i386",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-0:2.0.115-1.el5.ia64"
},
"product_reference": "cman-0:2.0.115-1.el5.ia64",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-0:2.0.115-1.el5.ppc"
},
"product_reference": "cman-0:2.0.115-1.el5.ppc",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-0:2.0.115-1.el5.s390x"
},
"product_reference": "cman-0:2.0.115-1.el5.s390x",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.src as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-0:2.0.115-1.el5.src"
},
"product_reference": "cman-0:2.0.115-1.el5.src",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-0:2.0.115-1.el5.x86_64"
},
"product_reference": "cman-0:2.0.115-1.el5.x86_64",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.i386"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.i386",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ia64"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.ia64",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.ppc",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.ppc64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc64"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.ppc64",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.s390 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.s390",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390x"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.s390x",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.x86_64"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.x86_64",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-devel-0:2.0.115-1.el5.i386"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.i386",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-devel-0:2.0.115-1.el5.ia64"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.ia64",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.ppc",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.ppc64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc64"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.ppc64",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.s390 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.s390",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390x"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.s390x",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-devel-0:2.0.115-1.el5.x86_64"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.x86_64",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-0:2.0.115-1.el5.i386"
},
"product_reference": "cman-0:2.0.115-1.el5.i386",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-0:2.0.115-1.el5.ia64"
},
"product_reference": "cman-0:2.0.115-1.el5.ia64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-0:2.0.115-1.el5.ppc"
},
"product_reference": "cman-0:2.0.115-1.el5.ppc",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-0:2.0.115-1.el5.s390x"
},
"product_reference": "cman-0:2.0.115-1.el5.s390x",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.src as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-0:2.0.115-1.el5.src"
},
"product_reference": "cman-0:2.0.115-1.el5.src",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-0:2.0.115-1.el5.x86_64"
},
"product_reference": "cman-0:2.0.115-1.el5.x86_64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-debuginfo-0:2.0.115-1.el5.i386"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.i386",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-debuginfo-0:2.0.115-1.el5.ia64"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.ia64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-debuginfo-0:2.0.115-1.el5.ppc"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.ppc",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.ppc64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-debuginfo-0:2.0.115-1.el5.ppc64"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.ppc64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.s390 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-debuginfo-0:2.0.115-1.el5.s390"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.s390",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-debuginfo-0:2.0.115-1.el5.s390x"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.s390x",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-debuginfo-0:2.0.115-1.el5.x86_64"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.x86_64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-devel-0:2.0.115-1.el5.i386"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.i386",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-devel-0:2.0.115-1.el5.ia64"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.ia64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-devel-0:2.0.115-1.el5.ppc"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.ppc",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.ppc64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-devel-0:2.0.115-1.el5.ppc64"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.ppc64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.s390 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-devel-0:2.0.115-1.el5.s390"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.s390",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-devel-0:2.0.115-1.el5.s390x"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.s390x",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-devel-0:2.0.115-1.el5.x86_64"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.x86_64",
"relates_to_product_reference": "5Server"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2008-4579",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2008-10-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "467386"
}
],
"notes": [
{
"category": "description",
"text": "The (1) fence_apc and (2) fence_apc_snmp programs, as used in (a) fence 2.02.00-r1 and possibly (b) cman, when running in verbose mode, allows local users to append to arbitrary files via a symlink attack on the apclog temporary file.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cman/fence: insecure temporary file usage in the apc fence agents",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-Workstation:cman-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-0:2.0.115-1.el5.src",
"5Client-Workstation:cman-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.x86_64",
"5Server:cman-0:2.0.115-1.el5.i386",
"5Server:cman-0:2.0.115-1.el5.ia64",
"5Server:cman-0:2.0.115-1.el5.ppc",
"5Server:cman-0:2.0.115-1.el5.s390x",
"5Server:cman-0:2.0.115-1.el5.src",
"5Server:cman-0:2.0.115-1.el5.x86_64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Server:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Server:cman-devel-0:2.0.115-1.el5.i386",
"5Server:cman-devel-0:2.0.115-1.el5.ia64",
"5Server:cman-devel-0:2.0.115-1.el5.ppc",
"5Server:cman-devel-0:2.0.115-1.el5.ppc64",
"5Server:cman-devel-0:2.0.115-1.el5.s390",
"5Server:cman-devel-0:2.0.115-1.el5.s390x",
"5Server:cman-devel-0:2.0.115-1.el5.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2008-4579"
},
{
"category": "external",
"summary": "RHBZ#467386",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=467386"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2008-4579",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-4579"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-4579",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-4579"
}
],
"release_date": "2008-10-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2009-09-02T08:00:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Client-Workstation:cman-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-0:2.0.115-1.el5.src",
"5Client-Workstation:cman-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.x86_64",
"5Server:cman-0:2.0.115-1.el5.i386",
"5Server:cman-0:2.0.115-1.el5.ia64",
"5Server:cman-0:2.0.115-1.el5.ppc",
"5Server:cman-0:2.0.115-1.el5.s390x",
"5Server:cman-0:2.0.115-1.el5.src",
"5Server:cman-0:2.0.115-1.el5.x86_64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Server:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Server:cman-devel-0:2.0.115-1.el5.i386",
"5Server:cman-devel-0:2.0.115-1.el5.ia64",
"5Server:cman-devel-0:2.0.115-1.el5.ppc",
"5Server:cman-devel-0:2.0.115-1.el5.ppc64",
"5Server:cman-devel-0:2.0.115-1.el5.s390",
"5Server:cman-devel-0:2.0.115-1.el5.s390x",
"5Server:cman-devel-0:2.0.115-1.el5.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2009:1341"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 1.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"5Client-Workstation:cman-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-0:2.0.115-1.el5.src",
"5Client-Workstation:cman-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.x86_64",
"5Server:cman-0:2.0.115-1.el5.i386",
"5Server:cman-0:2.0.115-1.el5.ia64",
"5Server:cman-0:2.0.115-1.el5.ppc",
"5Server:cman-0:2.0.115-1.el5.s390x",
"5Server:cman-0:2.0.115-1.el5.src",
"5Server:cman-0:2.0.115-1.el5.x86_64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Server:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Server:cman-devel-0:2.0.115-1.el5.i386",
"5Server:cman-devel-0:2.0.115-1.el5.ia64",
"5Server:cman-devel-0:2.0.115-1.el5.ppc",
"5Server:cman-devel-0:2.0.115-1.el5.ppc64",
"5Server:cman-devel-0:2.0.115-1.el5.s390",
"5Server:cman-devel-0:2.0.115-1.el5.s390x",
"5Server:cman-devel-0:2.0.115-1.el5.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "cman/fence: insecure temporary file usage in the apc fence agents"
},
{
"cve": "CVE-2008-6552",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2008-10-31T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "519436"
}
],
"notes": [
{
"category": "description",
"text": "Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rgmanager: multiple insecure temporary file use issues",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-Workstation:cman-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-0:2.0.115-1.el5.src",
"5Client-Workstation:cman-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.x86_64",
"5Server:cman-0:2.0.115-1.el5.i386",
"5Server:cman-0:2.0.115-1.el5.ia64",
"5Server:cman-0:2.0.115-1.el5.ppc",
"5Server:cman-0:2.0.115-1.el5.s390x",
"5Server:cman-0:2.0.115-1.el5.src",
"5Server:cman-0:2.0.115-1.el5.x86_64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Server:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Server:cman-devel-0:2.0.115-1.el5.i386",
"5Server:cman-devel-0:2.0.115-1.el5.ia64",
"5Server:cman-devel-0:2.0.115-1.el5.ppc",
"5Server:cman-devel-0:2.0.115-1.el5.ppc64",
"5Server:cman-devel-0:2.0.115-1.el5.s390",
"5Server:cman-devel-0:2.0.115-1.el5.s390x",
"5Server:cman-devel-0:2.0.115-1.el5.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2008-6552"
},
{
"category": "external",
"summary": "RHBZ#519436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=519436"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2008-6552",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-6552"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-6552",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-6552"
}
],
"release_date": "2008-10-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2009-09-02T08:00:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Client-Workstation:cman-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-0:2.0.115-1.el5.src",
"5Client-Workstation:cman-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.x86_64",
"5Server:cman-0:2.0.115-1.el5.i386",
"5Server:cman-0:2.0.115-1.el5.ia64",
"5Server:cman-0:2.0.115-1.el5.ppc",
"5Server:cman-0:2.0.115-1.el5.s390x",
"5Server:cman-0:2.0.115-1.el5.src",
"5Server:cman-0:2.0.115-1.el5.x86_64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Server:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Server:cman-devel-0:2.0.115-1.el5.i386",
"5Server:cman-devel-0:2.0.115-1.el5.ia64",
"5Server:cman-devel-0:2.0.115-1.el5.ppc",
"5Server:cman-devel-0:2.0.115-1.el5.ppc64",
"5Server:cman-devel-0:2.0.115-1.el5.s390",
"5Server:cman-devel-0:2.0.115-1.el5.s390x",
"5Server:cman-devel-0:2.0.115-1.el5.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2009:1341"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 5.4,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:C",
"version": "2.0"
},
"products": [
"5Client-Workstation:cman-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-0:2.0.115-1.el5.src",
"5Client-Workstation:cman-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.x86_64",
"5Server:cman-0:2.0.115-1.el5.i386",
"5Server:cman-0:2.0.115-1.el5.ia64",
"5Server:cman-0:2.0.115-1.el5.ppc",
"5Server:cman-0:2.0.115-1.el5.s390x",
"5Server:cman-0:2.0.115-1.el5.src",
"5Server:cman-0:2.0.115-1.el5.x86_64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Server:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Server:cman-devel-0:2.0.115-1.el5.i386",
"5Server:cman-devel-0:2.0.115-1.el5.ia64",
"5Server:cman-devel-0:2.0.115-1.el5.ppc",
"5Server:cman-devel-0:2.0.115-1.el5.ppc64",
"5Server:cman-devel-0:2.0.115-1.el5.s390",
"5Server:cman-devel-0:2.0.115-1.el5.s390x",
"5Server:cman-devel-0:2.0.115-1.el5.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "rgmanager: multiple insecure temporary file use issues"
}
]
}
rhsa-2011:0265
Vulnerability from csaf_redhat
Published
2011-02-16 15:08
Modified
2025-11-08 03:24
Summary
Red Hat Security Advisory: ccs security update
Notes
Topic
Updated ccs packages that fix one security issue are now available for Red
Hat Cluster Suite 4.
The Red Hat Security Response Team has rated this update as having low
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.
Details
The Cluster Configuration System provides the ability for nodes in a
cluster to obtain information about the cluster and each other. ccs_tool is
a program for making online updates to the cluster configuration file.
An insecure temporary file use flaw was found in ccs_tool. A local attacker
could use this flaw to conduct a symbolic link attack, allowing them to
overwrite (with the output of ccs_tool) an arbitrary file writable by the
victim running ccs_tool. (CVE-2008-6552)
All ccs users should upgrade to these updated packages, which correct this
issue.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Low"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated ccs packages that fix one security issue are now available for Red\nHat Cluster Suite 4.\n\nThe Red Hat Security Response Team has rated this update as having low\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The Cluster Configuration System provides the ability for nodes in a\ncluster to obtain information about the cluster and each other. ccs_tool is\na program for making online updates to the cluster configuration file.\n\nAn insecure temporary file use flaw was found in ccs_tool. A local attacker\ncould use this flaw to conduct a symbolic link attack, allowing them to\noverwrite (with the output of ccs_tool) an arbitrary file writable by the\nvictim running ccs_tool. (CVE-2008-6552)\n\nAll ccs users should upgrade to these updated packages, which correct this\nissue.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2011:0265",
"url": "https://access.redhat.com/errata/RHSA-2011:0265"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#low",
"url": "https://access.redhat.com/security/updates/classification/#low"
},
{
"category": "external",
"summary": "498980",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=498980"
},
{
"category": "external",
"summary": "519436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=519436"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0265.json"
}
],
"title": "Red Hat Security Advisory: ccs security update",
"tracking": {
"current_release_date": "2025-11-08T03:24:22+00:00",
"generator": {
"date": "2025-11-08T03:24:22+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2011:0265",
"initial_release_date": "2011-02-16T15:08:00+00:00",
"revision_history": [
{
"date": "2011-02-16T15:08:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2011-02-16T10:14:42+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-08T03:24:22+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Cluster Suite 4AS",
"product": {
"name": "Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_cluster:4"
}
}
},
{
"category": "product_name",
"name": "Red Hat Cluster Suite 4ES",
"product": {
"name": "Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_cluster:4"
}
}
},
{
"category": "product_name",
"name": "Red Hat Cluster Suite 4WS",
"product": {
"name": "Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_cluster:4"
}
}
}
],
"category": "product_family",
"name": "Red Hat Cluster Suite"
},
{
"branches": [
{
"category": "product_version",
"name": "ccs-devel-0:1.0.13-2.i686",
"product": {
"name": "ccs-devel-0:1.0.13-2.i686",
"product_id": "ccs-devel-0:1.0.13-2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs-devel@1.0.13-2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "ccs-debuginfo-0:1.0.13-2.i686",
"product": {
"name": "ccs-debuginfo-0:1.0.13-2.i686",
"product_id": "ccs-debuginfo-0:1.0.13-2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs-debuginfo@1.0.13-2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "ccs-0:1.0.13-2.i686",
"product": {
"name": "ccs-0:1.0.13-2.i686",
"product_id": "ccs-0:1.0.13-2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs@1.0.13-2?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "ccs-devel-0:1.0.13-2.ia64",
"product": {
"name": "ccs-devel-0:1.0.13-2.ia64",
"product_id": "ccs-devel-0:1.0.13-2.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs-devel@1.0.13-2?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "ccs-debuginfo-0:1.0.13-2.ia64",
"product": {
"name": "ccs-debuginfo-0:1.0.13-2.ia64",
"product_id": "ccs-debuginfo-0:1.0.13-2.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs-debuginfo@1.0.13-2?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "ccs-0:1.0.13-2.ia64",
"product": {
"name": "ccs-0:1.0.13-2.ia64",
"product_id": "ccs-0:1.0.13-2.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs@1.0.13-2?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "ccs-devel-0:1.0.13-2.x86_64",
"product": {
"name": "ccs-devel-0:1.0.13-2.x86_64",
"product_id": "ccs-devel-0:1.0.13-2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs-devel@1.0.13-2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ccs-debuginfo-0:1.0.13-2.x86_64",
"product": {
"name": "ccs-debuginfo-0:1.0.13-2.x86_64",
"product_id": "ccs-debuginfo-0:1.0.13-2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs-debuginfo@1.0.13-2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ccs-0:1.0.13-2.x86_64",
"product": {
"name": "ccs-0:1.0.13-2.x86_64",
"product_id": "ccs-0:1.0.13-2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs@1.0.13-2?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "ccs-0:1.0.13-2.src",
"product": {
"name": "ccs-0:1.0.13-2.src",
"product_id": "ccs-0:1.0.13-2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs@1.0.13-2?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "ccs-devel-0:1.0.13-2.ppc64",
"product": {
"name": "ccs-devel-0:1.0.13-2.ppc64",
"product_id": "ccs-devel-0:1.0.13-2.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs-devel@1.0.13-2?arch=ppc64"
}
}
},
{
"category": "product_version",
"name": "ccs-debuginfo-0:1.0.13-2.ppc64",
"product": {
"name": "ccs-debuginfo-0:1.0.13-2.ppc64",
"product_id": "ccs-debuginfo-0:1.0.13-2.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs-debuginfo@1.0.13-2?arch=ppc64"
}
}
},
{
"category": "product_version",
"name": "ccs-0:1.0.13-2.ppc64",
"product": {
"name": "ccs-0:1.0.13-2.ppc64",
"product_id": "ccs-0:1.0.13-2.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs@1.0.13-2?arch=ppc64"
}
}
}
],
"category": "architecture",
"name": "ppc64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.i686 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-0:1.0.13-2.i686"
},
"product_reference": "ccs-0:1.0.13-2.i686",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.ia64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-0:1.0.13-2.ia64"
},
"product_reference": "ccs-0:1.0.13-2.ia64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.ppc64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-0:1.0.13-2.ppc64"
},
"product_reference": "ccs-0:1.0.13-2.ppc64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.src as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-0:1.0.13-2.src"
},
"product_reference": "ccs-0:1.0.13-2.src",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.x86_64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-0:1.0.13-2.x86_64"
},
"product_reference": "ccs-0:1.0.13-2.x86_64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.i686 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-debuginfo-0:1.0.13-2.i686"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.i686",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.ia64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-debuginfo-0:1.0.13-2.ia64"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.ia64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.ppc64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-debuginfo-0:1.0.13-2.ppc64"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.ppc64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.x86_64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-debuginfo-0:1.0.13-2.x86_64"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.x86_64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.i686 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-devel-0:1.0.13-2.i686"
},
"product_reference": "ccs-devel-0:1.0.13-2.i686",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.ia64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-devel-0:1.0.13-2.ia64"
},
"product_reference": "ccs-devel-0:1.0.13-2.ia64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.ppc64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-devel-0:1.0.13-2.ppc64"
},
"product_reference": "ccs-devel-0:1.0.13-2.ppc64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.x86_64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-devel-0:1.0.13-2.x86_64"
},
"product_reference": "ccs-devel-0:1.0.13-2.x86_64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.i686 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-0:1.0.13-2.i686"
},
"product_reference": "ccs-0:1.0.13-2.i686",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.ia64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-0:1.0.13-2.ia64"
},
"product_reference": "ccs-0:1.0.13-2.ia64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.ppc64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-0:1.0.13-2.ppc64"
},
"product_reference": "ccs-0:1.0.13-2.ppc64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.src as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-0:1.0.13-2.src"
},
"product_reference": "ccs-0:1.0.13-2.src",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.x86_64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-0:1.0.13-2.x86_64"
},
"product_reference": "ccs-0:1.0.13-2.x86_64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.i686 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-debuginfo-0:1.0.13-2.i686"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.i686",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.ia64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-debuginfo-0:1.0.13-2.ia64"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.ia64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.ppc64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-debuginfo-0:1.0.13-2.ppc64"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.ppc64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.x86_64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-debuginfo-0:1.0.13-2.x86_64"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.x86_64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.i686 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-devel-0:1.0.13-2.i686"
},
"product_reference": "ccs-devel-0:1.0.13-2.i686",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.ia64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-devel-0:1.0.13-2.ia64"
},
"product_reference": "ccs-devel-0:1.0.13-2.ia64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.ppc64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-devel-0:1.0.13-2.ppc64"
},
"product_reference": "ccs-devel-0:1.0.13-2.ppc64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.x86_64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-devel-0:1.0.13-2.x86_64"
},
"product_reference": "ccs-devel-0:1.0.13-2.x86_64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.i686 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-0:1.0.13-2.i686"
},
"product_reference": "ccs-0:1.0.13-2.i686",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.ia64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-0:1.0.13-2.ia64"
},
"product_reference": "ccs-0:1.0.13-2.ia64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.ppc64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-0:1.0.13-2.ppc64"
},
"product_reference": "ccs-0:1.0.13-2.ppc64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.src as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-0:1.0.13-2.src"
},
"product_reference": "ccs-0:1.0.13-2.src",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.x86_64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-0:1.0.13-2.x86_64"
},
"product_reference": "ccs-0:1.0.13-2.x86_64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.i686 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-debuginfo-0:1.0.13-2.i686"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.i686",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.ia64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-debuginfo-0:1.0.13-2.ia64"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.ia64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.ppc64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-debuginfo-0:1.0.13-2.ppc64"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.ppc64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.x86_64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-debuginfo-0:1.0.13-2.x86_64"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.x86_64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.i686 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-devel-0:1.0.13-2.i686"
},
"product_reference": "ccs-devel-0:1.0.13-2.i686",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.ia64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-devel-0:1.0.13-2.ia64"
},
"product_reference": "ccs-devel-0:1.0.13-2.ia64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.ppc64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-devel-0:1.0.13-2.ppc64"
},
"product_reference": "ccs-devel-0:1.0.13-2.ppc64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.x86_64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-devel-0:1.0.13-2.x86_64"
},
"product_reference": "ccs-devel-0:1.0.13-2.x86_64",
"relates_to_product_reference": "4WS-cluster"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2008-6552",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2008-10-31T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "519436"
}
],
"notes": [
{
"category": "description",
"text": "Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rgmanager: multiple insecure temporary file use issues",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"4AS-cluster:ccs-0:1.0.13-2.i686",
"4AS-cluster:ccs-0:1.0.13-2.ia64",
"4AS-cluster:ccs-0:1.0.13-2.ppc64",
"4AS-cluster:ccs-0:1.0.13-2.src",
"4AS-cluster:ccs-0:1.0.13-2.x86_64",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.i686",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.ia64",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.ppc64",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.x86_64",
"4AS-cluster:ccs-devel-0:1.0.13-2.i686",
"4AS-cluster:ccs-devel-0:1.0.13-2.ia64",
"4AS-cluster:ccs-devel-0:1.0.13-2.ppc64",
"4AS-cluster:ccs-devel-0:1.0.13-2.x86_64",
"4ES-cluster:ccs-0:1.0.13-2.i686",
"4ES-cluster:ccs-0:1.0.13-2.ia64",
"4ES-cluster:ccs-0:1.0.13-2.ppc64",
"4ES-cluster:ccs-0:1.0.13-2.src",
"4ES-cluster:ccs-0:1.0.13-2.x86_64",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.i686",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.ia64",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.ppc64",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.x86_64",
"4ES-cluster:ccs-devel-0:1.0.13-2.i686",
"4ES-cluster:ccs-devel-0:1.0.13-2.ia64",
"4ES-cluster:ccs-devel-0:1.0.13-2.ppc64",
"4ES-cluster:ccs-devel-0:1.0.13-2.x86_64",
"4WS-cluster:ccs-0:1.0.13-2.i686",
"4WS-cluster:ccs-0:1.0.13-2.ia64",
"4WS-cluster:ccs-0:1.0.13-2.ppc64",
"4WS-cluster:ccs-0:1.0.13-2.src",
"4WS-cluster:ccs-0:1.0.13-2.x86_64",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.i686",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.ia64",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.ppc64",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.x86_64",
"4WS-cluster:ccs-devel-0:1.0.13-2.i686",
"4WS-cluster:ccs-devel-0:1.0.13-2.ia64",
"4WS-cluster:ccs-devel-0:1.0.13-2.ppc64",
"4WS-cluster:ccs-devel-0:1.0.13-2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2008-6552"
},
{
"category": "external",
"summary": "RHBZ#519436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=519436"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2008-6552",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-6552"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-6552",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-6552"
}
],
"release_date": "2008-10-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2011-02-16T15:08:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"4AS-cluster:ccs-0:1.0.13-2.i686",
"4AS-cluster:ccs-0:1.0.13-2.ia64",
"4AS-cluster:ccs-0:1.0.13-2.ppc64",
"4AS-cluster:ccs-0:1.0.13-2.src",
"4AS-cluster:ccs-0:1.0.13-2.x86_64",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.i686",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.ia64",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.ppc64",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.x86_64",
"4AS-cluster:ccs-devel-0:1.0.13-2.i686",
"4AS-cluster:ccs-devel-0:1.0.13-2.ia64",
"4AS-cluster:ccs-devel-0:1.0.13-2.ppc64",
"4AS-cluster:ccs-devel-0:1.0.13-2.x86_64",
"4ES-cluster:ccs-0:1.0.13-2.i686",
"4ES-cluster:ccs-0:1.0.13-2.ia64",
"4ES-cluster:ccs-0:1.0.13-2.ppc64",
"4ES-cluster:ccs-0:1.0.13-2.src",
"4ES-cluster:ccs-0:1.0.13-2.x86_64",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.i686",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.ia64",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.ppc64",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.x86_64",
"4ES-cluster:ccs-devel-0:1.0.13-2.i686",
"4ES-cluster:ccs-devel-0:1.0.13-2.ia64",
"4ES-cluster:ccs-devel-0:1.0.13-2.ppc64",
"4ES-cluster:ccs-devel-0:1.0.13-2.x86_64",
"4WS-cluster:ccs-0:1.0.13-2.i686",
"4WS-cluster:ccs-0:1.0.13-2.ia64",
"4WS-cluster:ccs-0:1.0.13-2.ppc64",
"4WS-cluster:ccs-0:1.0.13-2.src",
"4WS-cluster:ccs-0:1.0.13-2.x86_64",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.i686",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.ia64",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.ppc64",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.x86_64",
"4WS-cluster:ccs-devel-0:1.0.13-2.i686",
"4WS-cluster:ccs-devel-0:1.0.13-2.ia64",
"4WS-cluster:ccs-devel-0:1.0.13-2.ppc64",
"4WS-cluster:ccs-devel-0:1.0.13-2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2011:0265"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 5.4,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:C",
"version": "2.0"
},
"products": [
"4AS-cluster:ccs-0:1.0.13-2.i686",
"4AS-cluster:ccs-0:1.0.13-2.ia64",
"4AS-cluster:ccs-0:1.0.13-2.ppc64",
"4AS-cluster:ccs-0:1.0.13-2.src",
"4AS-cluster:ccs-0:1.0.13-2.x86_64",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.i686",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.ia64",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.ppc64",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.x86_64",
"4AS-cluster:ccs-devel-0:1.0.13-2.i686",
"4AS-cluster:ccs-devel-0:1.0.13-2.ia64",
"4AS-cluster:ccs-devel-0:1.0.13-2.ppc64",
"4AS-cluster:ccs-devel-0:1.0.13-2.x86_64",
"4ES-cluster:ccs-0:1.0.13-2.i686",
"4ES-cluster:ccs-0:1.0.13-2.ia64",
"4ES-cluster:ccs-0:1.0.13-2.ppc64",
"4ES-cluster:ccs-0:1.0.13-2.src",
"4ES-cluster:ccs-0:1.0.13-2.x86_64",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.i686",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.ia64",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.ppc64",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.x86_64",
"4ES-cluster:ccs-devel-0:1.0.13-2.i686",
"4ES-cluster:ccs-devel-0:1.0.13-2.ia64",
"4ES-cluster:ccs-devel-0:1.0.13-2.ppc64",
"4ES-cluster:ccs-devel-0:1.0.13-2.x86_64",
"4WS-cluster:ccs-0:1.0.13-2.i686",
"4WS-cluster:ccs-0:1.0.13-2.ia64",
"4WS-cluster:ccs-0:1.0.13-2.ppc64",
"4WS-cluster:ccs-0:1.0.13-2.src",
"4WS-cluster:ccs-0:1.0.13-2.x86_64",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.i686",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.ia64",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.ppc64",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.x86_64",
"4WS-cluster:ccs-devel-0:1.0.13-2.i686",
"4WS-cluster:ccs-devel-0:1.0.13-2.ia64",
"4WS-cluster:ccs-devel-0:1.0.13-2.ppc64",
"4WS-cluster:ccs-devel-0:1.0.13-2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "rgmanager: multiple insecure temporary file use issues"
}
]
}
RHSA-2011:0264
Vulnerability from csaf_redhat
Published
2011-02-16 15:02
Modified
2025-11-08 03:24
Summary
Red Hat Security Advisory: rgmanager security and bug fix update
Notes
Topic
An updated rgmanager package that fixes multiple security issues and
several bugs is now available for Red Hat Cluster Suite 4.
