Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2013.1674 Low: pacemaker security, bug fix, and enhancement update 22 November 2013 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: pacemaker Publisher: Red Hat Operating System: Red Hat Enterprise Linux Server 6 Linux variants Impact/Access: Denial of Service -- Remote/Unauthenticated Resolution: Patch/Upgrade CVE Names: CVE-2013-0281 Original Bulletin: https://rhn.redhat.com/errata/RHSA-2013-1635.html Comment: This advisory references vulnerabilities in products which run on platforms other than Red Hat. It is recommended that administrators running pacemaker check for an updated version of the software for their operating system. - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Low: pacemaker security, bug fix, and enhancement update Advisory ID: RHSA-2013:1635-02 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2013-1635.html Issue date: 2013-11-21 CVE Names: CVE-2013-0281 ===================================================================== 1. Summary: Updated pacemaker packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux High Availability (v. 6) - i386, x86_64 Red Hat Enterprise Linux Resilient Storage (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, x86_64 3. Description: Pacemaker is a high-availability cluster resource manager with a powerful policy engine. A denial of service flaw was found in the way Pacemaker performed authentication and processing of remote connections in certain circumstances. When Pacemaker was configured to allow remote Cluster Information Base (CIB) configuration or resource management, a remote attacker could use this flaw to cause Pacemaker to block indefinitely (preventing it from serving other requests). (CVE-2013-0281) Note: The default Pacemaker configuration in Red Hat Enterprise Linux 6 has the remote CIB management functionality disabled. The pacemaker package has been upgraded to upstream version 1.1.10, which provides a number of bug fixes and enhancements over the previous version: * Pacemaker no longer assumes unknown cman nodes are safely stopped. * The core dump file now converts all exit codes into positive 'errno' values. * Pacemaker ensures a return to a stable state after too many fencing failures, and initiates a shutdown if a node claimed to be fenced is still active. * The crm_error tool adds the ability to list and print error symbols. * The crm_resource command allows individual resources to be reprobed, and implements the "--ban" option for moving resources away from nodes. The "--clear" option has replaced the "--unmove" option. Also, crm_resource now supports OCF tracing when using the "--force" option. * The IPC mechanism restores the ability for members of the haclient group to connect to the cluster. * The Policy Engine daemon allows active nodes in the current membership to be fenced without quorum. * Policy Engine now suppresses meaningless IDs when displaying anonymous clone status, supports maintenance mode for a single node, and correctly handles the recovered resources before they are operated on. * XML configuration files are now checked for non-printing characters and replaced with their octal equivalent when exporting XML text. Also, a more reliable buffer allocation strategy has been implemented to prevent lockups. (BZ#987355) Additional bug fixes: * The "crm_resource --move" command was designed for atomic resources and could not handle resources on clones, masters, or slaves present on multiple nodes. Consequently, crm_resource could not obtain enough information to move a resource and did not perform any action. The "--ban" and "--clear" options have been added to allow the administrator to instruct the cluster unambiguously. Clone, master, and slave resources can now be navigated within the cluster as expected. (BZ#902407) * The hacluster user account did not have a user identification (UID) or group identification (GID) number reserved on the system. Thus, UID and GID values were picked randomly during the installation process. The UID and GID number 189 was reserved for hacluster and is now used consistently for all installations. (BZ#908450) * Certain clusters used node host names that did not match the output of the "uname -n" command. Thus, the default node name used by the crm_standby and crm_failcount commands was incorrect and caused the cluster to ignore the update by the administrator. The crm_node