CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 0CVE-2008-6560
https://notcve.org/view.php?id=CVE-2008-6560
Buffer overflow in CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9 and Red Hat Enterprise Linux (RHEL) 5 allows attackers to cause a denial of service (CPU consumption and memory corruption) via a cluster.conf file with many lines. NOTE: it is not clear whether this issue crosses privilege boundaries in realistic uses of the product. Desbordamiento de búfer en CMAN - The Cluster Manager versiones anteriores a v2.03.09-1 en Fedora 9 y Red Hat Enterprise Linux (RHEL) 5 permite a atacantes provocar una denegación de servicio (consumo de CPU y consumo de memoria) a través de un fichero cluster.conf con muchas líneas. NOTA: no está claro si este problema cruza fronteras de privilegios en usuarios reales del producto. • http://git.fedorahosted.org/git/cluster.git?p=cluster.git%3Ba=commitdiff%3Bh=67fee9128e54c6c3fc3eae306b5b501f3029c3be http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00163.html http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00164.html http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00165.html http://www.ubuntu.com/usn/USN-875-1 https://bugzilla.redhat.com/show_bug.cgi?id=468966 https://exchange.xforce.ibmcloud.com/vulnerabilities/49832 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.9EPSS: 0%CPEs: 43EXPL: 0CVE-2008-6552 – rgmanager: multiple insecure temporary file use issues
https://notcve.org/view.php?id=CVE-2008-6552
Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9. Red Hat Cluster Project v2.x permite a usuarios locales modificar o sobrescribir ficheros de su elección mediante ataques de enlaces simbólicos a ficheros en /tmp, implicando componentes no especificados en Resource Group Manager (también conocido como rgmanager) versiones anteriores a v2.03.09-1, en gfs2-utils versiones anteriore a v2.03.09-1, y en CMAN - The Cluster Manager versiones anteriores a v2.03.09-1 para Fedora 9. • http://osvdb.org/50299 http://osvdb.org/50300 http://osvdb.org/50301 http://rhn.redhat.com/errata/RHSA-2009-1337.html http://secunia.com/advisories/32602 http://secunia.com/advisories/32616 http://secunia.com/advisories/36530 http://secunia.com/advisories/36555 http://secunia.com/advisories/43367 http://secunia.com/advisories/43372 http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00163.html http://www.redhat.com/archives/fedora-package-announce/ • CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-377: Insecure Temporary File •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2008-4580
https://notcve.org/view.php?id=CVE-2008-4580
fence_manual, as used in fence 2.02.00-r1 and possibly cman, allows local users to modify arbitrary files via a symlink attack on the fence_manual.fifo temporary file. fence_manual, tal y como es usado en fence versión 2.02.00-r1 y posiblemente cman, permite a los usuarios locales modificar archivos arbitrarios por medio de un ataque de tipo symlink en el archivo temporal fence_manual.fifo. • http://bugs.gentoo.org/show_bug.cgi?id=240576 http://www.openwall.com/lists/oss-security/2008/10/13/3 http://www.openwall.com/lists/oss-security/2008/10/16/1 http://www.ubuntu.com/usn/USN-875-1 https://exchange.xforce.ibmcloud.com/vulnerabilities/45953 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 1.9EPSS: 0%CPEs: 2EXPL: 0CVE-2008-4579 – cman/fence: insecure temporary file usage in the apc fence agents
https://notcve.org/view.php?id=CVE-2008-4579
The (1) fence_apc and (2) fence_apc_snmp programs, as used in (a) fence 2.02.00-r1 and possibly (b) cman, when running in verbose mode, allows local users to append to arbitrary files via a symlink attack on the apclog temporary file. Los programas (1) fence_apc y (2) fence_apc_snmp,como se utilizan en (a) fence 2.02.00-r1 y posiblemente (b) cman, cuando se ejecutan en modo verbose, permiten a usuarios locales añadir a archivos de su elección mediante un ataque de enlaces simbólicos al archivo temporal apclog. • http://bugs.gentoo.org/show_bug.cgi?id=240576 http://secunia.com/advisories/32387 http://secunia.com/advisories/32390 http://secunia.com/advisories/36530 http://secunia.com/advisories/43362 http://www.openwall.com/lists/oss-security/2008/10/13/3 http://www.redhat.com/support/errata/RHSA-2009-1341.html http://www.redhat.com/support/errata/RHSA-2011-0266.html http://www.securityfocus.com/bid/31904 http://www.ubuntu.com/usn/USN-875-1 http://www.vupen.com&# • CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-377: Insecure Temporary File •