The Red Hat Security Response Team has rated this update as having low
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
The rgmanager package contains the Red Hat Resource Group Manager, which
provides high availability for critical server applications.
Multiple insecure temporary file use flaws were discovered in rgmanager and
various resource scripts run by rgmanager. A local attacker could use these
flaws to overwrite an arbitrary file writable by the rgmanager process
(i.e. user root) with the output of rgmanager or a resource agent via a
symbolic link attack. (CVE-2008-6552)
It was discovered that certain resource agent scripts set the
LD_LIBRARY_PATH environment variable to an insecure value containing empty
path elements. A local user able to trick a user running those scripts to
run them while working from an attacker-writable directory could use this
flaw to escalate their privileges via a specially-crafted dynamic library.
(CVE-2010-3389)
Red Hat would like to thank Raphael Geissert for reporting the
CVE-2010-3389 issue.
This update also fixes the following bugs:
* Previously, starting threads could incorrectly include a reference to an
exited thread if that thread exited when rgmanager received a request
to start a new thread. Due to this issue, the new thread did not retry and
entered an infinite loop. This update ensures that new threads do not
reference old threads. Now, new threads no longer enter an infinite loop
in which the rgmanager enables and disables services without failing
gracefully. (BZ#502872)
* Previously, nfsclient.sh left temporary nfsclient-status-cache-$$ files
in /tmp/. (BZ#506152)
* Previously, the function local_node_name in
/resources/utils/member_util.sh did not correctly check whether magma_tool
failed. Due to this issue, empty strings could be returned. This update
checks the input and rejects empty strings. (BZ#516758)
* Previously, the file system agent could kill a process when an
application used a mount point with a similar name to a mount point managed
by rgmanager using force_unmount. With this update, the file system agent
kills only the processes that access the mount point managed by rgmanager.
(BZ#555901)
* Previously, simultaneous execution of "lvchange --deltag" from
/etc/init.d/rgmanager caused a checksum error on High Availability Logical
Volume Manager (HA-LVM). With this update, ownership of LVM tags is checked
before removing them. (BZ#559582)
* Previously, the isAlive check could fail if two nodes used the same file
name. With this update, the isAlive function prevents two nodes from using
the same file name. (BZ#469815)
* Previously, the S/Lang code could lead to unwanted S/Lang stack leaks
during event processing. (BZ#507430)
All users of rgmanager are advised to upgrade to this updated package,
which corrects these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Low"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An updated rgmanager package that fixes multiple security issues and\nseveral bugs is now available for Red Hat Cluster Suite 4.\n\nThe Red Hat Security Response Team has rated this update as having low\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The rgmanager package contains the Red Hat Resource Group Manager, which\nprovides high availability for critical server applications.\n\nMultiple insecure temporary file use flaws were discovered in rgmanager and\nvarious resource scripts run by rgmanager. A local attacker could use these\nflaws to overwrite an arbitrary file writable by the rgmanager process\n(i.e. user root) with the output of rgmanager or a resource agent via a\nsymbolic link attack. (CVE-2008-6552)\n\nIt was discovered that certain resource agent scripts set the\nLD_LIBRARY_PATH environment variable to an insecure value containing empty\npath elements. A local user able to trick a user running those scripts to\nrun them while working from an attacker-writable directory could use this\nflaw to escalate their privileges via a specially-crafted dynamic library.\n(CVE-2010-3389)\n\nRed Hat would like to thank Raphael Geissert for reporting the\nCVE-2010-3389 issue.\n\nThis update also fixes the following bugs:\n\n* Previously, starting threads could incorrectly include a reference to an\nexited thread if that thread exited when rgmanager received a request\nto start a new thread. Due to this issue, the new thread did not retry and\nentered an infinite loop. This update ensures that new threads do not\nreference old threads. Now, new threads no longer enter an infinite loop\nin which the rgmanager enables and disables services without failing\ngracefully. (BZ#502872)\n\n* Previously, nfsclient.sh left temporary nfsclient-status-cache-$$ files\nin /tmp/. (BZ#506152)\n\n* Previously, the function local_node_name in\n/resources/utils/member_util.sh did not correctly check whether magma_tool\nfailed. Due to this issue, empty strings could be returned. This update\nchecks the input and rejects empty strings. (BZ#516758)\n\n* Previously, the file system agent could kill a process when an\napplication used a mount point with a similar name to a mount point managed\nby rgmanager using force_unmount. With this update, the file system agent\nkills only the processes that access the mount point managed by rgmanager.\n(BZ#555901)\n\n* Previously, simultaneous execution of \"lvchange --deltag\" from\n/etc/init.d/rgmanager caused a checksum error on High Availability Logical\nVolume Manager (HA-LVM). With this update, ownership of LVM tags is checked\nbefore removing them. (BZ#559582)\n\n* Previously, the isAlive check could fail if two nodes used the same file\nname. With this update, the isAlive function prevents two nodes from using\nthe same file name. (BZ#469815)\n\n* Previously, the S/Lang code could lead to unwanted S/Lang stack leaks\nduring event processing. (BZ#507430)\n\nAll users of rgmanager are advised to upgrade to this updated package,\nwhich corrects these issues.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2011:0264",
"url": "https://access.redhat.com/errata/RHSA-2011:0264"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#low",
"url": "https://access.redhat.com/security/updates/classification/#low"
},
{
"category": "external",
"summary": "469815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=469815"
},
{
"category": "external",
"summary": "498985",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=498985"
},
{
"category": "external",
"summary": "506152",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=506152"
},
{
"category": "external",
"summary": "507430",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=507430"
},
{
"category": "external",
"summary": "516758",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=516758"
},
{
"category": "external",
"summary": "519436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=519436"
},
{
"category": "external",
"summary": "555901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=555901"
},
{
"category": "external",
"summary": "639044",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=639044"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0264.json"
}
],
"title": "Red Hat Security Advisory: rgmanager security and bug fix update",
"tracking": {
"current_release_date": "2025-11-08T03:24:22+00:00",
"generator": {
"date": "2025-11-08T03:24:22+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2011:0264",
"initial_release_date": "2011-02-16T15:02:00+00:00",
"revision_history": [
{
"date": "2011-02-16T15:02:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2011-02-16T10:07:04+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-08T03:24:22+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Cluster Suite 4AS",
"product": {
"name": "Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_cluster:4"
}
}
},
{
"category": "product_name",
"name": "Red Hat Cluster Suite 4ES",
"product": {
"name": "Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_cluster:4"
}
}
},
{
"category": "product_name",
"name": "Red Hat Cluster Suite 4WS",
"product": {
"name": "Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_cluster:4"
}
}
}
],
"category": "product_family",
"name": "Red Hat Cluster Suite"
},
{
"branches": [
{
"category": "product_version",
"name": "rgmanager-0:1.9.88-2.el4.ia64",
"product": {
"name": "rgmanager-0:1.9.88-2.el4.ia64",
"product_id": "rgmanager-0:1.9.88-2.el4.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager@1.9.88-2.el4?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"product": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"product_id": "rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager-debuginfo@1.9.88-2.el4?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "rgmanager-0:1.9.88-2.el4.src",
"product": {
"name": "rgmanager-0:1.9.88-2.el4.src",
"product_id": "rgmanager-0:1.9.88-2.el4.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager@1.9.88-2.el4?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "rgmanager-0:1.9.88-2.el4.x86_64",
"product": {
"name": "rgmanager-0:1.9.88-2.el4.x86_64",
"product_id": "rgmanager-0:1.9.88-2.el4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager@1.9.88-2.el4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"product": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"product_id": "rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager-debuginfo@1.9.88-2.el4?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "rgmanager-0:1.9.88-2.el4.i386",
"product": {
"name": "rgmanager-0:1.9.88-2.el4.i386",
"product_id": "rgmanager-0:1.9.88-2.el4.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager@1.9.88-2.el4?arch=i386"
}
}
},
{
"category": "product_version",
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"product": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"product_id": "rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager-debuginfo@1.9.88-2.el4?arch=i386"
}
}
}
],
"category": "architecture",
"name": "i386"
},
{
"branches": [
{
"category": "product_version",
"name": "rgmanager-0:1.9.88-2.el4.ppc64",
"product": {
"name": "rgmanager-0:1.9.88-2.el4.ppc64",
"product_id": "rgmanager-0:1.9.88-2.el4.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager@1.9.88-2.el4?arch=ppc64"
}
}
},
{
"category": "product_version",
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"product": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"product_id": "rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager-debuginfo@1.9.88-2.el4?arch=ppc64"
}
}
}
],
"category": "architecture",
"name": "ppc64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.i386 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:rgmanager-0:1.9.88-2.el4.i386"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.i386",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.ia64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:rgmanager-0:1.9.88-2.el4.ia64"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.ia64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.ppc64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:rgmanager-0:1.9.88-2.el4.ppc64"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.ppc64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.src as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:rgmanager-0:1.9.88-2.el4.src"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.src",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.x86_64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:rgmanager-0:1.9.88-2.el4.x86_64"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.x86_64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.i386 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.ia64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.ppc64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.x86_64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.i386 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:rgmanager-0:1.9.88-2.el4.i386"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.i386",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.ia64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:rgmanager-0:1.9.88-2.el4.ia64"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.ia64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.ppc64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:rgmanager-0:1.9.88-2.el4.ppc64"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.ppc64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.src as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:rgmanager-0:1.9.88-2.el4.src"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.src",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.x86_64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:rgmanager-0:1.9.88-2.el4.x86_64"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.x86_64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.i386 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.ia64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.ppc64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.x86_64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.i386 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:rgmanager-0:1.9.88-2.el4.i386"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.i386",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.ia64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:rgmanager-0:1.9.88-2.el4.ia64"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.ia64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.ppc64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:rgmanager-0:1.9.88-2.el4.ppc64"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.ppc64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.src as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:rgmanager-0:1.9.88-2.el4.src"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.src",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.x86_64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:rgmanager-0:1.9.88-2.el4.x86_64"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.x86_64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.i386 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.ia64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.ppc64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.x86_64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"relates_to_product_reference": "4WS-cluster"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2008-6552",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2008-10-31T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "519436"
}
],
"notes": [
{
"category": "description",
"text": "Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rgmanager: multiple insecure temporary file use issues",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"4AS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.src",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2008-6552"
},
{
"category": "external",
"summary": "RHBZ#519436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=519436"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2008-6552",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-6552"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-6552",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-6552"
}
],
"release_date": "2008-10-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2011-02-16T15:02:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"4AS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.src",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2011:0264"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 5.4,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:C",
"version": "2.0"
},
"products": [
"4AS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.src",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "rgmanager: multiple insecure temporary file use issues"
},
{
"acknowledgments": [
{
"names": [
"Raphael Geissert"
]
}
],
"cve": "CVE-2010-3389",
"discovery_date": "2010-09-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "639044"
}
],
"notes": [
{
"category": "description",
"text": "The (1) SAPDatabase and (2) SAPInstance scripts in OCF Resource Agents (aka resource-agents or cluster-agents) 1.0.3 in Linux-HA place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rgmanager: insecure library loading vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"4AS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.src",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3389"
},
{
"category": "external",
"summary": "RHBZ#639044",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=639044"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3389",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3389"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3389",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3389"
}
],
"release_date": "2010-09-30T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2011-02-16T15:02:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"4AS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.src",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2011:0264"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 3.7,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"4AS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.src",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "rgmanager: insecure library loading vulnerability"
}
]
}
rhsa-2011_0265
Vulnerability from csaf_redhat
Published
2011-02-16 15:08
Modified
2024-11-14 10:08
Summary
Red Hat Security Advisory: ccs security update
Notes
Topic
Updated ccs packages that fix one security issue are now available for Red
Hat Cluster Suite 4.
The Red Hat Security Response Team has rated this update as having low
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.
Details
The Cluster Configuration System provides the ability for nodes in a
cluster to obtain information about the cluster and each other. ccs_tool is
a program for making online updates to the cluster configuration file.
