Executive Summary
| Summary | |
|---|---|
| Title | cman security update |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2007:0559 | First vendor Publication | 2007-06-28 |
| Vendor | RedHat | Last vendor Modification | 2007-06-28 |
| Severity (Vendor) | Important | Revision | 01 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 4.6 | Attack Range | Local |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 3.9 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: Updated cman packages that correct a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Problem description: cman is the Red Hat Cluster Manager. A flaw was found in the cman daemon. A local attacker could connect to the cman daemon and trigger a static buffer overflow leading to a denial of service or, potentially, an escalation of privileges. (CVE-2007-3374) Users of Cluster Manager should upgrade to these updated packages, which contain a backported patch to correct this issue. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 244891 - CVE-2007-3374 possible buffer overflow could cause local DoS by crashing cman |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2007-0559.html |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:21754 | |||
| Oval ID: | oval:org.mitre.oval:def:21754 | ||
| Title: | ELSA-2007:0559: cman security update (Important) | ||
| Description: | Buffer overflow in cluster/cman/daemon/daemon.c in cman (redhat-cluster-suite) before 20070622 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via long client messages. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2007:0559-01 CVE-2007-3374 | Version: | 6 |
| Platform(s): | Oracle Linux 5 | Product(s): | cman |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:9524 | |||
| Oval ID: | oval:org.mitre.oval:def:9524 | ||
| Title: | Buffer overflow in cluster/cman/daemon/daemon.c in cman (redhat-cluster-suite) before 20070622 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via long client messages. | ||
| Description: | Buffer overflow in cluster/cman/daemon/daemon.c in cman (redhat-cluster-suite) before 20070622 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via long client messages. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2007-3374 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 1 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-03-23 | Name : Ubuntu Update for redhat-cluster-suite vulnerability USN-476-1 File : nvt/gb_ubuntu_USN_476_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 37497 | cman cluster/cman/daemon/daemon.c process_client() Function Local Overflow |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-0559-2.nasl - Type : ACT_GATHER_INFO |
| 2010-01-06 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-0559.nasl - Type : ACT_GATHER_INFO |
| 2007-11-10 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-476-1.nasl - Type : ACT_GATHER_INFO |
| 2007-06-29 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0559.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:50:49 |
|
