Rhsa-2009:1341: Low Security, Bug Fix, And Enhancement Update - Red Hat ENTERPRISE LINUX 5.4 - TECHNICAL NOTES Manual

Chapter 1. Package Updates
Updated cman packages that fix a bug are now available.
The Cluster Manager (cman) utility provides user-level services for managing a Linux cluster.
This update applies the following bug fix:
• Nodes are no longer ejected from the cluster that were quorate on their own if they do not have a
state.
All cman users should upgrade to these updated packages, which resolve this issue.
1.19.4. RHSA-2009:1341: Low security, bug fix, and enhancement
update
Updated cman packages that fix several security issues, various bugs, and add enhancements are
now available for Red Hat Enterprise Linux 5.
This update has been rated as having low security impact by the Red Hat Security Response Team.
The Cluster Manager (cman) utility provides services for managing a Linux cluster.
Multiple insecure temporary file use flaws were found in fence_apc_snmp and ccs_tool. A local
attacker could use these flaws to overwrite an arbitrary file writable by a victim running those
utilities (typically root) with the output of the utilities via a symbolic link attack.
167
CVE-2008-6552
)
Bug fixes:
• a buffer could overflow if cluster.conf had more than 52 entries per block inside the <cman> block.
The limit is now 1024.
• the output of the group_tool dump subcommands were NULL padded.
• using device="" instead of label="" no longer causes qdiskd to incorrectly exit.
• the IPMI fencing agent has been modified to time out after 10 seconds. It is also now possible to
specify a different timeout value with the '-t' option.
• the IPMI fencing agent now allows punctuation in passwords.
• quickly starting and stopping the cman service no longer causes the cluster membership to become
inconsistent across the cluster.
• an issue with lock syncing caused 'receive_own from' errors to be logged to '/var/log/messages'.
• an issue which caused gfs_controld to segfault when mounting hundreds of file systems has been
fixed.
• the LPAR fencing agent now properly reports status when an LPAR is in Open Firmware mode.
• the LPAR fencing agent now works properly with systems using the Integrated Virtualization
Manager (IVM).
166
https://www.redhat.com/security/data/cve/CVE-2008-4579.html
167
https://www.redhat.com/security/data/cve/CVE-2008-6552.html
24
166
(CVE-2008-4579 ,