An insecure temporary file use flaw was found in ccs_tool. A local attacker
could use this flaw to conduct a symbolic link attack, allowing them to
overwrite (with the output of ccs_tool) an arbitrary file writable by the
victim running ccs_tool. (CVE-2008-6552)
All ccs users should upgrade to these updated packages, which correct this
issue.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Low"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated ccs packages that fix one security issue are now available for Red\nHat Cluster Suite 4.\n\nThe Red Hat Security Response Team has rated this update as having low\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The Cluster Configuration System provides the ability for nodes in a\ncluster to obtain information about the cluster and each other. ccs_tool is\na program for making online updates to the cluster configuration file.\n\nAn insecure temporary file use flaw was found in ccs_tool. A local attacker\ncould use this flaw to conduct a symbolic link attack, allowing them to\noverwrite (with the output of ccs_tool) an arbitrary file writable by the\nvictim running ccs_tool. (CVE-2008-6552)\n\nAll ccs users should upgrade to these updated packages, which correct this\nissue.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2011:0265",
"url": "https://access.redhat.com/errata/RHSA-2011:0265"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#low",
"url": "https://access.redhat.com/security/updates/classification/#low"
},
{
"category": "external",
"summary": "498980",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=498980"
},
{
"category": "external",
"summary": "519436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=519436"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0265.json"
}
],
"title": "Red Hat Security Advisory: ccs security update",
"tracking": {
"current_release_date": "2024-11-14T10:08:24+00:00",
"generator": {
"date": "2024-11-14T10:08:24+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.0"
}
},
"id": "RHSA-2011:0265",
"initial_release_date": "2011-02-16T15:08:00+00:00",
"revision_history": [
{
"date": "2011-02-16T15:08:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2011-02-16T10:14:42+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T10:08:24+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Cluster Suite 4AS",
"product": {
"name": "Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_cluster:4"
}
}
},
{
"category": "product_name",
"name": "Red Hat Cluster Suite 4ES",
"product": {
"name": "Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_cluster:4"
}
}
},
{
"category": "product_name",
"name": "Red Hat Cluster Suite 4WS",
"product": {
"name": "Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_cluster:4"
}
}
}
],
"category": "product_family",
"name": "Red Hat Cluster Suite"
},
{
"branches": [
{
"category": "product_version",
"name": "ccs-devel-0:1.0.13-2.i686",
"product": {
"name": "ccs-devel-0:1.0.13-2.i686",
"product_id": "ccs-devel-0:1.0.13-2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs-devel@1.0.13-2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "ccs-debuginfo-0:1.0.13-2.i686",
"product": {
"name": "ccs-debuginfo-0:1.0.13-2.i686",
"product_id": "ccs-debuginfo-0:1.0.13-2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs-debuginfo@1.0.13-2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "ccs-0:1.0.13-2.i686",
"product": {
"name": "ccs-0:1.0.13-2.i686",
"product_id": "ccs-0:1.0.13-2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs@1.0.13-2?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "ccs-devel-0:1.0.13-2.ia64",
"product": {
"name": "ccs-devel-0:1.0.13-2.ia64",
"product_id": "ccs-devel-0:1.0.13-2.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs-devel@1.0.13-2?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "ccs-debuginfo-0:1.0.13-2.ia64",
"product": {
"name": "ccs-debuginfo-0:1.0.13-2.ia64",
"product_id": "ccs-debuginfo-0:1.0.13-2.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs-debuginfo@1.0.13-2?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "ccs-0:1.0.13-2.ia64",
"product": {
"name": "ccs-0:1.0.13-2.ia64",
"product_id": "ccs-0:1.0.13-2.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs@1.0.13-2?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "ccs-devel-0:1.0.13-2.x86_64",
"product": {
"name": "ccs-devel-0:1.0.13-2.x86_64",
"product_id": "ccs-devel-0:1.0.13-2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs-devel@1.0.13-2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ccs-debuginfo-0:1.0.13-2.x86_64",
"product": {
"name": "ccs-debuginfo-0:1.0.13-2.x86_64",
"product_id": "ccs-debuginfo-0:1.0.13-2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs-debuginfo@1.0.13-2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ccs-0:1.0.13-2.x86_64",
"product": {
"name": "ccs-0:1.0.13-2.x86_64",
"product_id": "ccs-0:1.0.13-2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs@1.0.13-2?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "ccs-0:1.0.13-2.src",
"product": {
"name": "ccs-0:1.0.13-2.src",
"product_id": "ccs-0:1.0.13-2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs@1.0.13-2?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "ccs-devel-0:1.0.13-2.ppc64",
"product": {
"name": "ccs-devel-0:1.0.13-2.ppc64",
"product_id": "ccs-devel-0:1.0.13-2.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs-devel@1.0.13-2?arch=ppc64"
}
}
},
{
"category": "product_version",
"name": "ccs-debuginfo-0:1.0.13-2.ppc64",
"product": {
"name": "ccs-debuginfo-0:1.0.13-2.ppc64",
"product_id": "ccs-debuginfo-0:1.0.13-2.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs-debuginfo@1.0.13-2?arch=ppc64"
}
}
},
{
"category": "product_version",
"name": "ccs-0:1.0.13-2.ppc64",
"product": {
"name": "ccs-0:1.0.13-2.ppc64",
"product_id": "ccs-0:1.0.13-2.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs@1.0.13-2?arch=ppc64"
}
}
}
],
"category": "architecture",
"name": "ppc64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.i686 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-0:1.0.13-2.i686"
},
"product_reference": "ccs-0:1.0.13-2.i686",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.ia64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-0:1.0.13-2.ia64"
},
"product_reference": "ccs-0:1.0.13-2.ia64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.ppc64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-0:1.0.13-2.ppc64"
},
"product_reference": "ccs-0:1.0.13-2.ppc64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.src as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-0:1.0.13-2.src"
},
"product_reference": "ccs-0:1.0.13-2.src",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.x86_64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-0:1.0.13-2.x86_64"
},
"product_reference": "ccs-0:1.0.13-2.x86_64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.i686 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-debuginfo-0:1.0.13-2.i686"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.i686",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.ia64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-debuginfo-0:1.0.13-2.ia64"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.ia64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.ppc64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-debuginfo-0:1.0.13-2.ppc64"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.ppc64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.x86_64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-debuginfo-0:1.0.13-2.x86_64"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.x86_64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.i686 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-devel-0:1.0.13-2.i686"
},
"product_reference": "ccs-devel-0:1.0.13-2.i686",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.ia64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-devel-0:1.0.13-2.ia64"
},
"product_reference": "ccs-devel-0:1.0.13-2.ia64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.ppc64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-devel-0:1.0.13-2.ppc64"
},
"product_reference": "ccs-devel-0:1.0.13-2.ppc64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.x86_64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-devel-0:1.0.13-2.x86_64"
},
"product_reference": "ccs-devel-0:1.0.13-2.x86_64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.i686 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-0:1.0.13-2.i686"
},
"product_reference": "ccs-0:1.0.13-2.i686",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.ia64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-0:1.0.13-2.ia64"
},
"product_reference": "ccs-0:1.0.13-2.ia64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.ppc64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-0:1.0.13-2.ppc64"
},
"product_reference": "ccs-0:1.0.13-2.ppc64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.src as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-0:1.0.13-2.src"
},
"product_reference": "ccs-0:1.0.13-2.src",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.x86_64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-0:1.0.13-2.x86_64"
},
"product_reference": "ccs-0:1.0.13-2.x86_64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.i686 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-debuginfo-0:1.0.13-2.i686"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.i686",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.ia64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-debuginfo-0:1.0.13-2.ia64"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.ia64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.ppc64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-debuginfo-0:1.0.13-2.ppc64"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.ppc64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.x86_64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-debuginfo-0:1.0.13-2.x86_64"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.x86_64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.i686 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-devel-0:1.0.13-2.i686"
},
"product_reference": "ccs-devel-0:1.0.13-2.i686",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.ia64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-devel-0:1.0.13-2.ia64"
},
"product_reference": "ccs-devel-0:1.0.13-2.ia64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.ppc64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-devel-0:1.0.13-2.ppc64"
},
"product_reference": "ccs-devel-0:1.0.13-2.ppc64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.x86_64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-devel-0:1.0.13-2.x86_64"
},
"product_reference": "ccs-devel-0:1.0.13-2.x86_64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.i686 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-0:1.0.13-2.i686"
},
"product_reference": "ccs-0:1.0.13-2.i686",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.ia64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-0:1.0.13-2.ia64"
},
"product_reference": "ccs-0:1.0.13-2.ia64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.ppc64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-0:1.0.13-2.ppc64"
},
"product_reference": "ccs-0:1.0.13-2.ppc64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.src as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-0:1.0.13-2.src"
},
"product_reference": "ccs-0:1.0.13-2.src",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.x86_64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-0:1.0.13-2.x86_64"
},
"product_reference": "ccs-0:1.0.13-2.x86_64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.i686 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-debuginfo-0:1.0.13-2.i686"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.i686",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.ia64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-debuginfo-0:1.0.13-2.ia64"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.ia64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.ppc64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-debuginfo-0:1.0.13-2.ppc64"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.ppc64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.x86_64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-debuginfo-0:1.0.13-2.x86_64"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.x86_64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.i686 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-devel-0:1.0.13-2.i686"
},
"product_reference": "ccs-devel-0:1.0.13-2.i686",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.ia64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-devel-0:1.0.13-2.ia64"
},
"product_reference": "ccs-devel-0:1.0.13-2.ia64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.ppc64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-devel-0:1.0.13-2.ppc64"
},
"product_reference": "ccs-devel-0:1.0.13-2.ppc64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.x86_64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-devel-0:1.0.13-2.x86_64"
},
"product_reference": "ccs-devel-0:1.0.13-2.x86_64",
"relates_to_product_reference": "4WS-cluster"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2008-6552",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2008-10-31T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "519436"
}
],
"notes": [
{
"category": "description",
"text": "Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rgmanager: multiple insecure temporary file use issues",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"4AS-cluster:ccs-0:1.0.13-2.i686",
"4AS-cluster:ccs-0:1.0.13-2.ia64",
"4AS-cluster:ccs-0:1.0.13-2.ppc64",
"4AS-cluster:ccs-0:1.0.13-2.src",
"4AS-cluster:ccs-0:1.0.13-2.x86_64",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.i686",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.ia64",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.ppc64",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.x86_64",
"4AS-cluster:ccs-devel-0:1.0.13-2.i686",
"4AS-cluster:ccs-devel-0:1.0.13-2.ia64",
"4AS-cluster:ccs-devel-0:1.0.13-2.ppc64",
"4AS-cluster:ccs-devel-0:1.0.13-2.x86_64",
"4ES-cluster:ccs-0:1.0.13-2.i686",
"4ES-cluster:ccs-0:1.0.13-2.ia64",
"4ES-cluster:ccs-0:1.0.13-2.ppc64",
"4ES-cluster:ccs-0:1.0.13-2.src",
"4ES-cluster:ccs-0:1.0.13-2.x86_64",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.i686",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.ia64",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.ppc64",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.x86_64",
"4ES-cluster:ccs-devel-0:1.0.13-2.i686",
"4ES-cluster:ccs-devel-0:1.0.13-2.ia64",
"4ES-cluster:ccs-devel-0:1.0.13-2.ppc64",
"4ES-cluster:ccs-devel-0:1.0.13-2.x86_64",
"4WS-cluster:ccs-0:1.0.13-2.i686",
"4WS-cluster:ccs-0:1.0.13-2.ia64",
"4WS-cluster:ccs-0:1.0.13-2.ppc64",
"4WS-cluster:ccs-0:1.0.13-2.src",
"4WS-cluster:ccs-0:1.0.13-2.x86_64",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.i686",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.ia64",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.ppc64",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.x86_64",
"4WS-cluster:ccs-devel-0:1.0.13-2.i686",
"4WS-cluster:ccs-devel-0:1.0.13-2.ia64",
"4WS-cluster:ccs-devel-0:1.0.13-2.ppc64",
"4WS-cluster:ccs-devel-0:1.0.13-2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2008-6552"
},
{
"category": "external",
"summary": "RHBZ#519436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=519436"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2008-6552",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-6552"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-6552",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-6552"
}
],
"release_date": "2008-10-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2011-02-16T15:08:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"4AS-cluster:ccs-0:1.0.13-2.i686",
"4AS-cluster:ccs-0:1.0.13-2.ia64",
"4AS-cluster:ccs-0:1.0.13-2.ppc64",
"4AS-cluster:ccs-0:1.0.13-2.src",
"4AS-cluster:ccs-0:1.0.13-2.x86_64",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.i686",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.ia64",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.ppc64",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.x86_64",
"4AS-cluster:ccs-devel-0:1.0.13-2.i686",
"4AS-cluster:ccs-devel-0:1.0.13-2.ia64",
"4AS-cluster:ccs-devel-0:1.0.13-2.ppc64",
"4AS-cluster:ccs-devel-0:1.0.13-2.x86_64",
"4ES-cluster:ccs-0:1.0.13-2.i686",
"4ES-cluster:ccs-0:1.0.13-2.ia64",
"4ES-cluster:ccs-0:1.0.13-2.ppc64",
"4ES-cluster:ccs-0:1.0.13-2.src",
"4ES-cluster:ccs-0:1.0.13-2.x86_64",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.i686",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.ia64",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.ppc64",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.x86_64",
"4ES-cluster:ccs-devel-0:1.0.13-2.i686",
"4ES-cluster:ccs-devel-0:1.0.13-2.ia64",
"4ES-cluster:ccs-devel-0:1.0.13-2.ppc64",
"4ES-cluster:ccs-devel-0:1.0.13-2.x86_64",
"4WS-cluster:ccs-0:1.0.13-2.i686",
"4WS-cluster:ccs-0:1.0.13-2.ia64",
"4WS-cluster:ccs-0:1.0.13-2.ppc64",
"4WS-cluster:ccs-0:1.0.13-2.src",
"4WS-cluster:ccs-0:1.0.13-2.x86_64",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.i686",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.ia64",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.ppc64",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.x86_64",
"4WS-cluster:ccs-devel-0:1.0.13-2.i686",
"4WS-cluster:ccs-devel-0:1.0.13-2.ia64",
"4WS-cluster:ccs-devel-0:1.0.13-2.ppc64",
"4WS-cluster:ccs-devel-0:1.0.13-2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2011:0265"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 5.4,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:C",
"version": "2.0"
},
"products": [
"4AS-cluster:ccs-0:1.0.13-2.i686",
"4AS-cluster:ccs-0:1.0.13-2.ia64",
"4AS-cluster:ccs-0:1.0.13-2.ppc64",
"4AS-cluster:ccs-0:1.0.13-2.src",
"4AS-cluster:ccs-0:1.0.13-2.x86_64",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.i686",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.ia64",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.ppc64",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.x86_64",
"4AS-cluster:ccs-devel-0:1.0.13-2.i686",
"4AS-cluster:ccs-devel-0:1.0.13-2.ia64",
"4AS-cluster:ccs-devel-0:1.0.13-2.ppc64",
"4AS-cluster:ccs-devel-0:1.0.13-2.x86_64",
"4ES-cluster:ccs-0:1.0.13-2.i686",
"4ES-cluster:ccs-0:1.0.13-2.ia64",
"4ES-cluster:ccs-0:1.0.13-2.ppc64",
"4ES-cluster:ccs-0:1.0.13-2.src",
"4ES-cluster:ccs-0:1.0.13-2.x86_64",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.i686",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.ia64",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.ppc64",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.x86_64",
"4ES-cluster:ccs-devel-0:1.0.13-2.i686",
"4ES-cluster:ccs-devel-0:1.0.13-2.ia64",
"4ES-cluster:ccs-devel-0:1.0.13-2.ppc64",
"4ES-cluster:ccs-devel-0:1.0.13-2.x86_64",
"4WS-cluster:ccs-0:1.0.13-2.i686",
"4WS-cluster:ccs-0:1.0.13-2.ia64",
"4WS-cluster:ccs-0:1.0.13-2.ppc64",
"4WS-cluster:ccs-0:1.0.13-2.src",
"4WS-cluster:ccs-0:1.0.13-2.x86_64",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.i686",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.ia64",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.ppc64",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.x86_64",
"4WS-cluster:ccs-devel-0:1.0.13-2.i686",
"4WS-cluster:ccs-devel-0:1.0.13-2.ia64",
"4WS-cluster:ccs-devel-0:1.0.13-2.ppc64",
"4WS-cluster:ccs-devel-0:1.0.13-2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "rgmanager: multiple insecure temporary file use issues"
}
]
}
RHSA-2011:0265
Vulnerability from csaf_redhat
Published
2011-02-16 15:08
Modified
2025-11-08 03:24
Summary
Red Hat Security Advisory: ccs security update
Notes
Topic
Updated ccs packages that fix one security issue are now available for Red
Hat Cluster Suite 4.
The Red Hat Security Response Team has rated this update as having low
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.
Details
The Cluster Configuration System provides the ability for nodes in a
cluster to obtain information about the cluster and each other. ccs_tool is
a program for making online updates to the cluster configuration file.
An insecure temporary file use flaw was found in ccs_tool. A local attacker
could use this flaw to conduct a symbolic link attack, allowing them to
overwrite (with the output of ccs_tool) an arbitrary file writable by the
victim running ccs_tool. (CVE-2008-6552)
All ccs users should upgrade to these updated packages, which correct this
issue.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Low"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated ccs packages that fix one security issue are now available for Red\nHat Cluster Suite 4.\n\nThe Red Hat Security Response Team has rated this update as having low\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The Cluster Configuration System provides the ability for nodes in a\ncluster to obtain information about the cluster and each other. ccs_tool is\na program for making online updates to the cluster configuration file.\n\nAn insecure temporary file use flaw was found in ccs_tool. A local attacker\ncould use this flaw to conduct a symbolic link attack, allowing them to\noverwrite (with the output of ccs_tool) an arbitrary file writable by the\nvictim running ccs_tool. (CVE-2008-6552)\n\nAll ccs users should upgrade to these updated packages, which correct this\nissue.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2011:0265",
"url": "https://access.redhat.com/errata/RHSA-2011:0265"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#low",
"url": "https://access.redhat.com/security/updates/classification/#low"
},
{
"category": "external",
"summary": "498980",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=498980"
},
{
"category": "external",
"summary": "519436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=519436"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0265.json"
}
],
"title": "Red Hat Security Advisory: ccs security update",
"tracking": {
"current_release_date": "2025-11-08T03:24:22+00:00",
"generator": {
"date": "2025-11-08T03:24:22+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2011:0265",
"initial_release_date": "2011-02-16T15:08:00+00:00",
"revision_history": [
{
"date": "2011-02-16T15:08:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2011-02-16T10:14:42+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-08T03:24:22+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Cluster Suite 4AS",
"product": {
"name": "Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_cluster:4"
}
}
},
{
"category": "product_name",
"name": "Red Hat Cluster Suite 4ES",
"product": {
"name": "Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_cluster:4"
}
}
},
{
"category": "product_name",
"name": "Red Hat Cluster Suite 4WS",
"product": {
"name": "Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_cluster:4"
}
}
}
],
"category": "product_family",
"name": "Red Hat Cluster Suite"
},
{
"branches": [
{
"category": "product_version",
"name": "ccs-devel-0:1.0.13-2.i686",
"product": {
"name": "ccs-devel-0:1.0.13-2.i686",
"product_id": "ccs-devel-0:1.0.13-2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs-devel@1.0.13-2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "ccs-debuginfo-0:1.0.13-2.i686",
"product": {
"name": "ccs-debuginfo-0:1.0.13-2.i686",
"product_id": "ccs-debuginfo-0:1.0.13-2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs-debuginfo@1.0.13-2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "ccs-0:1.0.13-2.i686",
"product": {
"name": "ccs-0:1.0.13-2.i686",
"product_id": "ccs-0:1.0.13-2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs@1.0.13-2?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "ccs-devel-0:1.0.13-2.ia64",
"product": {
"name": "ccs-devel-0:1.0.13-2.ia64",
"product_id": "ccs-devel-0:1.0.13-2.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs-devel@1.0.13-2?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "ccs-debuginfo-0:1.0.13-2.ia64",
"product": {
"name": "ccs-debuginfo-0:1.0.13-2.ia64",
"product_id": "ccs-debuginfo-0:1.0.13-2.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs-debuginfo@1.0.13-2?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "ccs-0:1.0.13-2.ia64",
"product": {
"name": "ccs-0:1.0.13-2.ia64",
"product_id": "ccs-0:1.0.13-2.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs@1.0.13-2?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "ccs-devel-0:1.0.13-2.x86_64",
"product": {
"name": "ccs-devel-0:1.0.13-2.x86_64",
"product_id": "ccs-devel-0:1.0.13-2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs-devel@1.0.13-2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ccs-debuginfo-0:1.0.13-2.x86_64",
"product": {
"name": "ccs-debuginfo-0:1.0.13-2.x86_64",
"product_id": "ccs-debuginfo-0:1.0.13-2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs-debuginfo@1.0.13-2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ccs-0:1.0.13-2.x86_64",
"product": {
"name": "ccs-0:1.0.13-2.x86_64",
"product_id": "ccs-0:1.0.13-2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs@1.0.13-2?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "ccs-0:1.0.13-2.src",
"product": {
"name": "ccs-0:1.0.13-2.src",
"product_id": "ccs-0:1.0.13-2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs@1.0.13-2?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "ccs-devel-0:1.0.13-2.ppc64",
"product": {
"name": "ccs-devel-0:1.0.13-2.ppc64",
"product_id": "ccs-devel-0:1.0.13-2.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs-devel@1.0.13-2?arch=ppc64"
}
}
},
{
"category": "product_version",
"name": "ccs-debuginfo-0:1.0.13-2.ppc64",
"product": {
"name": "ccs-debuginfo-0:1.0.13-2.ppc64",
"product_id": "ccs-debuginfo-0:1.0.13-2.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs-debuginfo@1.0.13-2?arch=ppc64"
}
}
},
{
"category": "product_version",
"name": "ccs-0:1.0.13-2.ppc64",
"product": {
"name": "ccs-0:1.0.13-2.ppc64",
"product_id": "ccs-0:1.0.13-2.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ccs@1.0.13-2?arch=ppc64"
}
}
}
],
"category": "architecture",
"name": "ppc64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.i686 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-0:1.0.13-2.i686"
},
"product_reference": "ccs-0:1.0.13-2.i686",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.ia64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-0:1.0.13-2.ia64"
},
"product_reference": "ccs-0:1.0.13-2.ia64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.ppc64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-0:1.0.13-2.ppc64"
},
"product_reference": "ccs-0:1.0.13-2.ppc64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.src as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-0:1.0.13-2.src"
},
"product_reference": "ccs-0:1.0.13-2.src",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.x86_64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-0:1.0.13-2.x86_64"
},
"product_reference": "ccs-0:1.0.13-2.x86_64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.i686 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-debuginfo-0:1.0.13-2.i686"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.i686",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.ia64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-debuginfo-0:1.0.13-2.ia64"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.ia64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.ppc64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-debuginfo-0:1.0.13-2.ppc64"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.ppc64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.x86_64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-debuginfo-0:1.0.13-2.x86_64"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.x86_64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.i686 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-devel-0:1.0.13-2.i686"
},
"product_reference": "ccs-devel-0:1.0.13-2.i686",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.ia64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-devel-0:1.0.13-2.ia64"
},
"product_reference": "ccs-devel-0:1.0.13-2.ia64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.ppc64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-devel-0:1.0.13-2.ppc64"
},
"product_reference": "ccs-devel-0:1.0.13-2.ppc64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.x86_64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:ccs-devel-0:1.0.13-2.x86_64"
},
"product_reference": "ccs-devel-0:1.0.13-2.x86_64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.i686 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-0:1.0.13-2.i686"
},
"product_reference": "ccs-0:1.0.13-2.i686",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.ia64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-0:1.0.13-2.ia64"
},
"product_reference": "ccs-0:1.0.13-2.ia64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.ppc64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-0:1.0.13-2.ppc64"
},
"product_reference": "ccs-0:1.0.13-2.ppc64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.src as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-0:1.0.13-2.src"
},
"product_reference": "ccs-0:1.0.13-2.src",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.x86_64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-0:1.0.13-2.x86_64"
},
"product_reference": "ccs-0:1.0.13-2.x86_64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.i686 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-debuginfo-0:1.0.13-2.i686"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.i686",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.ia64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-debuginfo-0:1.0.13-2.ia64"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.ia64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.ppc64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-debuginfo-0:1.0.13-2.ppc64"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.ppc64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.x86_64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-debuginfo-0:1.0.13-2.x86_64"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.x86_64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.i686 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-devel-0:1.0.13-2.i686"
},
"product_reference": "ccs-devel-0:1.0.13-2.i686",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.ia64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-devel-0:1.0.13-2.ia64"
},
"product_reference": "ccs-devel-0:1.0.13-2.ia64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.ppc64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-devel-0:1.0.13-2.ppc64"
},
"product_reference": "ccs-devel-0:1.0.13-2.ppc64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.x86_64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:ccs-devel-0:1.0.13-2.x86_64"
},
"product_reference": "ccs-devel-0:1.0.13-2.x86_64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.i686 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-0:1.0.13-2.i686"
},
"product_reference": "ccs-0:1.0.13-2.i686",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.ia64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-0:1.0.13-2.ia64"
},
"product_reference": "ccs-0:1.0.13-2.ia64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.ppc64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-0:1.0.13-2.ppc64"
},
"product_reference": "ccs-0:1.0.13-2.ppc64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.src as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-0:1.0.13-2.src"
},
"product_reference": "ccs-0:1.0.13-2.src",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-0:1.0.13-2.x86_64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-0:1.0.13-2.x86_64"
},
"product_reference": "ccs-0:1.0.13-2.x86_64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.i686 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-debuginfo-0:1.0.13-2.i686"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.i686",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.ia64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-debuginfo-0:1.0.13-2.ia64"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.ia64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.ppc64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-debuginfo-0:1.0.13-2.ppc64"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.ppc64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-debuginfo-0:1.0.13-2.x86_64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-debuginfo-0:1.0.13-2.x86_64"
},
"product_reference": "ccs-debuginfo-0:1.0.13-2.x86_64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.i686 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-devel-0:1.0.13-2.i686"
},
"product_reference": "ccs-devel-0:1.0.13-2.i686",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.ia64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-devel-0:1.0.13-2.ia64"
},
"product_reference": "ccs-devel-0:1.0.13-2.ia64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.ppc64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-devel-0:1.0.13-2.ppc64"
},
"product_reference": "ccs-devel-0:1.0.13-2.ppc64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ccs-devel-0:1.0.13-2.x86_64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:ccs-devel-0:1.0.13-2.x86_64"
},
"product_reference": "ccs-devel-0:1.0.13-2.x86_64",
"relates_to_product_reference": "4WS-cluster"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2008-6552",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2008-10-31T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "519436"
}
],
"notes": [
{
"category": "description",
"text": "Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rgmanager: multiple insecure temporary file use issues",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"4AS-cluster:ccs-0:1.0.13-2.i686",
"4AS-cluster:ccs-0:1.0.13-2.ia64",
"4AS-cluster:ccs-0:1.0.13-2.ppc64",
"4AS-cluster:ccs-0:1.0.13-2.src",
"4AS-cluster:ccs-0:1.0.13-2.x86_64",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.i686",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.ia64",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.ppc64",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.x86_64",
"4AS-cluster:ccs-devel-0:1.0.13-2.i686",
"4AS-cluster:ccs-devel-0:1.0.13-2.ia64",
"4AS-cluster:ccs-devel-0:1.0.13-2.ppc64",
"4AS-cluster:ccs-devel-0:1.0.13-2.x86_64",
"4ES-cluster:ccs-0:1.0.13-2.i686",
"4ES-cluster:ccs-0:1.0.13-2.ia64",
"4ES-cluster:ccs-0:1.0.13-2.ppc64",
"4ES-cluster:ccs-0:1.0.13-2.src",
"4ES-cluster:ccs-0:1.0.13-2.x86_64",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.i686",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.ia64",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.ppc64",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.x86_64",
"4ES-cluster:ccs-devel-0:1.0.13-2.i686",
"4ES-cluster:ccs-devel-0:1.0.13-2.ia64",
"4ES-cluster:ccs-devel-0:1.0.13-2.ppc64",
"4ES-cluster:ccs-devel-0:1.0.13-2.x86_64",
"4WS-cluster:ccs-0:1.0.13-2.i686",
"4WS-cluster:ccs-0:1.0.13-2.ia64",
"4WS-cluster:ccs-0:1.0.13-2.ppc64",
"4WS-cluster:ccs-0:1.0.13-2.src",
"4WS-cluster:ccs-0:1.0.13-2.x86_64",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.i686",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.ia64",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.ppc64",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.x86_64",
"4WS-cluster:ccs-devel-0:1.0.13-2.i686",
"4WS-cluster:ccs-devel-0:1.0.13-2.ia64",
"4WS-cluster:ccs-devel-0:1.0.13-2.ppc64",
"4WS-cluster:ccs-devel-0:1.0.13-2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2008-6552"
},
{
"category": "external",
"summary": "RHBZ#519436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=519436"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2008-6552",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-6552"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-6552",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-6552"
}
],
"release_date": "2008-10-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2011-02-16T15:08:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"4AS-cluster:ccs-0:1.0.13-2.i686",
"4AS-cluster:ccs-0:1.0.13-2.ia64",
"4AS-cluster:ccs-0:1.0.13-2.ppc64",
"4AS-cluster:ccs-0:1.0.13-2.src",
"4AS-cluster:ccs-0:1.0.13-2.x86_64",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.i686",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.ia64",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.ppc64",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.x86_64",
"4AS-cluster:ccs-devel-0:1.0.13-2.i686",
"4AS-cluster:ccs-devel-0:1.0.13-2.ia64",
"4AS-cluster:ccs-devel-0:1.0.13-2.ppc64",
"4AS-cluster:ccs-devel-0:1.0.13-2.x86_64",
"4ES-cluster:ccs-0:1.0.13-2.i686",
"4ES-cluster:ccs-0:1.0.13-2.ia64",
"4ES-cluster:ccs-0:1.0.13-2.ppc64",
"4ES-cluster:ccs-0:1.0.13-2.src",
"4ES-cluster:ccs-0:1.0.13-2.x86_64",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.i686",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.ia64",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.ppc64",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.x86_64",
"4ES-cluster:ccs-devel-0:1.0.13-2.i686",
"4ES-cluster:ccs-devel-0:1.0.13-2.ia64",
"4ES-cluster:ccs-devel-0:1.0.13-2.ppc64",
"4ES-cluster:ccs-devel-0:1.0.13-2.x86_64",
"4WS-cluster:ccs-0:1.0.13-2.i686",
"4WS-cluster:ccs-0:1.0.13-2.ia64",
"4WS-cluster:ccs-0:1.0.13-2.ppc64",
"4WS-cluster:ccs-0:1.0.13-2.src",
"4WS-cluster:ccs-0:1.0.13-2.x86_64",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.i686",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.ia64",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.ppc64",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.x86_64",
"4WS-cluster:ccs-devel-0:1.0.13-2.i686",
"4WS-cluster:ccs-devel-0:1.0.13-2.ia64",
"4WS-cluster:ccs-devel-0:1.0.13-2.ppc64",
"4WS-cluster:ccs-devel-0:1.0.13-2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2011:0265"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 5.4,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:C",
"version": "2.0"
},
"products": [
"4AS-cluster:ccs-0:1.0.13-2.i686",
"4AS-cluster:ccs-0:1.0.13-2.ia64",
"4AS-cluster:ccs-0:1.0.13-2.ppc64",
"4AS-cluster:ccs-0:1.0.13-2.src",
"4AS-cluster:ccs-0:1.0.13-2.x86_64",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.i686",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.ia64",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.ppc64",
"4AS-cluster:ccs-debuginfo-0:1.0.13-2.x86_64",
"4AS-cluster:ccs-devel-0:1.0.13-2.i686",
"4AS-cluster:ccs-devel-0:1.0.13-2.ia64",
"4AS-cluster:ccs-devel-0:1.0.13-2.ppc64",
"4AS-cluster:ccs-devel-0:1.0.13-2.x86_64",
"4ES-cluster:ccs-0:1.0.13-2.i686",
"4ES-cluster:ccs-0:1.0.13-2.ia64",
"4ES-cluster:ccs-0:1.0.13-2.ppc64",
"4ES-cluster:ccs-0:1.0.13-2.src",
"4ES-cluster:ccs-0:1.0.13-2.x86_64",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.i686",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.ia64",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.ppc64",
"4ES-cluster:ccs-debuginfo-0:1.0.13-2.x86_64",
"4ES-cluster:ccs-devel-0:1.0.13-2.i686",
"4ES-cluster:ccs-devel-0:1.0.13-2.ia64",
"4ES-cluster:ccs-devel-0:1.0.13-2.ppc64",
"4ES-cluster:ccs-devel-0:1.0.13-2.x86_64",
"4WS-cluster:ccs-0:1.0.13-2.i686",
"4WS-cluster:ccs-0:1.0.13-2.ia64",
"4WS-cluster:ccs-0:1.0.13-2.ppc64",
"4WS-cluster:ccs-0:1.0.13-2.src",
"4WS-cluster:ccs-0:1.0.13-2.x86_64",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.i686",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.ia64",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.ppc64",
"4WS-cluster:ccs-debuginfo-0:1.0.13-2.x86_64",
"4WS-cluster:ccs-devel-0:1.0.13-2.i686",
"4WS-cluster:ccs-devel-0:1.0.13-2.ia64",
"4WS-cluster:ccs-devel-0:1.0.13-2.ppc64",
"4WS-cluster:ccs-devel-0:1.0.13-2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "rgmanager: multiple insecure temporary file use issues"
}
]
}
rhsa-2011_0264
Vulnerability from csaf_redhat
Published
2011-02-16 15:02
Modified
2024-11-14 10:50
Summary
Red Hat Security Advisory: rgmanager security and bug fix update
Notes
Topic
An updated rgmanager package that fixes multiple security issues and
several bugs is now available for Red Hat Cluster Suite 4.