command is now used instead of the uname utility in helper scripts. As a result, the cluster behaves as expected. (BZ#913093) * Due to incorrect return code handling, internal recovery logic of the crm_mon utility was not executed when a configuration updated failed to apply, leading to an assertion failure. Return codes are now checked correctly, and the recovery of an expected error state is now handled transparently. (BZ#951371) * cman's automatic unfencing feature failed when combined with Pacemaker. Support for automated unfencing in Pacemaker has been added, and the unwanted behavior no longer occurs. (BZ#996850) All pacemaker users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 891922 - CVE-2013-0281 pacemaker: remote DoS when CIB management is enabled caused by use of blocking sockets 902407 - Different results when moving Master/Slave resources 902459 - Persistent resource-related data after the resource is deleted 996850 - Unfence at cluster startup with fence_scsi 997346 - pacemaker enables itself on boot during installation 1011618 - Slave roles inconsistent in pcs status xml (or crm_mon) 6. Package List: Red Hat Enterprise Linux High Availability (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/pacemaker-1.1.10-14.el6.src.rpm i386: pacemaker-1.1.10-14.el6.i686.rpm pacemaker-cli-1.1.10-14.el6.i686.rpm pacemaker-cluster-libs-1.1.10-14.el6.i686.rpm pacemaker-cts-1.1.10-14.el6.i686.rpm pacemaker-debuginfo-1.1.10-14.el6.i686.rpm pacemaker-doc-1.1.10-14.el6.i686.rpm pacemaker-libs-1.1.10-14.el6.i686.rpm pacemaker-libs-devel-1.1.10-14.el6.i686.rpm x86_64: pacemaker-1.1.10-14.el6.x86_64.rpm pacemaker-cli-1.1.10-14.el6.x86_64.rpm pacemaker-cluster-libs-1.1.10-14.el6.i686.rpm pacemaker-cluster-libs-1.1.10-14.el6.x86_64.rpm pacemaker-cts-1.1.10-14.el6.x86_64.rpm pacemaker-debuginfo-1.1.10-14.el6.i686.rpm pacemaker-debuginfo-1.1.10-14.el6.x86_64.rpm pacemaker-doc-1.1.10-14.el6.x86_64.rpm pacemaker-libs-1.1.10-14.el6.i686.rpm pacemaker-libs-1.1.10-14.el6.x86_64.rpm pacemaker-libs-devel-1.1.10-14.el6.i686.rpm pacemaker-libs-devel-1.1.10-14.el6.x86_64.rpm Red Hat Enterprise Linux Resilient Storage (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/pacemaker-1.1.10-14.el6.src.rpm i386: pacemaker-1.1.10-14.el6.i686.rpm pacemaker-cli-1.1.10-14.el6.i686.rpm pacemaker-cluster-libs-1.1.10-14.el6.i686.rpm pacemaker-cts-1.1.10-14.el6.i686.rpm pacemaker-debuginfo-1.1.10-14.el6.i686.rpm pacemaker-doc-1.1.10-14.el6.i686.rpm pacemaker-libs-1.1.10-14.el6.i686.rpm pacemaker-libs-devel-1.1.10-14.el6.i686.rpm x86_64: pacemaker-1.1.10-14.el6.x86_64.rpm pacemaker-cli-1.1.10-14.el6.x86_64.rpm pacemaker-cluster-libs-1.1.10-14.el6.i686.rpm pacemaker-cluster-libs-1.1.10-14.el6.x86_64.rpm pacemaker-cts-1.1.10-14.el6.x86_64.rpm pacemaker-debuginfo-1.1.10-14.el6.i686.rpm pacemaker-debuginfo-1.1.10-14.el6.x86_64.rpm pacemaker-doc-1.1.10-14.el6.x86_64.rpm pacemaker-libs-1.1.10-14.el6.i686.rpm pacemaker-libs-1.1.10-14.el6.x86_64.rpm pacemaker-libs-devel-1.1.10-14.el6.i686.rpm pacemaker-libs-devel-1.1.10-14.el6.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/pacemaker-1.1.10-14.el6.src.rpm i386: pacemaker-debuginfo-1.1.10-14.el6.i686.rpm pacemaker-remote-1.1.10-14.el6.i686.rpm x86_64: pacemaker-debuginfo-1.1.10-14.el6.x86_64.rpm pacemaker-remote-1.1.10-14.el6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2013-0281.html https://access.redhat.com/security/updates/classification/#low 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2013 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFSjY4fXlSAg2UNWIIRAh/NAJ0aE95vq2J06nTLQqnwLhV9yWrM5wCeIN9t CSiV2AI7kFPkupLOCP2BBSM= =he1w - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBUo7UFBLndAQH1ShLAQLE1g//bTAidoHQ2/DBXdV3vKSA/BCKeAgW2FqZ 15SDNOgDilVyLVFoA+5k5YTiEFV1O1kUJB9y6qfUXG77ekl93qlyS2rKB2w/LzNv dBNzsW9m6MJUgKY58+uI0IBeIE7TphF1h4ro6gC3NKgyX9rQUXsAE3tWJJ8/x3cN nJdrxFLC5iKS3YS6JsXfo+q5ju6VwjcyHS5NK5WHnUinVCLmLNv/558lvvuw26Fn i/IWhXyl1KXi3cpGLR52G0csrYCLi0Ot/kPZjhktX7wcY38Kul0XPd+PGdVY5lH+ Elz8kC/zaTLUgNBeesv+vVNsR3VBvGGdjgEK5yNvfwNTFaPL2jgfHokX7Qb5MeKi IOnry5j7C0pfqSw6hiNc4FOHy+mRZj8iC6A4J+NCZf5mlEdAN5ATgcLjPYFT/hxp HhFV1/9Nf9UuIW5kgBKltuEbzZK9XlD7d98aK+T7OPuXiuc78iOcwHCe4O6IR4Np ow87tOQnjyyEJfJCqFOW0Mh9U3j1r9Lo8gvrSqI7xqf0xnq5LROgYWf6HuGAtjhv DUFAV2EhrZB/Z6ajVVb8jyzANBkXVqYvGzptCjyXZLZSeUz7CgHCevOLq4a+1KKd E9u6l16tbqx2Ghr5K/T0dvb9MslJuCRsrgwrOisEt4oR2XwiSlqY8UViqLdzngUO BTGdQEhVd0Q= =LRa9 -----END PGP SIGNATURE-----