The Red Hat Security Response Team has rated this update as having low
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
The rgmanager package contains the Red Hat Resource Group Manager, which
provides high availability for critical server applications.
Multiple insecure temporary file use flaws were discovered in rgmanager and
various resource scripts run by rgmanager. A local attacker could use these
flaws to overwrite an arbitrary file writable by the rgmanager process
(i.e. user root) with the output of rgmanager or a resource agent via a
symbolic link attack. (CVE-2008-6552)
It was discovered that certain resource agent scripts set the
LD_LIBRARY_PATH environment variable to an insecure value containing empty
path elements. A local user able to trick a user running those scripts to
run them while working from an attacker-writable directory could use this
flaw to escalate their privileges via a specially-crafted dynamic library.
(CVE-2010-3389)
Red Hat would like to thank Raphael Geissert for reporting the
CVE-2010-3389 issue.
This update also fixes the following bugs:
* Previously, starting threads could incorrectly include a reference to an
exited thread if that thread exited when rgmanager received a request
to start a new thread. Due to this issue, the new thread did not retry and
entered an infinite loop. This update ensures that new threads do not
reference old threads. Now, new threads no longer enter an infinite loop
in which the rgmanager enables and disables services without failing
gracefully. (BZ#502872)
* Previously, nfsclient.sh left temporary nfsclient-status-cache-$$ files
in /tmp/. (BZ#506152)
* Previously, the function local_node_name in
/resources/utils/member_util.sh did not correctly check whether magma_tool
failed. Due to this issue, empty strings could be returned. This update
checks the input and rejects empty strings. (BZ#516758)
* Previously, the file system agent could kill a process when an
application used a mount point with a similar name to a mount point managed
by rgmanager using force_unmount. With this update, the file system agent
kills only the processes that access the mount point managed by rgmanager.
(BZ#555901)
* Previously, simultaneous execution of "lvchange --deltag" from
/etc/init.d/rgmanager caused a checksum error on High Availability Logical
Volume Manager (HA-LVM). With this update, ownership of LVM tags is checked
before removing them. (BZ#559582)
* Previously, the isAlive check could fail if two nodes used the same file
name. With this update, the isAlive function prevents two nodes from using
the same file name. (BZ#469815)
* Previously, the S/Lang code could lead to unwanted S/Lang stack leaks
during event processing. (BZ#507430)
All users of rgmanager are advised to upgrade to this updated package,
which corrects these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Low"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An updated rgmanager package that fixes multiple security issues and\nseveral bugs is now available for Red Hat Cluster Suite 4.\n\nThe Red Hat Security Response Team has rated this update as having low\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The rgmanager package contains the Red Hat Resource Group Manager, which\nprovides high availability for critical server applications.\n\nMultiple insecure temporary file use flaws were discovered in rgmanager and\nvarious resource scripts run by rgmanager. A local attacker could use these\nflaws to overwrite an arbitrary file writable by the rgmanager process\n(i.e. user root) with the output of rgmanager or a resource agent via a\nsymbolic link attack. (CVE-2008-6552)\n\nIt was discovered that certain resource agent scripts set the\nLD_LIBRARY_PATH environment variable to an insecure value containing empty\npath elements. A local user able to trick a user running those scripts to\nrun them while working from an attacker-writable directory could use this\nflaw to escalate their privileges via a specially-crafted dynamic library.\n(CVE-2010-3389)\n\nRed Hat would like to thank Raphael Geissert for reporting the\nCVE-2010-3389 issue.\n\nThis update also fixes the following bugs:\n\n* Previously, starting threads could incorrectly include a reference to an\nexited thread if that thread exited when rgmanager received a request\nto start a new thread. Due to this issue, the new thread did not retry and\nentered an infinite loop. This update ensures that new threads do not\nreference old threads. Now, new threads no longer enter an infinite loop\nin which the rgmanager enables and disables services without failing\ngracefully. (BZ#502872)\n\n* Previously, nfsclient.sh left temporary nfsclient-status-cache-$$ files\nin /tmp/. (BZ#506152)\n\n* Previously, the function local_node_name in\n/resources/utils/member_util.sh did not correctly check whether magma_tool\nfailed. Due to this issue, empty strings could be returned. This update\nchecks the input and rejects empty strings. (BZ#516758)\n\n* Previously, the file system agent could kill a process when an\napplication used a mount point with a similar name to a mount point managed\nby rgmanager using force_unmount. With this update, the file system agent\nkills only the processes that access the mount point managed by rgmanager.\n(BZ#555901)\n\n* Previously, simultaneous execution of \"lvchange --deltag\" from\n/etc/init.d/rgmanager caused a checksum error on High Availability Logical\nVolume Manager (HA-LVM). With this update, ownership of LVM tags is checked\nbefore removing them. (BZ#559582)\n\n* Previously, the isAlive check could fail if two nodes used the same file\nname. With this update, the isAlive function prevents two nodes from using\nthe same file name. (BZ#469815)\n\n* Previously, the S/Lang code could lead to unwanted S/Lang stack leaks\nduring event processing. (BZ#507430)\n\nAll users of rgmanager are advised to upgrade to this updated package,\nwhich corrects these issues.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2011:0264",
"url": "https://access.redhat.com/errata/RHSA-2011:0264"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#low",
"url": "https://access.redhat.com/security/updates/classification/#low"
},
{
"category": "external",
"summary": "469815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=469815"
},
{
"category": "external",
"summary": "498985",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=498985"
},
{
"category": "external",
"summary": "506152",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=506152"
},
{
"category": "external",
"summary": "507430",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=507430"
},
{
"category": "external",
"summary": "516758",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=516758"
},
{
"category": "external",
"summary": "519436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=519436"
},
{
"category": "external",
"summary": "555901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=555901"
},
{
"category": "external",
"summary": "639044",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=639044"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0264.json"
}
],
"title": "Red Hat Security Advisory: rgmanager security and bug fix update",
"tracking": {
"current_release_date": "2024-11-14T10:50:34+00:00",
"generator": {
"date": "2024-11-14T10:50:34+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.0"
}
},
"id": "RHSA-2011:0264",
"initial_release_date": "2011-02-16T15:02:00+00:00",
"revision_history": [
{
"date": "2011-02-16T15:02:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2011-02-16T10:07:04+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T10:50:34+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Cluster Suite 4AS",
"product": {
"name": "Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_cluster:4"
}
}
},
{
"category": "product_name",
"name": "Red Hat Cluster Suite 4ES",
"product": {
"name": "Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_cluster:4"
}
}
},
{
"category": "product_name",
"name": "Red Hat Cluster Suite 4WS",
"product": {
"name": "Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_cluster:4"
}
}
}
],
"category": "product_family",
"name": "Red Hat Cluster Suite"
},
{
"branches": [
{
"category": "product_version",
"name": "rgmanager-0:1.9.88-2.el4.ia64",
"product": {
"name": "rgmanager-0:1.9.88-2.el4.ia64",
"product_id": "rgmanager-0:1.9.88-2.el4.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager@1.9.88-2.el4?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"product": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"product_id": "rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager-debuginfo@1.9.88-2.el4?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "rgmanager-0:1.9.88-2.el4.src",
"product": {
"name": "rgmanager-0:1.9.88-2.el4.src",
"product_id": "rgmanager-0:1.9.88-2.el4.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager@1.9.88-2.el4?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "rgmanager-0:1.9.88-2.el4.x86_64",
"product": {
"name": "rgmanager-0:1.9.88-2.el4.x86_64",
"product_id": "rgmanager-0:1.9.88-2.el4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager@1.9.88-2.el4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"product": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"product_id": "rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager-debuginfo@1.9.88-2.el4?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "rgmanager-0:1.9.88-2.el4.i386",
"product": {
"name": "rgmanager-0:1.9.88-2.el4.i386",
"product_id": "rgmanager-0:1.9.88-2.el4.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager@1.9.88-2.el4?arch=i386"
}
}
},
{
"category": "product_version",
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"product": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"product_id": "rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager-debuginfo@1.9.88-2.el4?arch=i386"
}
}
}
],
"category": "architecture",
"name": "i386"
},
{
"branches": [
{
"category": "product_version",
"name": "rgmanager-0:1.9.88-2.el4.ppc64",
"product": {
"name": "rgmanager-0:1.9.88-2.el4.ppc64",
"product_id": "rgmanager-0:1.9.88-2.el4.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager@1.9.88-2.el4?arch=ppc64"
}
}
},
{
"category": "product_version",
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"product": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"product_id": "rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager-debuginfo@1.9.88-2.el4?arch=ppc64"
}
}
}
],
"category": "architecture",
"name": "ppc64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.i386 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:rgmanager-0:1.9.88-2.el4.i386"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.i386",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.ia64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:rgmanager-0:1.9.88-2.el4.ia64"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.ia64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.ppc64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:rgmanager-0:1.9.88-2.el4.ppc64"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.ppc64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.src as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:rgmanager-0:1.9.88-2.el4.src"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.src",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.x86_64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:rgmanager-0:1.9.88-2.el4.x86_64"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.x86_64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.i386 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.ia64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.ppc64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.x86_64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.i386 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:rgmanager-0:1.9.88-2.el4.i386"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.i386",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.ia64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:rgmanager-0:1.9.88-2.el4.ia64"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.ia64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.ppc64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:rgmanager-0:1.9.88-2.el4.ppc64"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.ppc64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.src as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:rgmanager-0:1.9.88-2.el4.src"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.src",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.x86_64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:rgmanager-0:1.9.88-2.el4.x86_64"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.x86_64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.i386 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.ia64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.ppc64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.x86_64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.i386 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:rgmanager-0:1.9.88-2.el4.i386"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.i386",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.ia64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:rgmanager-0:1.9.88-2.el4.ia64"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.ia64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.ppc64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:rgmanager-0:1.9.88-2.el4.ppc64"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.ppc64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.src as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:rgmanager-0:1.9.88-2.el4.src"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.src",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.x86_64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:rgmanager-0:1.9.88-2.el4.x86_64"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.x86_64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.i386 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.ia64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.ppc64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.x86_64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"relates_to_product_reference": "4WS-cluster"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2008-6552",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2008-10-31T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "519436"
}
],
"notes": [
{
"category": "description",
"text": "Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rgmanager: multiple insecure temporary file use issues",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"4AS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.src",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2008-6552"
},
{
"category": "external",
"summary": "RHBZ#519436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=519436"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2008-6552",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-6552"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-6552",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-6552"
}
],
"release_date": "2008-10-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2011-02-16T15:02:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"4AS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.src",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2011:0264"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 5.4,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:C",
"version": "2.0"
},
"products": [
"4AS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.src",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "rgmanager: multiple insecure temporary file use issues"
},
{
"acknowledgments": [
{
"names": [
"Raphael Geissert"
]
}
],
"cve": "CVE-2010-3389",
"discovery_date": "2010-09-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "639044"
}
],
"notes": [
{
"category": "description",
"text": "The (1) SAPDatabase and (2) SAPInstance scripts in OCF Resource Agents (aka resource-agents or cluster-agents) 1.0.3 in Linux-HA place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rgmanager: insecure library loading vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"4AS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.src",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3389"
},
{
"category": "external",
"summary": "RHBZ#639044",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=639044"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3389",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3389"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3389",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3389"
}
],
"release_date": "2010-09-30T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2011-02-16T15:02:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"4AS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.src",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2011:0264"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 3.7,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"4AS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.src",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "rgmanager: insecure library loading vulnerability"
}
]
}
rhsa-2011:0264
Vulnerability from csaf_redhat
Published
2011-02-16 15:02
Modified
2025-11-08 03:24
Summary
Red Hat Security Advisory: rgmanager security and bug fix update
Notes
Topic
An updated rgmanager package that fixes multiple security issues and
several bugs is now available for Red Hat Cluster Suite 4.
The Red Hat Security Response Team has rated this update as having low
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
The rgmanager package contains the Red Hat Resource Group Manager, which
provides high availability for critical server applications.
Multiple insecure temporary file use flaws were discovered in rgmanager and
various resource scripts run by rgmanager. A local attacker could use these
flaws to overwrite an arbitrary file writable by the rgmanager process
(i.e. user root) with the output of rgmanager or a resource agent via a
symbolic link attack. (CVE-2008-6552)
It was discovered that certain resource agent scripts set the
LD_LIBRARY_PATH environment variable to an insecure value containing empty
path elements. A local user able to trick a user running those scripts to
run them while working from an attacker-writable directory could use this
flaw to escalate their privileges via a specially-crafted dynamic library.
(CVE-2010-3389)
Red Hat would like to thank Raphael Geissert for reporting the
CVE-2010-3389 issue.
This update also fixes the following bugs:
* Previously, starting threads could incorrectly include a reference to an
exited thread if that thread exited when rgmanager received a request
to start a new thread. Due to this issue, the new thread did not retry and
entered an infinite loop. This update ensures that new threads do not
reference old threads. Now, new threads no longer enter an infinite loop
in which the rgmanager enables and disables services without failing
gracefully. (BZ#502872)
* Previously, nfsclient.sh left temporary nfsclient-status-cache-$$ files
in /tmp/. (BZ#506152)
* Previously, the function local_node_name in
/resources/utils/member_util.sh did not correctly check whether magma_tool
failed. Due to this issue, empty strings could be returned. This update
checks the input and rejects empty strings. (BZ#516758)
* Previously, the file system agent could kill a process when an
application used a mount point with a similar name to a mount point managed
by rgmanager using force_unmount. With this update, the file system agent
kills only the processes that access the mount point managed by rgmanager.
(BZ#555901)
* Previously, simultaneous execution of "lvchange --deltag" from
/etc/init.d/rgmanager caused a checksum error on High Availability Logical
Volume Manager (HA-LVM). With this update, ownership of LVM tags is checked
before removing them. (BZ#559582)
* Previously, the isAlive check could fail if two nodes used the same file
name. With this update, the isAlive function prevents two nodes from using
the same file name. (BZ#469815)
* Previously, the S/Lang code could lead to unwanted S/Lang stack leaks
during event processing. (BZ#507430)
All users of rgmanager are advised to upgrade to this updated package,
which corrects these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Low"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An updated rgmanager package that fixes multiple security issues and\nseveral bugs is now available for Red Hat Cluster Suite 4.\n\nThe Red Hat Security Response Team has rated this update as having low\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The rgmanager package contains the Red Hat Resource Group Manager, which\nprovides high availability for critical server applications.\n\nMultiple insecure temporary file use flaws were discovered in rgmanager and\nvarious resource scripts run by rgmanager. A local attacker could use these\nflaws to overwrite an arbitrary file writable by the rgmanager process\n(i.e. user root) with the output of rgmanager or a resource agent via a\nsymbolic link attack. (CVE-2008-6552)\n\nIt was discovered that certain resource agent scripts set the\nLD_LIBRARY_PATH environment variable to an insecure value containing empty\npath elements. A local user able to trick a user running those scripts to\nrun them while working from an attacker-writable directory could use this\nflaw to escalate their privileges via a specially-crafted dynamic library.\n(CVE-2010-3389)\n\nRed Hat would like to thank Raphael Geissert for reporting the\nCVE-2010-3389 issue.\n\nThis update also fixes the following bugs:\n\n* Previously, starting threads could incorrectly include a reference to an\nexited thread if that thread exited when rgmanager received a request\nto start a new thread. Due to this issue, the new thread did not retry and\nentered an infinite loop. This update ensures that new threads do not\nreference old threads. Now, new threads no longer enter an infinite loop\nin which the rgmanager enables and disables services without failing\ngracefully. (BZ#502872)\n\n* Previously, nfsclient.sh left temporary nfsclient-status-cache-$$ files\nin /tmp/. (BZ#506152)\n\n* Previously, the function local_node_name in\n/resources/utils/member_util.sh did not correctly check whether magma_tool\nfailed. Due to this issue, empty strings could be returned. This update\nchecks the input and rejects empty strings. (BZ#516758)\n\n* Previously, the file system agent could kill a process when an\napplication used a mount point with a similar name to a mount point managed\nby rgmanager using force_unmount. With this update, the file system agent\nkills only the processes that access the mount point managed by rgmanager.\n(BZ#555901)\n\n* Previously, simultaneous execution of \"lvchange --deltag\" from\n/etc/init.d/rgmanager caused a checksum error on High Availability Logical\nVolume Manager (HA-LVM). With this update, ownership of LVM tags is checked\nbefore removing them. (BZ#559582)\n\n* Previously, the isAlive check could fail if two nodes used the same file\nname. With this update, the isAlive function prevents two nodes from using\nthe same file name. (BZ#469815)\n\n* Previously, the S/Lang code could lead to unwanted S/Lang stack leaks\nduring event processing. (BZ#507430)\n\nAll users of rgmanager are advised to upgrade to this updated package,\nwhich corrects these issues.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2011:0264",
"url": "https://access.redhat.com/errata/RHSA-2011:0264"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#low",
"url": "https://access.redhat.com/security/updates/classification/#low"
},
{
"category": "external",
"summary": "469815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=469815"
},
{
"category": "external",
"summary": "498985",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=498985"
},
{
"category": "external",
"summary": "506152",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=506152"
},
{
"category": "external",
"summary": "507430",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=507430"
},
{
"category": "external",
"summary": "516758",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=516758"
},
{
"category": "external",
"summary": "519436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=519436"
},
{
"category": "external",
"summary": "555901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=555901"
},
{
"category": "external",
"summary": "639044",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=639044"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0264.json"
}
],
"title": "Red Hat Security Advisory: rgmanager security and bug fix update",
"tracking": {
"current_release_date": "2025-11-08T03:24:22+00:00",
"generator": {
"date": "2025-11-08T03:24:22+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2011:0264",
"initial_release_date": "2011-02-16T15:02:00+00:00",
"revision_history": [
{
"date": "2011-02-16T15:02:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2011-02-16T10:07:04+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-08T03:24:22+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Cluster Suite 4AS",
"product": {
"name": "Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_cluster:4"
}
}
},
{
"category": "product_name",
"name": "Red Hat Cluster Suite 4ES",
"product": {
"name": "Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_cluster:4"
}
}
},
{
"category": "product_name",
"name": "Red Hat Cluster Suite 4WS",
"product": {
"name": "Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_cluster:4"
}
}
}
],
"category": "product_family",
"name": "Red Hat Cluster Suite"
},
{
"branches": [
{
"category": "product_version",
"name": "rgmanager-0:1.9.88-2.el4.ia64",
"product": {
"name": "rgmanager-0:1.9.88-2.el4.ia64",
"product_id": "rgmanager-0:1.9.88-2.el4.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager@1.9.88-2.el4?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"product": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"product_id": "rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager-debuginfo@1.9.88-2.el4?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "rgmanager-0:1.9.88-2.el4.src",
"product": {
"name": "rgmanager-0:1.9.88-2.el4.src",
"product_id": "rgmanager-0:1.9.88-2.el4.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager@1.9.88-2.el4?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "rgmanager-0:1.9.88-2.el4.x86_64",
"product": {
"name": "rgmanager-0:1.9.88-2.el4.x86_64",
"product_id": "rgmanager-0:1.9.88-2.el4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager@1.9.88-2.el4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"product": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"product_id": "rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager-debuginfo@1.9.88-2.el4?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "rgmanager-0:1.9.88-2.el4.i386",
"product": {
"name": "rgmanager-0:1.9.88-2.el4.i386",
"product_id": "rgmanager-0:1.9.88-2.el4.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager@1.9.88-2.el4?arch=i386"
}
}
},
{
"category": "product_version",
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"product": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"product_id": "rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager-debuginfo@1.9.88-2.el4?arch=i386"
}
}
}
],
"category": "architecture",
"name": "i386"
},
{
"branches": [
{
"category": "product_version",
"name": "rgmanager-0:1.9.88-2.el4.ppc64",
"product": {
"name": "rgmanager-0:1.9.88-2.el4.ppc64",
"product_id": "rgmanager-0:1.9.88-2.el4.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager@1.9.88-2.el4?arch=ppc64"
}
}
},
{
"category": "product_version",
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"product": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"product_id": "rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager-debuginfo@1.9.88-2.el4?arch=ppc64"
}
}
}
],
"category": "architecture",
"name": "ppc64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.i386 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:rgmanager-0:1.9.88-2.el4.i386"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.i386",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.ia64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:rgmanager-0:1.9.88-2.el4.ia64"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.ia64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.ppc64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:rgmanager-0:1.9.88-2.el4.ppc64"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.ppc64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.src as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:rgmanager-0:1.9.88-2.el4.src"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.src",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.x86_64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:rgmanager-0:1.9.88-2.el4.x86_64"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.x86_64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.i386 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.ia64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.ppc64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.x86_64 as a component of Red Hat Cluster Suite 4AS",
"product_id": "4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"relates_to_product_reference": "4AS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.i386 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:rgmanager-0:1.9.88-2.el4.i386"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.i386",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.ia64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:rgmanager-0:1.9.88-2.el4.ia64"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.ia64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.ppc64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:rgmanager-0:1.9.88-2.el4.ppc64"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.ppc64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.src as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:rgmanager-0:1.9.88-2.el4.src"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.src",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.x86_64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:rgmanager-0:1.9.88-2.el4.x86_64"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.x86_64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.i386 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.ia64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.ppc64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.x86_64 as a component of Red Hat Cluster Suite 4ES",
"product_id": "4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"relates_to_product_reference": "4ES-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.i386 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:rgmanager-0:1.9.88-2.el4.i386"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.i386",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.ia64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:rgmanager-0:1.9.88-2.el4.ia64"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.ia64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.ppc64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:rgmanager-0:1.9.88-2.el4.ppc64"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.ppc64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.src as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:rgmanager-0:1.9.88-2.el4.src"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.src",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:1.9.88-2.el4.x86_64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:rgmanager-0:1.9.88-2.el4.x86_64"
},
"product_reference": "rgmanager-0:1.9.88-2.el4.x86_64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.i386 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.ia64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.ppc64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"relates_to_product_reference": "4WS-cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:1.9.88-2.el4.x86_64 as a component of Red Hat Cluster Suite 4WS",
"product_id": "4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64"
},
"product_reference": "rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"relates_to_product_reference": "4WS-cluster"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2008-6552",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2008-10-31T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "519436"
}
],
"notes": [
{
"category": "description",
"text": "Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rgmanager: multiple insecure temporary file use issues",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"4AS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.src",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2008-6552"
},
{
"category": "external",
"summary": "RHBZ#519436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=519436"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2008-6552",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-6552"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-6552",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-6552"
}
],
"release_date": "2008-10-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2011-02-16T15:02:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"4AS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.src",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2011:0264"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 5.4,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:C",
"version": "2.0"
},
"products": [
"4AS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.src",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "rgmanager: multiple insecure temporary file use issues"
},
{
"acknowledgments": [
{
"names": [
"Raphael Geissert"
]
}
],
"cve": "CVE-2010-3389",
"discovery_date": "2010-09-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "639044"
}
],
"notes": [
{
"category": "description",
"text": "The (1) SAPDatabase and (2) SAPInstance scripts in OCF Resource Agents (aka resource-agents or cluster-agents) 1.0.3 in Linux-HA place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rgmanager: insecure library loading vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"4AS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.src",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3389"
},
{
"category": "external",
"summary": "RHBZ#639044",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=639044"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3389",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3389"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3389",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3389"
}
],
"release_date": "2010-09-30T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2011-02-16T15:02:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"4AS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.src",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2011:0264"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 3.7,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"4AS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4AS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4AS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.src",
"4ES-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4ES-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.src",
"4WS-cluster:rgmanager-0:1.9.88-2.el4.x86_64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.i386",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ia64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.ppc64",
"4WS-cluster:rgmanager-debuginfo-0:1.9.88-2.el4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "rgmanager: insecure library loading vulnerability"
}
]
}
rhsa-2009:1337
Vulnerability from csaf_redhat
Published
2009-09-02 08:00
Modified
2025-11-08 03:24
Summary
Red Hat Security Advisory: gfs2-utils security and bug fix update
Notes
Topic
An updated gfs2-utils package that fixes multiple security issues and
various bugs is now available for Red Hat Enterprise Linux 5.
This update has been rated as having low security impact by the Red Hat
Security Response Team.
Details
The gfs2-utils package provides the user-space tools necessary to mount,
create, maintain, and test GFS2 file systems.
Multiple insecure temporary file use flaws were discovered in GFS2 user
level utilities. A local attacker could use these flaws to overwrite an
arbitrary file writable by a victim running those utilities (typically
root) with the output of the utilities via a symbolic link attack.
(CVE-2008-6552)
This update also fixes the following bugs:
* gfs2_fsck now properly detects and repairs problems with sequence numbers
on GFS2 file systems.
* GFS2 user utilities now use the file system UUID.
* gfs2_grow now properly updates the file system size during operation.
* gfs2_fsck now returns the proper exit codes.
* gfs2_convert now properly frees blocks when removing free blocks up to
height 2.
* the gfs2_fsck manual page has been renamed to fsck.gfs2 to match current
standards.
* the 'gfs2_tool df' command now provides human-readable output.
* mounting GFS2 file systems with the noatime or noquota option now works
properly.
* new capabilities have been added to the gfs2_edit tool to help in testing
and debugging GFS and GFS2 issues.
* the 'gfs2_tool df' command no longer segfaults on file systems with a
block size other than 4k.
* the gfs2_grow manual page no longer references the '-r' option, which has
been removed.
* the 'gfs2_tool unfreeze' command no longer hangs during use.
* gfs2_convert no longer corrupts file systems when converting from GFS to
GFS2.
* gfs2_fsck no longer segfaults when encountering a block which is listed
as both a data and stuffed directory inode.
* gfs2_fsck can now fix file systems even if the journal is already locked
for use.
* a GFS2 file system's metadata is now properly copied with 'gfs2_edit
savemeta' and 'gfs2_edit restoremeta'.
* the gfs2_edit savemeta function now properly saves blocks of type 2.
* 'gfs2_convert -vy' now works properly on the PowerPC architecture.
* when mounting a GFS2 file system as '/', mount_gfs2 no longer fails after
being unable to find the file system in '/proc/mounts'.
* gfs2_fsck no longer segfaults when fixing 'EA leaf block type' problems.
All gfs2-utils users should upgrade to this updated package, which resolves
these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Low"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An updated gfs2-utils package that fixes multiple security issues and\nvarious bugs is now available for Red Hat Enterprise Linux 5.\n\nThis update has been rated as having low security impact by the Red Hat\nSecurity Response Team.",
"title": "Topic"
},
{
"category": "general",
"text": "The gfs2-utils package provides the user-space tools necessary to mount,\ncreate, maintain, and test GFS2 file systems.\n\nMultiple insecure temporary file use flaws were discovered in GFS2 user\nlevel utilities. A local attacker could use these flaws to overwrite an\narbitrary file writable by a victim running those utilities (typically\nroot) with the output of the utilities via a symbolic link attack.\n(CVE-2008-6552)\n\nThis update also fixes the following bugs:\n\n* gfs2_fsck now properly detects and repairs problems with sequence numbers\non GFS2 file systems.\n\n* GFS2 user utilities now use the file system UUID.\n\n* gfs2_grow now properly updates the file system size during operation.\n\n* gfs2_fsck now returns the proper exit codes.\n\n* gfs2_convert now properly frees blocks when removing free blocks up to\nheight 2.\n\n* the gfs2_fsck manual page has been renamed to fsck.gfs2 to match current\nstandards.\n\n* the \u0027gfs2_tool df\u0027 command now provides human-readable output.\n\n* mounting GFS2 file systems with the noatime or noquota option now works\nproperly.\n\n* new capabilities have been added to the gfs2_edit tool to help in testing\nand debugging GFS and GFS2 issues.\n\n* the \u0027gfs2_tool df\u0027 command no longer segfaults on file systems with a\nblock size other than 4k.\n\n* the gfs2_grow manual page no longer references the \u0027-r\u0027 option, which has\nbeen removed.\n\n* the \u0027gfs2_tool unfreeze\u0027 command no longer hangs during use.\n\n* gfs2_convert no longer corrupts file systems when converting from GFS to\nGFS2.\n\n* gfs2_fsck no longer segfaults when encountering a block which is listed\nas both a data and stuffed directory inode.\n\n* gfs2_fsck can now fix file systems even if the journal is already locked\nfor use.\n\n* a GFS2 file system\u0027s metadata is now properly copied with \u0027gfs2_edit\nsavemeta\u0027 and \u0027gfs2_edit restoremeta\u0027.\n\n* the gfs2_edit savemeta function now properly saves blocks of type 2.\n\n* \u0027gfs2_convert -vy\u0027 now works properly on the PowerPC architecture.\n\n* when mounting a GFS2 file system as \u0027/\u0027, mount_gfs2 no longer fails after\nbeing unable to find the file system in \u0027/proc/mounts\u0027.\n\n* gfs2_fsck no longer segfaults when fixing \u0027EA leaf block type\u0027 problems.\n\nAll gfs2-utils users should upgrade to this updated package, which resolves\nthese issues.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2009:1337",
"url": "https://access.redhat.com/errata/RHSA-2009:1337"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#low",
"url": "https://access.redhat.com/security/updates/classification/#low"
},
{
"category": "external",
"summary": "242701",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=242701"
},
{
"category": "external",
"summary": "469773",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=469773"
},
{
"category": "external",
"summary": "474705",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=474705"
},
{
"category": "external",
"summary": "474707",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=474707"
},
{
"category": "external",
"summary": "477072",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=477072"
},
{
"category": "external",
"summary": "481762",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=481762"
},
{
"category": "external",
"summary": "483799",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=483799"
},
{
"category": "external",
"summary": "485761",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=485761"
},
{
"category": "external",
"summary": "486034",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=486034"
},
{
"category": "external",
"summary": "487608",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=487608"
},
{
"category": "external",
"summary": "498646",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=498646"
},
{
"category": "external",
"summary": "501732",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=501732"
},
{
"category": "external",
"summary": "502056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=502056"
},
{
"category": "external",
"summary": "506629",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=506629"
},
{
"category": "external",
"summary": "510758",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=510758"
},
{
"category": "external",
"summary": "519436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=519436"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1337.json"
}
],
"title": "Red Hat Security Advisory: gfs2-utils security and bug fix update",
"tracking": {
"current_release_date": "2025-11-08T03:24:12+00:00",
"generator": {
"date": "2025-11-08T03:24:12+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2009:1337",
"initial_release_date": "2009-09-02T08:00:00+00:00",
"revision_history": [
{
"date": "2009-09-02T08:00:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2009-09-01T06:41:56+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-08T03:24:12+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop (v. 5 client)",
"product": {
"name": "Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:5::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux (v. 5 server)",
"product": {
"name": "Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:5::server"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64",
"product": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64",
"product_id": "gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils-debuginfo@0.1.62-1.el5?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "gfs2-utils-0:0.1.62-1.el5.x86_64",
"product": {
"name": "gfs2-utils-0:0.1.62-1.el5.x86_64",
"product_id": "gfs2-utils-0:0.1.62-1.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils@0.1.62-1.el5?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"product": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"product_id": "gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils-debuginfo@0.1.62-1.el5?arch=i386"
}
}
},
{
"category": "product_version",
"name": "gfs2-utils-0:0.1.62-1.el5.i386",
"product": {
"name": "gfs2-utils-0:0.1.62-1.el5.i386",
"product_id": "gfs2-utils-0:0.1.62-1.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils@0.1.62-1.el5?arch=i386"
}
}
}
],
"category": "architecture",
"name": "i386"
},
{
"branches": [
{
"category": "product_version",
"name": "gfs2-utils-0:0.1.62-1.el5.src",
"product": {
"name": "gfs2-utils-0:0.1.62-1.el5.src",
"product_id": "gfs2-utils-0:0.1.62-1.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils@0.1.62-1.el5?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"product": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"product_id": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils-debuginfo@0.1.62-1.el5?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "gfs2-utils-0:0.1.62-1.el5.ia64",
"product": {
"name": "gfs2-utils-0:0.1.62-1.el5.ia64",
"product_id": "gfs2-utils-0:0.1.62-1.el5.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils@0.1.62-1.el5?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"product": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"product_id": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils-debuginfo@0.1.62-1.el5?arch=ppc"
}
}
},
{
"category": "product_version",
"name": "gfs2-utils-0:0.1.62-1.el5.ppc",
"product": {
"name": "gfs2-utils-0:0.1.62-1.el5.ppc",
"product_id": "gfs2-utils-0:0.1.62-1.el5.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils@0.1.62-1.el5?arch=ppc"
}
}
}
],
"category": "architecture",
"name": "ppc"
},
{
"branches": [
{
"category": "product_version",
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"product": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"product_id": "gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils-debuginfo@0.1.62-1.el5?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "gfs2-utils-0:0.1.62-1.el5.s390x",
"product": {
"name": "gfs2-utils-0:0.1.62-1.el5.s390x",
"product_id": "gfs2-utils-0:0.1.62-1.el5.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils@0.1.62-1.el5?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-0:0.1.62-1.el5.i386"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.i386",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-0:0.1.62-1.el5.ia64"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.ia64",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-0:0.1.62-1.el5.ppc"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.ppc",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-0:0.1.62-1.el5.s390x"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.s390x",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.src as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-0:0.1.62-1.el5.src"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.src",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-0:0.1.62-1.el5.x86_64"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.x86_64",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.i386"
},
"product_reference": "gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64"
},
"product_reference": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc"
},
"product_reference": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x"
},
"product_reference": "gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64"
},
"product_reference": "gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-0:0.1.62-1.el5.i386"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.i386",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-0:0.1.62-1.el5.ia64"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.ia64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-0:0.1.62-1.el5.ppc"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.ppc",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-0:0.1.62-1.el5.s390x"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.s390x",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.src as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-0:0.1.62-1.el5.src"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.src",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-0:0.1.62-1.el5.x86_64"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.x86_64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.i386"
},
"product_reference": "gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64"
},
"product_reference": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc"
},
"product_reference": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x"
},
"product_reference": "gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64"
},
"product_reference": "gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64",
"relates_to_product_reference": "5Server"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2008-6552",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2008-10-31T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "519436"
}
],
"notes": [
{
"category": "description",
"text": "Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rgmanager: multiple insecure temporary file use issues",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client:gfs2-utils-0:0.1.62-1.el5.i386",
"5Client:gfs2-utils-0:0.1.62-1.el5.ia64",
"5Client:gfs2-utils-0:0.1.62-1.el5.ppc",
"5Client:gfs2-utils-0:0.1.62-1.el5.s390x",
"5Client:gfs2-utils-0:0.1.62-1.el5.src",
"5Client:gfs2-utils-0:0.1.62-1.el5.x86_64",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64",
"5Server:gfs2-utils-0:0.1.62-1.el5.i386",
"5Server:gfs2-utils-0:0.1.62-1.el5.ia64",
"5Server:gfs2-utils-0:0.1.62-1.el5.ppc",
"5Server:gfs2-utils-0:0.1.62-1.el5.s390x",
"5Server:gfs2-utils-0:0.1.62-1.el5.src",
"5Server:gfs2-utils-0:0.1.62-1.el5.x86_64",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2008-6552"
},
{
"category": "external",
"summary": "RHBZ#519436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=519436"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2008-6552",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-6552"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-6552",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-6552"
}
],
"release_date": "2008-10-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2009-09-02T08:00:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Client:gfs2-utils-0:0.1.62-1.el5.i386",
"5Client:gfs2-utils-0:0.1.62-1.el5.ia64",
"5Client:gfs2-utils-0:0.1.62-1.el5.ppc",
"5Client:gfs2-utils-0:0.1.62-1.el5.s390x",
"5Client:gfs2-utils-0:0.1.62-1.el5.src",
"5Client:gfs2-utils-0:0.1.62-1.el5.x86_64",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64",
"5Server:gfs2-utils-0:0.1.62-1.el5.i386",
"5Server:gfs2-utils-0:0.1.62-1.el5.ia64",
"5Server:gfs2-utils-0:0.1.62-1.el5.ppc",
"5Server:gfs2-utils-0:0.1.62-1.el5.s390x",
"5Server:gfs2-utils-0:0.1.62-1.el5.src",
"5Server:gfs2-utils-0:0.1.62-1.el5.x86_64",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2009:1337"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 5.4,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:C",
"version": "2.0"
},
"products": [
"5Client:gfs2-utils-0:0.1.62-1.el5.i386",
"5Client:gfs2-utils-0:0.1.62-1.el5.ia64",
"5Client:gfs2-utils-0:0.1.62-1.el5.ppc",
"5Client:gfs2-utils-0:0.1.62-1.el5.s390x",
"5Client:gfs2-utils-0:0.1.62-1.el5.src",
"5Client:gfs2-utils-0:0.1.62-1.el5.x86_64",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64",
"5Server:gfs2-utils-0:0.1.62-1.el5.i386",
"5Server:gfs2-utils-0:0.1.62-1.el5.ia64",
"5Server:gfs2-utils-0:0.1.62-1.el5.ppc",
"5Server:gfs2-utils-0:0.1.62-1.el5.s390x",
"5Server:gfs2-utils-0:0.1.62-1.el5.src",
"5Server:gfs2-utils-0:0.1.62-1.el5.x86_64",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "rgmanager: multiple insecure temporary file use issues"
}
]
}
rhsa-2009_1337
Vulnerability from csaf_redhat
Published
2009-09-02 08:00
Modified
2024-11-14 10:07
Summary
Red Hat Security Advisory: gfs2-utils security and bug fix update
Notes
Topic
An updated gfs2-utils package that fixes multiple security issues and
various bugs is now available for Red Hat Enterprise Linux 5.
This update has been rated as having low security impact by the Red Hat
Security Response Team.
Details
The gfs2-utils package provides the user-space tools necessary to mount,
create, maintain, and test GFS2 file systems.
Multiple insecure temporary file use flaws were discovered in GFS2 user
level utilities. A local attacker could use these flaws to overwrite an
arbitrary file writable by a victim running those utilities (typically
root) with the output of the utilities via a symbolic link attack.
(CVE-2008-6552)
This update also fixes the following bugs:
* gfs2_fsck now properly detects and repairs problems with sequence numbers
on GFS2 file systems.
* GFS2 user utilities now use the file system UUID.
* gfs2_grow now properly updates the file system size during operation.
* gfs2_fsck now returns the proper exit codes.
* gfs2_convert now properly frees blocks when removing free blocks up to
height 2.
* the gfs2_fsck manual page has been renamed to fsck.gfs2 to match current
standards.
* the 'gfs2_tool df' command now provides human-readable output.
* mounting GFS2 file systems with the noatime or noquota option now works
properly.
* new capabilities have been added to the gfs2_edit tool to help in testing
and debugging GFS and GFS2 issues.
* the 'gfs2_tool df' command no longer segfaults on file systems with a
block size other than 4k.
* the gfs2_grow manual page no longer references the '-r' option, which has
been removed.
* the 'gfs2_tool unfreeze' command no longer hangs during use.
* gfs2_convert no longer corrupts file systems when converting from GFS to
GFS2.
* gfs2_fsck no longer segfaults when encountering a block which is listed
as both a data and stuffed directory inode.
* gfs2_fsck can now fix file systems even if the journal is already locked
for use.
* a GFS2 file system's metadata is now properly copied with 'gfs2_edit
savemeta' and 'gfs2_edit restoremeta'.
* the gfs2_edit savemeta function now properly saves blocks of type 2.
* 'gfs2_convert -vy' now works properly on the PowerPC architecture.
* when mounting a GFS2 file system as '/', mount_gfs2 no longer fails after
being unable to find the file system in '/proc/mounts'.
* gfs2_fsck no longer segfaults when fixing 'EA leaf block type' problems.
All gfs2-utils users should upgrade to this updated package, which resolves
these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Low"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An updated gfs2-utils package that fixes multiple security issues and\nvarious bugs is now available for Red Hat Enterprise Linux 5.\n\nThis update has been rated as having low security impact by the Red Hat\nSecurity Response Team.",
"title": "Topic"
},
{
"category": "general",
"text": "The gfs2-utils package provides the user-space tools necessary to mount,\ncreate, maintain, and test GFS2 file systems.\n\nMultiple insecure temporary file use flaws were discovered in GFS2 user\nlevel utilities. A local attacker could use these flaws to overwrite an\narbitrary file writable by a victim running those utilities (typically\nroot) with the output of the utilities via a symbolic link attack.\n(CVE-2008-6552)\n\nThis update also fixes the following bugs:\n\n* gfs2_fsck now properly detects and repairs problems with sequence numbers\non GFS2 file systems.\n\n* GFS2 user utilities now use the file system UUID.\n\n* gfs2_grow now properly updates the file system size during operation.\n\n* gfs2_fsck now returns the proper exit codes.\n\n* gfs2_convert now properly frees blocks when removing free blocks up to\nheight 2.\n\n* the gfs2_fsck manual page has been renamed to fsck.gfs2 to match current\nstandards.\n\n* the \u0027gfs2_tool df\u0027 command now provides human-readable output.\n\n* mounting GFS2 file systems with the noatime or noquota option now works\nproperly.\n\n* new capabilities have been added to the gfs2_edit tool to help in testing\nand debugging GFS and GFS2 issues.\n\n* the \u0027gfs2_tool df\u0027 command no longer segfaults on file systems with a\nblock size other than 4k.\n\n* the gfs2_grow manual page no longer references the \u0027-r\u0027 option, which has\nbeen removed.\n\n* the \u0027gfs2_tool unfreeze\u0027 command no longer hangs during use.\n\n* gfs2_convert no longer corrupts file systems when converting from GFS to\nGFS2.\n\n* gfs2_fsck no longer segfaults when encountering a block which is listed\nas both a data and stuffed directory inode.\n\n* gfs2_fsck can now fix file systems even if the journal is already locked\nfor use.\n\n* a GFS2 file system\u0027s metadata is now properly copied with \u0027gfs2_edit\nsavemeta\u0027 and \u0027gfs2_edit restoremeta\u0027.\n\n* the gfs2_edit savemeta function now properly saves blocks of type 2.\n\n* \u0027gfs2_convert -vy\u0027 now works properly on the PowerPC architecture.\n\n* when mounting a GFS2 file system as \u0027/\u0027, mount_gfs2 no longer fails after\nbeing unable to find the file system in \u0027/proc/mounts\u0027.\n\n* gfs2_fsck no longer segfaults when fixing \u0027EA leaf block type\u0027 problems.\n\nAll gfs2-utils users should upgrade to this updated package, which resolves\nthese issues.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2009:1337",
"url": "https://access.redhat.com/errata/RHSA-2009:1337"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#low",
"url": "https://access.redhat.com/security/updates/classification/#low"
},
{
"category": "external",
"summary": "242701",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=242701"
},
{
"category": "external",
"summary": "469773",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=469773"
},
{
"category": "external",
"summary": "474705",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=474705"
},
{
"category": "external",
"summary": "474707",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=474707"
},
{
"category": "external",
"summary": "477072",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=477072"
},
{
"category": "external",
"summary": "481762",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=481762"
},
{
"category": "external",
"summary": "483799",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=483799"
},
{
"category": "external",
"summary": "485761",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=485761"
},
{
"category": "external",
"summary": "486034",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=486034"
},
{
"category": "external",
"summary": "487608",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=487608"
},
{
"category": "external",
"summary": "498646",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=498646"
},
{
"category": "external",
"summary": "501732",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=501732"
},
{
"category": "external",
"summary": "502056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=502056"
},
{
"category": "external",
"summary": "506629",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=506629"
},
{
"category": "external",
"summary": "510758",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=510758"
},
{
"category": "external",
"summary": "519436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=519436"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1337.json"
}
],
"title": "Red Hat Security Advisory: gfs2-utils security and bug fix update",
"tracking": {
"current_release_date": "2024-11-14T10:07:22+00:00",
"generator": {
"date": "2024-11-14T10:07:22+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.0"
}
},
"id": "RHSA-2009:1337",
"initial_release_date": "2009-09-02T08:00:00+00:00",
"revision_history": [
{
"date": "2009-09-02T08:00:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2009-09-01T06:41:56+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T10:07:22+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop (v. 5 client)",
"product": {
"name": "Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:5::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux (v. 5 server)",
"product": {
"name": "Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:5::server"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64",
"product": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64",
"product_id": "gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils-debuginfo@0.1.62-1.el5?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "gfs2-utils-0:0.1.62-1.el5.x86_64",
"product": {
"name": "gfs2-utils-0:0.1.62-1.el5.x86_64",
"product_id": "gfs2-utils-0:0.1.62-1.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils@0.1.62-1.el5?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"product": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"product_id": "gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils-debuginfo@0.1.62-1.el5?arch=i386"
}
}
},
{
"category": "product_version",
"name": "gfs2-utils-0:0.1.62-1.el5.i386",
"product": {
"name": "gfs2-utils-0:0.1.62-1.el5.i386",
"product_id": "gfs2-utils-0:0.1.62-1.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils@0.1.62-1.el5?arch=i386"
}
}
}
],
"category": "architecture",
"name": "i386"
},
{
"branches": [
{
"category": "product_version",
"name": "gfs2-utils-0:0.1.62-1.el5.src",
"product": {
"name": "gfs2-utils-0:0.1.62-1.el5.src",
"product_id": "gfs2-utils-0:0.1.62-1.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils@0.1.62-1.el5?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"product": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"product_id": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils-debuginfo@0.1.62-1.el5?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "gfs2-utils-0:0.1.62-1.el5.ia64",
"product": {
"name": "gfs2-utils-0:0.1.62-1.el5.ia64",
"product_id": "gfs2-utils-0:0.1.62-1.el5.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils@0.1.62-1.el5?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"product": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"product_id": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils-debuginfo@0.1.62-1.el5?arch=ppc"
}
}
},
{
"category": "product_version",
"name": "gfs2-utils-0:0.1.62-1.el5.ppc",
"product": {
"name": "gfs2-utils-0:0.1.62-1.el5.ppc",
"product_id": "gfs2-utils-0:0.1.62-1.el5.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils@0.1.62-1.el5?arch=ppc"
}
}
}
],
"category": "architecture",
"name": "ppc"
},
{
"branches": [
{
"category": "product_version",
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"product": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"product_id": "gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils-debuginfo@0.1.62-1.el5?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "gfs2-utils-0:0.1.62-1.el5.s390x",
"product": {
"name": "gfs2-utils-0:0.1.62-1.el5.s390x",
"product_id": "gfs2-utils-0:0.1.62-1.el5.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gfs2-utils@0.1.62-1.el5?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-0:0.1.62-1.el5.i386"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.i386",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-0:0.1.62-1.el5.ia64"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.ia64",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-0:0.1.62-1.el5.ppc"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.ppc",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-0:0.1.62-1.el5.s390x"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.s390x",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.src as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-0:0.1.62-1.el5.src"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.src",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-0:0.1.62-1.el5.x86_64"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.x86_64",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.i386"
},
"product_reference": "gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64"
},
"product_reference": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc"
},
"product_reference": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x"
},
"product_reference": "gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64"
},
"product_reference": "gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-0:0.1.62-1.el5.i386"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.i386",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-0:0.1.62-1.el5.ia64"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.ia64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-0:0.1.62-1.el5.ppc"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.ppc",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-0:0.1.62-1.el5.s390x"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.s390x",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.src as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-0:0.1.62-1.el5.src"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.src",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-0:0.1.62-1.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-0:0.1.62-1.el5.x86_64"
},
"product_reference": "gfs2-utils-0:0.1.62-1.el5.x86_64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.i386"
},
"product_reference": "gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64"
},
"product_reference": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc"
},
"product_reference": "gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x"
},
"product_reference": "gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64"
},
"product_reference": "gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64",
"relates_to_product_reference": "5Server"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2008-6552",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2008-10-31T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "519436"
}
],
"notes": [
{
"category": "description",
"text": "Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rgmanager: multiple insecure temporary file use issues",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client:gfs2-utils-0:0.1.62-1.el5.i386",
"5Client:gfs2-utils-0:0.1.62-1.el5.ia64",
"5Client:gfs2-utils-0:0.1.62-1.el5.ppc",
"5Client:gfs2-utils-0:0.1.62-1.el5.s390x",
"5Client:gfs2-utils-0:0.1.62-1.el5.src",
"5Client:gfs2-utils-0:0.1.62-1.el5.x86_64",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64",
"5Server:gfs2-utils-0:0.1.62-1.el5.i386",
"5Server:gfs2-utils-0:0.1.62-1.el5.ia64",
"5Server:gfs2-utils-0:0.1.62-1.el5.ppc",
"5Server:gfs2-utils-0:0.1.62-1.el5.s390x",
"5Server:gfs2-utils-0:0.1.62-1.el5.src",
"5Server:gfs2-utils-0:0.1.62-1.el5.x86_64",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2008-6552"
},
{
"category": "external",
"summary": "RHBZ#519436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=519436"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2008-6552",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-6552"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-6552",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-6552"
}
],
"release_date": "2008-10-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2009-09-02T08:00:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Client:gfs2-utils-0:0.1.62-1.el5.i386",
"5Client:gfs2-utils-0:0.1.62-1.el5.ia64",
"5Client:gfs2-utils-0:0.1.62-1.el5.ppc",
"5Client:gfs2-utils-0:0.1.62-1.el5.s390x",
"5Client:gfs2-utils-0:0.1.62-1.el5.src",
"5Client:gfs2-utils-0:0.1.62-1.el5.x86_64",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64",
"5Server:gfs2-utils-0:0.1.62-1.el5.i386",
"5Server:gfs2-utils-0:0.1.62-1.el5.ia64",
"5Server:gfs2-utils-0:0.1.62-1.el5.ppc",
"5Server:gfs2-utils-0:0.1.62-1.el5.s390x",
"5Server:gfs2-utils-0:0.1.62-1.el5.src",
"5Server:gfs2-utils-0:0.1.62-1.el5.x86_64",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2009:1337"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 5.4,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:C",
"version": "2.0"
},
"products": [
"5Client:gfs2-utils-0:0.1.62-1.el5.i386",
"5Client:gfs2-utils-0:0.1.62-1.el5.ia64",
"5Client:gfs2-utils-0:0.1.62-1.el5.ppc",
"5Client:gfs2-utils-0:0.1.62-1.el5.s390x",
"5Client:gfs2-utils-0:0.1.62-1.el5.src",
"5Client:gfs2-utils-0:0.1.62-1.el5.x86_64",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"5Client:gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64",
"5Server:gfs2-utils-0:0.1.62-1.el5.i386",
"5Server:gfs2-utils-0:0.1.62-1.el5.ia64",
"5Server:gfs2-utils-0:0.1.62-1.el5.ppc",
"5Server:gfs2-utils-0:0.1.62-1.el5.s390x",
"5Server:gfs2-utils-0:0.1.62-1.el5.src",
"5Server:gfs2-utils-0:0.1.62-1.el5.x86_64",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.i386",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.ia64",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.ppc",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.s390x",
"5Server:gfs2-utils-debuginfo-0:0.1.62-1.el5.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "rgmanager: multiple insecure temporary file use issues"
}
]
}
RHSA-2009:1341
Vulnerability from csaf_redhat
Published
2009-09-02 08:00
Modified
2025-11-08 03:24
Summary
Red Hat Security Advisory: cman security, bug fix, and enhancement update
Notes
Topic
Updated cman packages that fix several security issues, various bugs, and
add enhancements are now available for Red Hat Enterprise Linux 5.
This update has been rated as having low security impact by the Red Hat
Security Response Team.
Details
The Cluster Manager (cman) utility provides services for managing a Linux
cluster.
Multiple insecure temporary file use flaws were found in fence_apc_snmp and
ccs_tool. A local attacker could use these flaws to overwrite an arbitrary
file writable by a victim running those utilities (typically root) with
the output of the utilities via a symbolic link attack. (CVE-2008-4579,
CVE-2008-6552)
Bug fixes:
* a buffer could overflow if cluster.conf had more than 52 entries per
block inside the <cman> block. The limit is now 1024.
* the output of the group_tool dump subcommands were NULL padded.
* using device="" instead of label="" no longer causes qdiskd to
incorrectly exit.
* the IPMI fencing agent has been modified to time out after 10 seconds. It
is also now possible to specify a different timeout value with the '-t'
option.
* the IPMI fencing agent now allows punctuation in passwords.
* quickly starting and stopping the cman service no longer causes the
cluster membership to become inconsistent across the cluster.
* an issue with lock syncing caused 'receive_own from' errors to be logged
to '/var/log/messages'.
* an issue which caused gfs_controld to segfault when mounting hundreds of
file systems has been fixed.
* the LPAR fencing agent now properly reports status when an LPAR is in
Open Firmware mode.
* the LPAR fencing agent now works properly with systems using the
Integrated Virtualization Manager (IVM).
* the APC SNMP fencing agent now properly recognizes outletStatusOn and
outletStatusOff return codes from the SNMP agent.
* the WTI fencing agent can now connect to fencing devices with no
password.
* the rps-10 fencing agent now properly performs a reboot when run with no
options.
* the IPMI fencing agent now supports different cipher types with the '-C'
option.
* qdisk now properly scans devices and partitions.
* cman now checks to see if a new node has state to prevent killing the
first node during cluster setup.
* 'service qdiskd start' now works properly.
* the McData fence agent now works properly with the McData Sphereon 4500
Fabric Switch.
* the Egenera fence agent can now specify an SSH login name.
* the APC fence agent now works with non-admin accounts when using the
3.5.x firmware.
* fence_xvmd now tries two methods to reboot a virtual machine.
* connections to OpenAIS are now allowed from unprivileged CPG clients with
the user and group of 'ais'.
* groupd no longer allows the default fence domain to be '0', which
previously caused rgmanager to hang. Now, rgmanager no longer hangs.
* the RSA fence agent now supports SSH enabled RSA II devices.
* the DRAC fence agent now works with the Integrated Dell Remote Access
Controller (iDRAC) on Dell PowerEdge M600 blade servers.
* fixed a memory leak in cman.
* qdisk now displays a warning if more than one label is found with the
same name.
* the DRAC5 fencing agent now shows proper usage instructions for the '-D'
option.
* cman no longer uses the wrong node name when getnameinfo() fails.
* the SCSI fence agent now verifies that sg_persist is installed.
* the DRAC5 fencing agent now properly handles modulename.
* QDisk now logs warning messages if it appears its I/O to shared storage
is hung.
* fence_apc no longer fails with a pexpect exception.
* removing a node from the cluster using 'cman_tool leave remove' now
properly reduces the expected_votes and quorum.
* a semaphore leak in cman has been fixed.
* 'cman_tool nodes -F name' no longer segfaults when a node is out of
membership.
Enhancements:
* support for: ePowerSwitch 8+ and LPAR/HMC v3 devices, Cisco MDS 9124 and
MDS 9134 SAN switches, the virsh fencing agent, and broadcast communication
with cman.
* fence_scsi limitations added to fence_scsi man page.
Users of cman are advised to upgrade to these updated packages, which
resolve these issues and add these enhancements.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Low"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated cman packages that fix several security issues, various bugs, and\nadd enhancements are now available for Red Hat Enterprise Linux 5.\n\nThis update has been rated as having low security impact by the Red Hat\nSecurity Response Team.",
"title": "Topic"
},
{
"category": "general",
"text": "The Cluster Manager (cman) utility provides services for managing a Linux\ncluster.\n\nMultiple insecure temporary file use flaws were found in fence_apc_snmp and\nccs_tool. A local attacker could use these flaws to overwrite an arbitrary\nfile writable by a victim running those utilities (typically root) with\nthe output of the utilities via a symbolic link attack. (CVE-2008-4579,\nCVE-2008-6552)\n\nBug fixes:\n\n* a buffer could overflow if cluster.conf had more than 52 entries per\nblock inside the \u003ccman\u003e block. The limit is now 1024.\n\n* the output of the group_tool dump subcommands were NULL padded.\n\n* using device=\"\" instead of label=\"\" no longer causes qdiskd to\nincorrectly exit.\n\n* the IPMI fencing agent has been modified to time out after 10 seconds. It\nis also now possible to specify a different timeout value with the \u0027-t\u0027\noption.\n\n* the IPMI fencing agent now allows punctuation in passwords.\n\n* quickly starting and stopping the cman service no longer causes the\ncluster membership to become inconsistent across the cluster.\n\n* an issue with lock syncing caused \u0027receive_own from\u0027 errors to be logged\nto \u0027/var/log/messages\u0027.\n\n* an issue which caused gfs_controld to segfault when mounting hundreds of\nfile systems has been fixed.\n\n* the LPAR fencing agent now properly reports status when an LPAR is in\nOpen Firmware mode.\n\n* the LPAR fencing agent now works properly with systems using the\nIntegrated Virtualization Manager (IVM).\n\n* the APC SNMP fencing agent now properly recognizes outletStatusOn and\noutletStatusOff return codes from the SNMP agent.\n\n* the WTI fencing agent can now connect to fencing devices with no\npassword.\n\n* the rps-10 fencing agent now properly performs a reboot when run with no\noptions.\n\n* the IPMI fencing agent now supports different cipher types with the \u0027-C\u0027\noption.\n\n* qdisk now properly scans devices and partitions.\n\n* cman now checks to see if a new node has state to prevent killing the\nfirst node during cluster setup.\n\n* \u0027service qdiskd start\u0027 now works properly.\n\n* the McData fence agent now works properly with the McData Sphereon 4500\nFabric Switch.\n\n* the Egenera fence agent can now specify an SSH login name.\n\n* the APC fence agent now works with non-admin accounts when using the\n3.5.x firmware.\n\n* fence_xvmd now tries two methods to reboot a virtual machine.\n\n* connections to OpenAIS are now allowed from unprivileged CPG clients with\nthe user and group of \u0027ais\u0027.\n\n* groupd no longer allows the default fence domain to be \u00270\u0027, which\npreviously caused rgmanager to hang. Now, rgmanager no longer hangs.\n\n* the RSA fence agent now supports SSH enabled RSA II devices.\n\n* the DRAC fence agent now works with the Integrated Dell Remote Access\nController (iDRAC) on Dell PowerEdge M600 blade servers.\n\n* fixed a memory leak in cman.\n\n* qdisk now displays a warning if more than one label is found with the\nsame name.\n\n* the DRAC5 fencing agent now shows proper usage instructions for the \u0027-D\u0027\noption.\n\n* cman no longer uses the wrong node name when getnameinfo() fails.\n\n* the SCSI fence agent now verifies that sg_persist is installed.\n\n* the DRAC5 fencing agent now properly handles modulename.\n\n* QDisk now logs warning messages if it appears its I/O to shared storage\nis hung.\n\n* fence_apc no longer fails with a pexpect exception.\n\n* removing a node from the cluster using \u0027cman_tool leave remove\u0027 now\nproperly reduces the expected_votes and quorum.\n\n* a semaphore leak in cman has been fixed.\n\n* \u0027cman_tool nodes -F name\u0027 no longer segfaults when a node is out of\nmembership.\n\nEnhancements:\n\n* support for: ePowerSwitch 8+ and LPAR/HMC v3 devices, Cisco MDS 9124 and\nMDS 9134 SAN switches, the virsh fencing agent, and broadcast communication\nwith cman.\n\n* fence_scsi limitations added to fence_scsi man page.\n\nUsers of cman are advised to upgrade to these updated packages, which\nresolve these issues and add these enhancements.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2009:1341",
"url": "https://access.redhat.com/errata/RHSA-2009:1341"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#low",
"url": "https://access.redhat.com/security/updates/classification/#low"
},
{
"category": "external",
"summary": "276541",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=276541"
},
{
"category": "external",
"summary": "322291",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=322291"
},
{
"category": "external",
"summary": "447497",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=447497"
},
{
"category": "external",
"summary": "447964",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=447964"
},
{
"category": "external",
"summary": "467386",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=467386"
},
{
"category": "external",
"summary": "468966",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=468966"
},
{
"category": "external",
"summary": "472460",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=472460"
},
{
"category": "external",
"summary": "472786",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=472786"
},
{
"category": "external",
"summary": "473961",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=473961"
},
{
"category": "external",
"summary": "474163",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=474163"
},
{
"category": "external",
"summary": "480178",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=480178"
},
{
"category": "external",
"summary": "480401",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=480401"
},
{
"category": "external",
"summary": "480836",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=480836"
},
{
"category": "external",
"summary": "481566",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=481566"
},
{
"category": "external",
"summary": "481664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=481664"
},
{
"category": "external",
"summary": "484095",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=484095"
},
{
"category": "external",
"summary": "484956",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=484956"
},
{
"category": "external",
"summary": "485026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=485026"
},
{
"category": "external",
"summary": "485469",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=485469"
},
{
"category": "external",
"summary": "485700",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=485700"
},
{
"category": "external",
"summary": "487436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=487436"
},
{
"category": "external",
"summary": "487501",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=487501"
},
{
"category": "external",
"summary": "488565",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=488565"
},
{
"category": "external",
"summary": "488958",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=488958"
},
{
"category": "external",
"summary": "491640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=491640"
},
{
"category": "external",
"summary": "493165",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=493165"
},
{
"category": "external",
"summary": "493207",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=493207"
},
{
"category": "external",
"summary": "493802",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=493802"
},
{
"category": "external",
"summary": "496629",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=496629"
},
{
"category": "external",
"summary": "496724",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=496724"
},
{
"category": "external",
"summary": "498329",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=498329"
},
{
"category": "external",
"summary": "499767",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=499767"
},
{
"category": "external",
"summary": "500450",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=500450"
},
{
"category": "external",
"summary": "500567",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=500567"
},
{
"category": "external",
"summary": "501586",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=501586"
},
{
"category": "external",
"summary": "502674",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=502674"
},
{
"category": "external",
"summary": "504705",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=504705"
},
{
"category": "external",
"summary": "505258",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=505258"
},
{
"category": "external",
"summary": "505594",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=505594"
},
{
"category": "external",
"summary": "512998",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=512998"
},
{
"category": "external",
"summary": "514758",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=514758"
},
{
"category": "external",
"summary": "485199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=485199"
},
{
"category": "external",
"summary": "519436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=519436"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1341.json"
}
],
"title": "Red Hat Security Advisory: cman security, bug fix, and enhancement update",
"tracking": {
"current_release_date": "2025-11-08T03:24:14+00:00",
"generator": {
"date": "2025-11-08T03:24:14+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2009:1341",
"initial_release_date": "2009-09-02T08:00:00+00:00",
"revision_history": [
{
"date": "2009-09-02T08:00:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2009-09-01T06:43:16+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-08T03:24:14+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product": {
"name": "Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:5::client_workstation"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux (v. 5 server)",
"product": {
"name": "Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:5::server"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "cman-0:2.0.115-1.el5.src",
"product": {
"name": "cman-0:2.0.115-1.el5.src",
"product_id": "cman-0:2.0.115-1.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman@2.0.115-1.el5?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "cman-0:2.0.115-1.el5.x86_64",
"product": {
"name": "cman-0:2.0.115-1.el5.x86_64",
"product_id": "cman-0:2.0.115-1.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman@2.0.115-1.el5?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "cman-devel-0:2.0.115-1.el5.x86_64",
"product": {
"name": "cman-devel-0:2.0.115-1.el5.x86_64",
"product_id": "cman-devel-0:2.0.115-1.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-devel@2.0.115-1.el5?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "cman-debuginfo-0:2.0.115-1.el5.x86_64",
"product": {
"name": "cman-debuginfo-0:2.0.115-1.el5.x86_64",
"product_id": "cman-debuginfo-0:2.0.115-1.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-debuginfo@2.0.115-1.el5?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "cman-devel-0:2.0.115-1.el5.i386",
"product": {
"name": "cman-devel-0:2.0.115-1.el5.i386",
"product_id": "cman-devel-0:2.0.115-1.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-devel@2.0.115-1.el5?arch=i386"
}
}
},
{
"category": "product_version",
"name": "cman-debuginfo-0:2.0.115-1.el5.i386",
"product": {
"name": "cman-debuginfo-0:2.0.115-1.el5.i386",
"product_id": "cman-debuginfo-0:2.0.115-1.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-debuginfo@2.0.115-1.el5?arch=i386"
}
}
},
{
"category": "product_version",
"name": "cman-0:2.0.115-1.el5.i386",
"product": {
"name": "cman-0:2.0.115-1.el5.i386",
"product_id": "cman-0:2.0.115-1.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman@2.0.115-1.el5?arch=i386"
}
}
}
],
"category": "architecture",
"name": "i386"
},
{
"branches": [
{
"category": "product_version",
"name": "cman-0:2.0.115-1.el5.ia64",
"product": {
"name": "cman-0:2.0.115-1.el5.ia64",
"product_id": "cman-0:2.0.115-1.el5.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman@2.0.115-1.el5?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "cman-devel-0:2.0.115-1.el5.ia64",
"product": {
"name": "cman-devel-0:2.0.115-1.el5.ia64",
"product_id": "cman-devel-0:2.0.115-1.el5.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-devel@2.0.115-1.el5?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "cman-debuginfo-0:2.0.115-1.el5.ia64",
"product": {
"name": "cman-debuginfo-0:2.0.115-1.el5.ia64",
"product_id": "cman-debuginfo-0:2.0.115-1.el5.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-debuginfo@2.0.115-1.el5?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "cman-0:2.0.115-1.el5.ppc",
"product": {
"name": "cman-0:2.0.115-1.el5.ppc",
"product_id": "cman-0:2.0.115-1.el5.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman@2.0.115-1.el5?arch=ppc"
}
}
},
{
"category": "product_version",
"name": "cman-devel-0:2.0.115-1.el5.ppc",
"product": {
"name": "cman-devel-0:2.0.115-1.el5.ppc",
"product_id": "cman-devel-0:2.0.115-1.el5.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-devel@2.0.115-1.el5?arch=ppc"
}
}
},
{
"category": "product_version",
"name": "cman-debuginfo-0:2.0.115-1.el5.ppc",
"product": {
"name": "cman-debuginfo-0:2.0.115-1.el5.ppc",
"product_id": "cman-debuginfo-0:2.0.115-1.el5.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-debuginfo@2.0.115-1.el5?arch=ppc"
}
}
}
],
"category": "architecture",
"name": "ppc"
},
{
"branches": [
{
"category": "product_version",
"name": "cman-devel-0:2.0.115-1.el5.ppc64",
"product": {
"name": "cman-devel-0:2.0.115-1.el5.ppc64",
"product_id": "cman-devel-0:2.0.115-1.el5.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-devel@2.0.115-1.el5?arch=ppc64"
}
}
},
{
"category": "product_version",
"name": "cman-debuginfo-0:2.0.115-1.el5.ppc64",
"product": {
"name": "cman-debuginfo-0:2.0.115-1.el5.ppc64",
"product_id": "cman-debuginfo-0:2.0.115-1.el5.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-debuginfo@2.0.115-1.el5?arch=ppc64"
}
}
}
],
"category": "architecture",
"name": "ppc64"
},
{
"branches": [
{
"category": "product_version",
"name": "cman-0:2.0.115-1.el5.s390x",
"product": {
"name": "cman-0:2.0.115-1.el5.s390x",
"product_id": "cman-0:2.0.115-1.el5.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman@2.0.115-1.el5?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "cman-devel-0:2.0.115-1.el5.s390x",
"product": {
"name": "cman-devel-0:2.0.115-1.el5.s390x",
"product_id": "cman-devel-0:2.0.115-1.el5.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-devel@2.0.115-1.el5?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "cman-debuginfo-0:2.0.115-1.el5.s390x",
"product": {
"name": "cman-debuginfo-0:2.0.115-1.el5.s390x",
"product_id": "cman-debuginfo-0:2.0.115-1.el5.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-debuginfo@2.0.115-1.el5?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "cman-devel-0:2.0.115-1.el5.s390",
"product": {
"name": "cman-devel-0:2.0.115-1.el5.s390",
"product_id": "cman-devel-0:2.0.115-1.el5.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-devel@2.0.115-1.el5?arch=s390"
}
}
},
{
"category": "product_version",
"name": "cman-debuginfo-0:2.0.115-1.el5.s390",
"product": {
"name": "cman-debuginfo-0:2.0.115-1.el5.s390",
"product_id": "cman-debuginfo-0:2.0.115-1.el5.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cman-debuginfo@2.0.115-1.el5?arch=s390"
}
}
}
],
"category": "architecture",
"name": "s390"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-0:2.0.115-1.el5.i386"
},
"product_reference": "cman-0:2.0.115-1.el5.i386",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-0:2.0.115-1.el5.ia64"
},
"product_reference": "cman-0:2.0.115-1.el5.ia64",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-0:2.0.115-1.el5.ppc"
},
"product_reference": "cman-0:2.0.115-1.el5.ppc",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-0:2.0.115-1.el5.s390x"
},
"product_reference": "cman-0:2.0.115-1.el5.s390x",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.src as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-0:2.0.115-1.el5.src"
},
"product_reference": "cman-0:2.0.115-1.el5.src",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-0:2.0.115-1.el5.x86_64"
},
"product_reference": "cman-0:2.0.115-1.el5.x86_64",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.i386"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.i386",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ia64"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.ia64",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.ppc",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.ppc64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc64"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.ppc64",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.s390 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.s390",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390x"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.s390x",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.x86_64"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.x86_64",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-devel-0:2.0.115-1.el5.i386"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.i386",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-devel-0:2.0.115-1.el5.ia64"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.ia64",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.ppc",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.ppc64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc64"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.ppc64",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.s390 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.s390",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390x"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.s390x",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:cman-devel-0:2.0.115-1.el5.x86_64"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.x86_64",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-0:2.0.115-1.el5.i386"
},
"product_reference": "cman-0:2.0.115-1.el5.i386",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-0:2.0.115-1.el5.ia64"
},
"product_reference": "cman-0:2.0.115-1.el5.ia64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-0:2.0.115-1.el5.ppc"
},
"product_reference": "cman-0:2.0.115-1.el5.ppc",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-0:2.0.115-1.el5.s390x"
},
"product_reference": "cman-0:2.0.115-1.el5.s390x",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.src as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-0:2.0.115-1.el5.src"
},
"product_reference": "cman-0:2.0.115-1.el5.src",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-0:2.0.115-1.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-0:2.0.115-1.el5.x86_64"
},
"product_reference": "cman-0:2.0.115-1.el5.x86_64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-debuginfo-0:2.0.115-1.el5.i386"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.i386",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-debuginfo-0:2.0.115-1.el5.ia64"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.ia64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-debuginfo-0:2.0.115-1.el5.ppc"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.ppc",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.ppc64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-debuginfo-0:2.0.115-1.el5.ppc64"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.ppc64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.s390 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-debuginfo-0:2.0.115-1.el5.s390"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.s390",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-debuginfo-0:2.0.115-1.el5.s390x"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.s390x",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-debuginfo-0:2.0.115-1.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-debuginfo-0:2.0.115-1.el5.x86_64"
},
"product_reference": "cman-debuginfo-0:2.0.115-1.el5.x86_64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-devel-0:2.0.115-1.el5.i386"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.i386",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-devel-0:2.0.115-1.el5.ia64"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.ia64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-devel-0:2.0.115-1.el5.ppc"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.ppc",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.ppc64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-devel-0:2.0.115-1.el5.ppc64"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.ppc64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.s390 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-devel-0:2.0.115-1.el5.s390"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.s390",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-devel-0:2.0.115-1.el5.s390x"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.s390x",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cman-devel-0:2.0.115-1.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:cman-devel-0:2.0.115-1.el5.x86_64"
},
"product_reference": "cman-devel-0:2.0.115-1.el5.x86_64",
"relates_to_product_reference": "5Server"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2008-4579",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2008-10-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "467386"
}
],
"notes": [
{
"category": "description",
"text": "The (1) fence_apc and (2) fence_apc_snmp programs, as used in (a) fence 2.02.00-r1 and possibly (b) cman, when running in verbose mode, allows local users to append to arbitrary files via a symlink attack on the apclog temporary file.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cman/fence: insecure temporary file usage in the apc fence agents",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-Workstation:cman-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-0:2.0.115-1.el5.src",
"5Client-Workstation:cman-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.x86_64",
"5Server:cman-0:2.0.115-1.el5.i386",
"5Server:cman-0:2.0.115-1.el5.ia64",
"5Server:cman-0:2.0.115-1.el5.ppc",
"5Server:cman-0:2.0.115-1.el5.s390x",
"5Server:cman-0:2.0.115-1.el5.src",
"5Server:cman-0:2.0.115-1.el5.x86_64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Server:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Server:cman-devel-0:2.0.115-1.el5.i386",
"5Server:cman-devel-0:2.0.115-1.el5.ia64",
"5Server:cman-devel-0:2.0.115-1.el5.ppc",
"5Server:cman-devel-0:2.0.115-1.el5.ppc64",
"5Server:cman-devel-0:2.0.115-1.el5.s390",
"5Server:cman-devel-0:2.0.115-1.el5.s390x",
"5Server:cman-devel-0:2.0.115-1.el5.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2008-4579"
},
{
"category": "external",
"summary": "RHBZ#467386",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=467386"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2008-4579",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-4579"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-4579",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-4579"
}
],
"release_date": "2008-10-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2009-09-02T08:00:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Client-Workstation:cman-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-0:2.0.115-1.el5.src",
"5Client-Workstation:cman-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.x86_64",
"5Server:cman-0:2.0.115-1.el5.i386",
"5Server:cman-0:2.0.115-1.el5.ia64",
"5Server:cman-0:2.0.115-1.el5.ppc",
"5Server:cman-0:2.0.115-1.el5.s390x",
"5Server:cman-0:2.0.115-1.el5.src",
"5Server:cman-0:2.0.115-1.el5.x86_64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Server:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Server:cman-devel-0:2.0.115-1.el5.i386",
"5Server:cman-devel-0:2.0.115-1.el5.ia64",
"5Server:cman-devel-0:2.0.115-1.el5.ppc",
"5Server:cman-devel-0:2.0.115-1.el5.ppc64",
"5Server:cman-devel-0:2.0.115-1.el5.s390",
"5Server:cman-devel-0:2.0.115-1.el5.s390x",
"5Server:cman-devel-0:2.0.115-1.el5.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2009:1341"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 1.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"5Client-Workstation:cman-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-0:2.0.115-1.el5.src",
"5Client-Workstation:cman-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.x86_64",
"5Server:cman-0:2.0.115-1.el5.i386",
"5Server:cman-0:2.0.115-1.el5.ia64",
"5Server:cman-0:2.0.115-1.el5.ppc",
"5Server:cman-0:2.0.115-1.el5.s390x",
"5Server:cman-0:2.0.115-1.el5.src",
"5Server:cman-0:2.0.115-1.el5.x86_64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Server:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Server:cman-devel-0:2.0.115-1.el5.i386",
"5Server:cman-devel-0:2.0.115-1.el5.ia64",
"5Server:cman-devel-0:2.0.115-1.el5.ppc",
"5Server:cman-devel-0:2.0.115-1.el5.ppc64",
"5Server:cman-devel-0:2.0.115-1.el5.s390",
"5Server:cman-devel-0:2.0.115-1.el5.s390x",
"5Server:cman-devel-0:2.0.115-1.el5.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "cman/fence: insecure temporary file usage in the apc fence agents"
},
{
"cve": "CVE-2008-6552",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2008-10-31T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "519436"
}
],
"notes": [
{
"category": "description",
"text": "Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rgmanager: multiple insecure temporary file use issues",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-Workstation:cman-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-0:2.0.115-1.el5.src",
"5Client-Workstation:cman-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.x86_64",
"5Server:cman-0:2.0.115-1.el5.i386",
"5Server:cman-0:2.0.115-1.el5.ia64",
"5Server:cman-0:2.0.115-1.el5.ppc",
"5Server:cman-0:2.0.115-1.el5.s390x",
"5Server:cman-0:2.0.115-1.el5.src",
"5Server:cman-0:2.0.115-1.el5.x86_64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Server:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Server:cman-devel-0:2.0.115-1.el5.i386",
"5Server:cman-devel-0:2.0.115-1.el5.ia64",
"5Server:cman-devel-0:2.0.115-1.el5.ppc",
"5Server:cman-devel-0:2.0.115-1.el5.ppc64",
"5Server:cman-devel-0:2.0.115-1.el5.s390",
"5Server:cman-devel-0:2.0.115-1.el5.s390x",
"5Server:cman-devel-0:2.0.115-1.el5.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2008-6552"
},
{
"category": "external",
"summary": "RHBZ#519436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=519436"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2008-6552",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-6552"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-6552",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-6552"
}
],
"release_date": "2008-10-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2009-09-02T08:00:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Client-Workstation:cman-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-0:2.0.115-1.el5.src",
"5Client-Workstation:cman-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.x86_64",
"5Server:cman-0:2.0.115-1.el5.i386",
"5Server:cman-0:2.0.115-1.el5.ia64",
"5Server:cman-0:2.0.115-1.el5.ppc",
"5Server:cman-0:2.0.115-1.el5.s390x",
"5Server:cman-0:2.0.115-1.el5.src",
"5Server:cman-0:2.0.115-1.el5.x86_64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Server:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Server:cman-devel-0:2.0.115-1.el5.i386",
"5Server:cman-devel-0:2.0.115-1.el5.ia64",
"5Server:cman-devel-0:2.0.115-1.el5.ppc",
"5Server:cman-devel-0:2.0.115-1.el5.ppc64",
"5Server:cman-devel-0:2.0.115-1.el5.s390",
"5Server:cman-devel-0:2.0.115-1.el5.s390x",
"5Server:cman-devel-0:2.0.115-1.el5.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2009:1341"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 5.4,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:C",
"version": "2.0"
},
"products": [
"5Client-Workstation:cman-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-0:2.0.115-1.el5.src",
"5Client-Workstation:cman-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.i386",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ia64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.ppc64",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.s390x",
"5Client-Workstation:cman-devel-0:2.0.115-1.el5.x86_64",
"5Server:cman-0:2.0.115-1.el5.i386",
"5Server:cman-0:2.0.115-1.el5.ia64",
"5Server:cman-0:2.0.115-1.el5.ppc",
"5Server:cman-0:2.0.115-1.el5.s390x",
"5Server:cman-0:2.0.115-1.el5.src",
"5Server:cman-0:2.0.115-1.el5.x86_64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.i386",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ia64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc",
"5Server:cman-debuginfo-0:2.0.115-1.el5.ppc64",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390",
"5Server:cman-debuginfo-0:2.0.115-1.el5.s390x",
"5Server:cman-debuginfo-0:2.0.115-1.el5.x86_64",
"5Server:cman-devel-0:2.0.115-1.el5.i386",
"5Server:cman-devel-0:2.0.115-1.el5.ia64",
"5Server:cman-devel-0:2.0.115-1.el5.ppc",
"5Server:cman-devel-0:2.0.115-1.el5.ppc64",
"5Server:cman-devel-0:2.0.115-1.el5.s390",
"5Server:cman-devel-0:2.0.115-1.el5.s390x",
"5Server:cman-devel-0:2.0.115-1.el5.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "rgmanager: multiple insecure temporary file use issues"
}
]
}
RHSA-2009:1339
Vulnerability from csaf_redhat
Published
2009-09-02 08:00
Modified
2025-11-08 03:24
Summary
Red Hat Security Advisory: rgmanager security, bug fix, and enhancement update
Notes
Topic
An updated rgmanager package that fixes multiple security issues, various
bugs, and adds enhancements is now available for Red Hat Enterprise Linux
5.
This update has been rated as having low security impact by the Red Hat
Security Response Team.
Details
The rgmanager package contains the Red Hat Resource Group Manager, which
provides high availability for critical server applications in the event of
system downtime.
Multiple insecure temporary file use flaws were discovered in rgmanager and
various resource scripts run by rgmanager. A local attacker could use these
flaws to overwrite an arbitrary file writable by the rgmanager process
(i.e. user root) with the output of rgmanager or a resource agent via a
symbolic link attack. (CVE-2008-6552)
This update also fixes the following bugs:
* clulog now accepts '-' as the first character in messages.
* if expire_time is 0, max_restarts is no longer ignored.
* the SAP resource agents included in the rgmanager package shipped with
Red Hat Enterprise Linux 5.3 were outdated. This update includes the most
recent SAP resource agents and, consequently, improves SAP failover
support.
* empty PID files no longer cause resource start failures.
* recovery policy of type 'restart' now works properly when using a
resource based on ra-skelet.sh.
* samba.sh has been updated to kill the PID listed in the proper PID file.
* handling of the '-F' option has been improved to fix issues causing
rgmanager to crash if no members of a restricted failover domain were
online.
* the number of simultaneous status checks can now be limited to prevent
load spikes.
* forking and cloning during status checks has been optimized to reduce
load spikes.
* rg_test no longer hangs when run with large cluster configuration files.
* when rgmanager is used with a restricted failover domain it will no
longer occasionally segfault when some nodes are offline during a failover
event.
* virtual machine guests no longer restart after a cluster.conf update.
* nfsclient.sh no longer leaves temporary files after running.
* extra checks from the Oracle agents have been removed.
* vm.sh now uses libvirt.
* users can now define an explicit service processing order when
central_processing is enabled.
* virtual machine guests can no longer start on 2 nodes at the same time.
* in some cases a successfully migrated virtual machine guest could restart
when the cluster.conf file was updated.
* incorrect reporting of a service being started when it was not started
has been addressed.
As well, this update adds the following enhancements:
* a startup_wait option has been added to the MySQL resource agent.
* services can now be prioritized.
* rgmanager now checks to see if it has been killed by the OOM killer and
if so, reboots the node.
Users of rgmanager are advised to upgrade to this updated package, which
resolves these issues and adds these enhancements.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Low"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An updated rgmanager package that fixes multiple security issues, various\nbugs, and adds enhancements is now available for Red Hat Enterprise Linux\n5.\n\nThis update has been rated as having low security impact by the Red Hat\nSecurity Response Team.",
"title": "Topic"
},
{
"category": "general",
"text": "The rgmanager package contains the Red Hat Resource Group Manager, which\nprovides high availability for critical server applications in the event of\nsystem downtime.\n\nMultiple insecure temporary file use flaws were discovered in rgmanager and\nvarious resource scripts run by rgmanager. A local attacker could use these\nflaws to overwrite an arbitrary file writable by the rgmanager process\n(i.e. user root) with the output of rgmanager or a resource agent via a\nsymbolic link attack. (CVE-2008-6552)\n\nThis update also fixes the following bugs:\n\n* clulog now accepts \u0027-\u0027 as the first character in messages.\n\n* if expire_time is 0, max_restarts is no longer ignored.\n\n* the SAP resource agents included in the rgmanager package shipped with\nRed Hat Enterprise Linux 5.3 were outdated. This update includes the most\nrecent SAP resource agents and, consequently, improves SAP failover\nsupport.\n\n* empty PID files no longer cause resource start failures.\n\n* recovery policy of type \u0027restart\u0027 now works properly when using a\nresource based on ra-skelet.sh.\n\n* samba.sh has been updated to kill the PID listed in the proper PID file.\n\n* handling of the \u0027-F\u0027 option has been improved to fix issues causing\nrgmanager to crash if no members of a restricted failover domain were\nonline.\n\n* the number of simultaneous status checks can now be limited to prevent\nload spikes.\n\n* forking and cloning during status checks has been optimized to reduce\nload spikes.\n\n* rg_test no longer hangs when run with large cluster configuration files.\n\n* when rgmanager is used with a restricted failover domain it will no\nlonger occasionally segfault when some nodes are offline during a failover\nevent.\n\n* virtual machine guests no longer restart after a cluster.conf update.\n\n* nfsclient.sh no longer leaves temporary files after running.\n\n* extra checks from the Oracle agents have been removed.\n\n* vm.sh now uses libvirt.\n\n* users can now define an explicit service processing order when\ncentral_processing is enabled.\n\n* virtual machine guests can no longer start on 2 nodes at the same time.\n\n* in some cases a successfully migrated virtual machine guest could restart\nwhen the cluster.conf file was updated.\n\n* incorrect reporting of a service being started when it was not started\nhas been addressed.\n\nAs well, this update adds the following enhancements:\n\n* a startup_wait option has been added to the MySQL resource agent.\n\n* services can now be prioritized.\n\n* rgmanager now checks to see if it has been killed by the OOM killer and\nif so, reboots the node.\n\nUsers of rgmanager are advised to upgrade to this updated package, which\nresolves these issues and adds these enhancements.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2009:1339",
"url": "https://access.redhat.com/errata/RHSA-2009:1339"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#low",
"url": "https://access.redhat.com/security/updates/classification/#low"
},
{
"category": "external",
"summary": "250718",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=250718"
},
{
"category": "external",
"summary": "412911",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=412911"
},
{
"category": "external",
"summary": "449394",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=449394"
},
{
"category": "external",
"summary": "468691",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=468691"
},
{
"category": "external",
"summary": "470917",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=470917"
},
{
"category": "external",
"summary": "471066",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=471066"
},
{
"category": "external",
"summary": "471226",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=471226"
},
{
"category": "external",
"summary": "471431",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=471431"
},
{
"category": "external",
"summary": "474444",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=474444"
},
{
"category": "external",
"summary": "475826",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=475826"
},
{
"category": "external",
"summary": "481058",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=481058"
},
{
"category": "external",
"summary": "482858",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=482858"
},
{
"category": "external",
"summary": "483093",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=483093"
},
{
"category": "external",
"summary": "486349",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=486349"
},
{
"category": "external",
"summary": "486717",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=486717"
},
{
"category": "external",
"summary": "488714",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=488714"
},
{
"category": "external",
"summary": "489785",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=489785"
},
{
"category": "external",
"summary": "490449",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=490449"
},
{
"category": "external",
"summary": "490455",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=490455"
},
{
"category": "external",
"summary": "492828",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=492828"
},
{
"category": "external",
"summary": "494977",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=494977"
},
{
"category": "external",
"summary": "505340",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=505340"
},
{
"category": "external",
"summary": "514044",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=514044"
},
{
"category": "external",
"summary": "519436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=519436"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1339.json"
}
],
"title": "Red Hat Security Advisory: rgmanager security, bug fix, and enhancement update",
"tracking": {
"current_release_date": "2025-11-08T03:24:14+00:00",
"generator": {
"date": "2025-11-08T03:24:14+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2009:1339",
"initial_release_date": "2009-09-02T08:00:00+00:00",
"revision_history": [
{
"date": "2009-09-02T08:00:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2009-09-01T06:42:29+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-08T03:24:14+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Clustering (v. 5 server)",
"product": {
"name": "Red Hat Enterprise Linux Clustering (v. 5 server)",
"product_id": "5Server-Cluster",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_cluster:5"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.ia64",
"product": {
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.ia64",
"product_id": "rgmanager-debuginfo-0:2.0.52-1.el5.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager-debuginfo@2.0.52-1.el5?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "rgmanager-0:2.0.52-1.el5.ia64",
"product": {
"name": "rgmanager-0:2.0.52-1.el5.ia64",
"product_id": "rgmanager-0:2.0.52-1.el5.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager@2.0.52-1.el5?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.ppc",
"product": {
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.ppc",
"product_id": "rgmanager-debuginfo-0:2.0.52-1.el5.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager-debuginfo@2.0.52-1.el5?arch=ppc"
}
}
},
{
"category": "product_version",
"name": "rgmanager-0:2.0.52-1.el5.ppc",
"product": {
"name": "rgmanager-0:2.0.52-1.el5.ppc",
"product_id": "rgmanager-0:2.0.52-1.el5.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager@2.0.52-1.el5?arch=ppc"
}
}
}
],
"category": "architecture",
"name": "ppc"
},
{
"branches": [
{
"category": "product_version",
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.x86_64",
"product": {
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.x86_64",
"product_id": "rgmanager-debuginfo-0:2.0.52-1.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager-debuginfo@2.0.52-1.el5?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rgmanager-0:2.0.52-1.el5.x86_64",
"product": {
"name": "rgmanager-0:2.0.52-1.el5.x86_64",
"product_id": "rgmanager-0:2.0.52-1.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager@2.0.52-1.el5?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.i386",
"product": {
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.i386",
"product_id": "rgmanager-debuginfo-0:2.0.52-1.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager-debuginfo@2.0.52-1.el5?arch=i386"
}
}
},
{
"category": "product_version",
"name": "rgmanager-0:2.0.52-1.el5.i386",
"product": {
"name": "rgmanager-0:2.0.52-1.el5.i386",
"product_id": "rgmanager-0:2.0.52-1.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager@2.0.52-1.el5?arch=i386"
}
}
}
],
"category": "architecture",
"name": "i386"
},
{
"branches": [
{
"category": "product_version",
"name": "rgmanager-0:2.0.52-1.el5.src",
"product": {
"name": "rgmanager-0:2.0.52-1.el5.src",
"product_id": "rgmanager-0:2.0.52-1.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rgmanager@2.0.52-1.el5?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:2.0.52-1.el5.i386 as a component of Red Hat Enterprise Linux Clustering (v. 5 server)",
"product_id": "5Server-Cluster:rgmanager-0:2.0.52-1.el5.i386"
},
"product_reference": "rgmanager-0:2.0.52-1.el5.i386",
"relates_to_product_reference": "5Server-Cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:2.0.52-1.el5.ia64 as a component of Red Hat Enterprise Linux Clustering (v. 5 server)",
"product_id": "5Server-Cluster:rgmanager-0:2.0.52-1.el5.ia64"
},
"product_reference": "rgmanager-0:2.0.52-1.el5.ia64",
"relates_to_product_reference": "5Server-Cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:2.0.52-1.el5.ppc as a component of Red Hat Enterprise Linux Clustering (v. 5 server)",
"product_id": "5Server-Cluster:rgmanager-0:2.0.52-1.el5.ppc"
},
"product_reference": "rgmanager-0:2.0.52-1.el5.ppc",
"relates_to_product_reference": "5Server-Cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:2.0.52-1.el5.src as a component of Red Hat Enterprise Linux Clustering (v. 5 server)",
"product_id": "5Server-Cluster:rgmanager-0:2.0.52-1.el5.src"
},
"product_reference": "rgmanager-0:2.0.52-1.el5.src",
"relates_to_product_reference": "5Server-Cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-0:2.0.52-1.el5.x86_64 as a component of Red Hat Enterprise Linux Clustering (v. 5 server)",
"product_id": "5Server-Cluster:rgmanager-0:2.0.52-1.el5.x86_64"
},
"product_reference": "rgmanager-0:2.0.52-1.el5.x86_64",
"relates_to_product_reference": "5Server-Cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.i386 as a component of Red Hat Enterprise Linux Clustering (v. 5 server)",
"product_id": "5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.i386"
},
"product_reference": "rgmanager-debuginfo-0:2.0.52-1.el5.i386",
"relates_to_product_reference": "5Server-Cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.ia64 as a component of Red Hat Enterprise Linux Clustering (v. 5 server)",
"product_id": "5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.ia64"
},
"product_reference": "rgmanager-debuginfo-0:2.0.52-1.el5.ia64",
"relates_to_product_reference": "5Server-Cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.ppc as a component of Red Hat Enterprise Linux Clustering (v. 5 server)",
"product_id": "5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.ppc"
},
"product_reference": "rgmanager-debuginfo-0:2.0.52-1.el5.ppc",
"relates_to_product_reference": "5Server-Cluster"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rgmanager-debuginfo-0:2.0.52-1.el5.x86_64 as a component of Red Hat Enterprise Linux Clustering (v. 5 server)",
"product_id": "5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.x86_64"
},
"product_reference": "rgmanager-debuginfo-0:2.0.52-1.el5.x86_64",
"relates_to_product_reference": "5Server-Cluster"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2008-6552",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2008-10-31T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "519436"
}
],
"notes": [
{
"category": "description",
"text": "Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rgmanager: multiple insecure temporary file use issues",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.i386",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.ia64",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.ppc",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.src",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.x86_64",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.i386",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.ia64",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.ppc",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2008-6552"
},
{
"category": "external",
"summary": "RHBZ#519436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=519436"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2008-6552",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-6552"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-6552",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-6552"
}
],
"release_date": "2008-10-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2009-09-02T08:00:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.i386",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.ia64",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.ppc",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.src",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.x86_64",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.i386",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.ia64",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.ppc",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2009:1339"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 5.4,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:C",
"version": "2.0"
},
"products": [
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.i386",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.ia64",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.ppc",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.src",
"5Server-Cluster:rgmanager-0:2.0.52-1.el5.x86_64",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.i386",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.ia64",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.ppc",
"5Server-Cluster:rgmanager-debuginfo-0:2.0.52-1.el5.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "rgmanager: multiple insecure temporary file use issues"
}
]
}
ghsa-mmp4-x7mg-mw3w
Vulnerability from github
Published
2022-05-17 00:39
Modified
2022-05-17 00:39
VLAI Severity ?
Details
Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9.
{
"affected": [],
"aliases": [
"CVE-2008-6552"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-03-30T16:30:00Z",
"severity": "MODERATE"
},
"details": "Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9.",
"id": "GHSA-mmp4-x7mg-mw3w",
"modified": "2022-05-17T00:39:08Z",
"published": "2022-05-17T00:39:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-6552"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46412"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11404"
},
{
"type": "WEB",
"url": "http://osvdb.org/50299"
},
{
"type": "WEB",
"url": "http://osvdb.org/50300"
},
{
"type": "WEB",
"url": "http://osvdb.org/50301"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2009-1337.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/32602"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/32616"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/36530"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/36555"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/43367"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/43372"
},
{
"type": "WEB",
"url": "http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00163.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00164.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00165.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2009-1339.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2009-1341.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2011-0264.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2011-0265.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/32179"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-875-1"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2011/0416"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2011/0417"
}
],
"schema_version": "1.4.0",
"severity": []
}
fkie_cve-2008-6552
Vulnerability from fkie_nvd
Published
2009-03-30 16:30
Modified
2025-04-09 00:30
Severity ?
Summary
Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9.
References
| URL | Tags | ||
|---|---|---|---|
| cve@mitre.org | http://osvdb.org/50299 | ||
| cve@mitre.org | http://osvdb.org/50300 | ||
| cve@mitre.org | http://osvdb.org/50301 | ||
| cve@mitre.org | http://rhn.redhat.com/errata/RHSA-2009-1337.html | ||
| cve@mitre.org | http://secunia.com/advisories/32602 | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/32616 | ||
| cve@mitre.org | http://secunia.com/advisories/36530 | ||
| cve@mitre.org | http://secunia.com/advisories/36555 | ||
| cve@mitre.org | http://secunia.com/advisories/43367 | ||
| cve@mitre.org | http://secunia.com/advisories/43372 | ||
| cve@mitre.org | http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00163.html | Vendor Advisory | |
| cve@mitre.org | http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00164.html | Vendor Advisory | |
| cve@mitre.org | http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00165.html | Vendor Advisory | |
| cve@mitre.org | http://www.redhat.com/support/errata/RHSA-2009-1339.html | ||
| cve@mitre.org | http://www.redhat.com/support/errata/RHSA-2009-1341.html | ||
| cve@mitre.org | http://www.redhat.com/support/errata/RHSA-2011-0264.html | ||
| cve@mitre.org | http://www.redhat.com/support/errata/RHSA-2011-0265.html | ||
| cve@mitre.org | http://www.securityfocus.com/bid/32179 | ||
| cve@mitre.org | http://www.ubuntu.com/usn/USN-875-1 | ||
| cve@mitre.org | http://www.vupen.com/english/advisories/2011/0416 | ||
| cve@mitre.org | http://www.vupen.com/english/advisories/2011/0417 | ||
| cve@mitre.org | https://exchange.xforce.ibmcloud.com/vulnerabilities/46412 | ||
| cve@mitre.org | https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11404 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://osvdb.org/50299 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://osvdb.org/50300 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://osvdb.org/50301 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://rhn.redhat.com/errata/RHSA-2009-1337.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/32602 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/32616 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/36530 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/36555 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/43367 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/43372 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00163.html | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00164.html | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00165.html | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.redhat.com/support/errata/RHSA-2009-1339.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.redhat.com/support/errata/RHSA-2009-1341.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.redhat.com/support/errata/RHSA-2011-0264.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.redhat.com/support/errata/RHSA-2011-0265.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/32179 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.ubuntu.com/usn/USN-875-1 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.vupen.com/english/advisories/2011/0416 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.vupen.com/english/advisories/2011/0417 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/46412 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11404 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| redhat | cluster_project | 2.00.00 | |
| redhat | cluster_project | 2.01.00 | |
| redhat | cluster_project | 2.02.00 | |
| redhat | cluster_project | 2.03.00 | |
| redhat | cluster_project | 2.03.01 | |
| redhat | cluster_project | 2.03.03 | |
| redhat | cluster_project | 2.03.04 | |
| redhat | cluster_project | 2.03.05 | |
| redhat | cluster_project | 2.03.7 | |
| redhat | cluster_project | 2.03.08 | |
| redhat | cluster_project | 2.03.09 | |
| redhat | cluster_project | 2.03.10 | |
| redhat | cluster_project | 2.03.11 | |
| redhat | cluster_project | 2.99.00 | |
| redhat | cluster_project | 2.99.01 | |
| redhat | cluster_project | 2.99.02 | |
| redhat | cluster_project | 2.99.03 | |
| redhat | cluster_project | 2.99.04 | |
| redhat | cluster_project | 2.99.05 | |
| redhat | cluster_project | 2.99.06 | |
| redhat | cluster_project | 2.99.07 | |
| redhat | cluster_project | 2.99.08 | |
| redhat | cluster_project | 2.99.09 | |
| redhat | cluster_project | 2.99.10 | |
| redhat | cluster_project | 2.99.11 | |
| redhat | cluster_project | 2.99.12 | |
| redhat | cluster_project | 2.99.13 | |
| redhat | cman | 2.03.03-1 | |
| redhat | cman | 2.03.04-1 | |
| redhat | cman | 2.03.05-1 | |
| redhat | cman | 2.03.07-1 | |
| redhat | cman | 2.03.08-1 | |
| redhat | rgmanager | 2.03.03-1 | |
| redhat | rgmanager | 2.03.04-1 | |
| redhat | rgmanager | 2.03.05-1 | |
| redhat | rgmanager | 2.03.07-1 | |
| redhat | rgmanager | 2.03.08-1 | |
| fedoraproject | fedora | 9 | |
| redhat | gfs2-utils | 2.03.03-1 | |
| redhat | gfs2-utils | 2.03.04-1 | |
| redhat | gfs2-utils | 2.03.05-1 | |
| redhat | gfs2-utils | 2.03.07-1 | |
| redhat | gfs2-utils | 22.03.08-1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:redhat:cluster_project:2.00.00:*:*:*:*:*:*:*",
"matchCriteriaId": "6C049531-EC84-456A-96C8-DA0A53343E51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:cluster_project:2.01.00:*:*:*:*:*:*:*",
"matchCriteriaId": "6DF4752C-D8A9-4065-B562-FC264224E89A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:cluster_project:2.02.00:*:*:*:*:*:*:*",
"matchCriteriaId": "1E57EEC9-F0EE-4B13-A6DC-934974183DEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:cluster_project:2.03.00:*:*:*:*:*:*:*",
"matchCriteriaId": "57D5A467-CD50-43D0-B711-CB2DC4538A98",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:cluster_project:2.03.01:*:*:*:*:*:*:*",
"matchCriteriaId": "C534C075-8156-4431-BC5F-36D985C36C3C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:cluster_project:2.03.03:*:*:*:*:*:*:*",
"matchCriteriaId": "E01FC592-60D5-417F-A8AF-647AA7EC311D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:cluster_project:2.03.04:*:*:*:*:*:*:*",
"matchCriteriaId": "589238CE-D4D1-425E-B43A-FA686E7F707D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:cluster_project:2.03.05:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E61C3-DD71-4AFC-8895-BF03ABA72F9E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:cluster_project:2.03.7:*:*:*:*:*:*:*",
"matchCriteriaId": "7C37DAB7-3B1A-447F-ADC6-1011D66EC22A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:cluster_project:2.03.08:*:*:*:*:*:*:*",
"matchCriteriaId": "7B7789DD-D69F-4B00-89CA-8E5EFDFB8655",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:cluster_project:2.03.09:*:*:*:*:*:*:*",
"matchCriteriaId": "25A87A44-1D4F-4192-8440-213A5C28FBAB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:cluster_project:2.03.10:*:*:*:*:*:*:*",
"matchCriteriaId": "55342974-C2F5-4B2A-9B33-E863BF1C2F9C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:cluster_project:2.03.11:*:*:*:*:*:*:*",
"matchCriteriaId": "3A8EFE56-2267-4108-AF0E-642DE1C9F0DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:cluster_project:2.99.00:*:*:*:*:*:*:*",
"matchCriteriaId": "7E5615C1-1FF5-4051-A608-32491B1E88B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:cluster_project:2.99.01:*:*:*:*:*:*:*",
"matchCriteriaId": "9C631CD9-92ED-4AF8-AFE9-5023C2BCA2E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:cluster_project:2.99.02:*:*:*:*:*:*:*",
"matchCriteriaId": "9CE29A34-4D4C-4242-8C2D-107A32FA70C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:cluster_project:2.99.03:*:*:*:*:*:*:*",
"matchCriteriaId": "B3FBED0F-1959-422A-BDD5-6BC1E1DCEC7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:cluster_project:2.99.04:*:*:*:*:*:*:*",
"matchCriteriaId": "3D34E256-54EF-4850-BE89-78F465247CF6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:cluster_project:2.99.05:*:*:*:*:*:*:*",
"matchCriteriaId": "2E3AD327-D339-47B2-8E92-15459FAFD607",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:cluster_project:2.99.06:*:*:*:*:*:*:*",
"matchCriteriaId": "7030912C-95C4-4147-9A1A-FF73D3561F10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:cluster_project:2.99.07:*:*:*:*:*:*:*",
"matchCriteriaId": "C8DAEB97-54E9-409C-9B5E-CE2A04DF8FF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:cluster_project:2.99.08:*:*:*:*:*:*:*",
"matchCriteriaId": "CFC5BEA8-87B8-477F-8F13-F62ED1D48C1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:cluster_project:2.99.09:*:*:*:*:*:*:*",
"matchCriteriaId": "6FFD0CCC-6C62-40A0-9795-DB50DF507F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:cluster_project:2.99.10:*:*:*:*:*:*:*",
"matchCriteriaId": "1B7810B2-4FAC-453B-A6AD-93C93BA7BDB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:cluster_project:2.99.11:*:*:*:*:*:*:*",
"matchCriteriaId": "C27C14EE-D852-4C6C-9736-4201E8328658",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:cluster_project:2.99.12:*:*:*:*:*:*:*",
"matchCriteriaId": "6BE22AF1-608E-4783-B14D-3543FD89A741",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:cluster_project:2.99.13:*:*:*:*:*:*:*",
"matchCriteriaId": "4F734960-8098-4D02-9379-00E2FAF8A6D1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:redhat:cman:2.03.03-1:*:*:*:*:*:*:*",
"matchCriteriaId": "F12B9C5F-29A5-4B40-89E2-CD32477C087F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:cman:2.03.04-1:*:*:*:*:*:*:*",
"matchCriteriaId": "06ABB244-870D-4D5F-81FA-0D8D133A1B2D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:cman:2.03.05-1:*:*:*:*:*:*:*",
"matchCriteriaId": "C31DAF4D-B7BB-43CE-87EC-33062475AF0C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:cman:2.03.07-1:*:*:*:*:*:*:*",
"matchCriteriaId": "25AD771F-0B14-4EC9-A425-3E49BE177402",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:cman:2.03.08-1:*:*:*:*:*:*:*",
"matchCriteriaId": "15DBBFE0-79B9-4776-BE5F-00B861350C93",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:rgmanager:2.03.03-1:*:*:*:*:*:*:*",
"matchCriteriaId": "69DCA7E1-6DA3-45EB-861E-9E81772D2B1E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:rgmanager:2.03.04-1:*:*:*:*:*:*:*",
"matchCriteriaId": "434FA1DD-2051-4D79-8C77-2A65BBAECD75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:rgmanager:2.03.05-1:*:*:*:*:*:*:*",
"matchCriteriaId": "BDEB8EE9-4CC1-4605-89A3-FF825F2FE850",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:rgmanager:2.03.07-1:*:*:*:*:*:*:*",
"matchCriteriaId": "96CADCB9-566C-4B0F-9CD6-EB6C428486DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:rgmanager:2.03.08-1:*:*:*:*:*:*:*",
"matchCriteriaId": "6FA6195C-7577-4602-BA42-CE3C966CC49D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:9:*:*:*:*:*:*:*",
"matchCriteriaId": "743CBBB1-C140-4FEF-B40E-FAE4511B1140",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:redhat:gfs2-utils:2.03.03-1:*:*:*:*:*:*:*",
"matchCriteriaId": "2C7CF4AF-CC1E-47F0-8B17-71DD6702A984",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:gfs2-utils:2.03.04-1:*:*:*:*:*:*:*",
"matchCriteriaId": "0ADCAF38-52C3-47A6-8C12-71B9F443F18F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:gfs2-utils:2.03.05-1:*:*:*:*:*:*:*",
"matchCriteriaId": "BB493A19-F941-45B0-BA19-8F3EEF91A97A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:gfs2-utils:2.03.07-1:*:*:*:*:*:*:*",
"matchCriteriaId": "0A1D95B2-55B7-4795-9F6C-A57F7C8411D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:gfs2-utils:22.03.08-1:*:*:*:*:*:*:*",
"matchCriteriaId": "D45A7C07-4AF7-4E0D-ADF3-9487198A2D14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9."
},
{
"lang": "es",
"value": "Red Hat Cluster Project v2.x permite a usuarios locales modificar o sobrescribir ficheros de su elecci\u00f3n mediante ataques de enlaces simb\u00f3licos a ficheros en /tmp, implicando componentes no especificados en Resource Group Manager (tambi\u00e9n conocido como rgmanager) versiones anteriores a v2.03.09-1, en gfs2-utils versiones anteriore a v2.03.09-1, y en CMAN - The Cluster Manager versiones anteriores a v2.03.09-1 para Fedora 9."
}
],
"id": "CVE-2008-6552",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.9,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.4,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2009-03-30T16:30:00.313",
"references": [
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/50299"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/50300"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/50301"
},
{
"source": "cve@mitre.org",
"url": "http://rhn.redhat.com/errata/RHSA-2009-1337.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/32602"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/32616"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/36530"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/36555"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/43367"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/43372"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00163.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00164.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00165.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.redhat.com/support/errata/RHSA-2009-1339.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.redhat.com/support/errata/RHSA-2009-1341.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.redhat.com/support/errata/RHSA-2011-0264.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.redhat.com/support/errata/RHSA-2011-0265.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/32179"
},
{
"source": "cve@mitre.org",
"url": "http://www.ubuntu.com/usn/USN-875-1"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2011/0416"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2011/0417"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46412"
},
{
"source": "cve@mitre.org",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11404"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/50299"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/50300"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/50301"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2009-1337.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/32602"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/32616"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/36530"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/36555"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/43367"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/43372"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00163.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00164.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00165.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.redhat.com/support/errata/RHSA-2009-1339.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.redhat.com/support/errata/RHSA-2009-1341.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.redhat.com/support/errata/RHSA-2011-0264.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.redhat.com/support/errata/RHSA-2011-0265.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/32179"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.ubuntu.com/usn/USN-875-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2011/0416"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2011/0417"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46412"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11404"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-59"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…