copyright | disclaimer | privacy | contact  
Australia's Leading Computer Emergency Response Team
 
Search this site

 
On this site

 > HOME
 > About AusCERT
 > Membership
 > Contact Us
 > PKI Services
 > Publications
 > Sec. Bulletins
 > Conferences
 > News & Media
 > Services
 > Web Log
 > Site Map
 > Site Help
 > Member login





 

ESB-2007.0944 -- [RedHat] -- Moderate: conga security, bug fix, and enhancement update

Date: 23 November 2007
References: ESB-2007.0881  

Click here for printable version
Click here for PGP verifiable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                         ESB-2007.0944 -- [RedHat]
         Moderate: conga security, bug fix, and enhancement update
                             23 November 2007

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              conga
Publisher:            Red Hat
Operating System:     Red Hat Linux 4
Impact:               Denial of Service
Access:               Remote/Unauthenticated
CVE Names:            CVE-2007-4136

Ref:                  ESB-2007.0881

Original Bulletin:    https://rhn.redhat.com/errata/RHSA-2007-0983.html

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - ---------------------------------------------------------------------
                   Red Hat Security Advisory

Synopsis:          Moderate: conga security, bug fix, and enhancement update
Advisory ID:       RHSA-2007:0983-01
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2007-0983.html
Issue date:        2007-11-21
Updated on:        2007-11-21
Product:           Red Hat Cluster Suite
CVE Names:         CVE-2007-4136 
- - ---------------------------------------------------------------------

1. Summary:

Updated conga packages that fix a security flaw, several bugs, and add
enhancements are now available for Red Hat Cluster Suite.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Cluster Suite 4AS - i386, ia64, x86_64
Red Hat Cluster Suite 4ES - i386, ia64, x86_64
Red Hat Cluster Suite 4WS - i386, ia64, x86_64

3. Problem description:

The Conga package is a web-based administration tool for remote cluster and
storage management.

A flaw was found in ricci during a code audit. A remote attacker who is
able to connect to ricci could cause ricci to temporarily refuse additional
connections, resulting in a denial of service. (CVE-2007-4136)

Additionally, these updated packages fix the following bugs:

* entering an invalid password when creating a new cluster with the luci
web application caused a "UnboundLocalError" error.

* conga did not set the the "nodename" attribute for instances of manual
fencing, resulting in manual fencing being non-functional.

* conga did not provide a way to remove a dead node from a cluster.
Attempting to remove a dead node from a cluster resulted in an error,
reporting that that the node name cannot be reached.

* during cluster formation Conga reboots the cluster nodes. During reboot
errors about not being able to communicate with nodes are displayed. These
errors can safely be ignored, and have been removed in these updated
packages.

* when building a new cluster on Red Hat Enterprise Linux 4, Conga did not
generate node ID attributes for clusternode tags. The node ID attributes
are needed by programs such as qdisk.

* during Quorum Partition Configuration, a "TypeError" error occurred if
you did not configure heuristics.

* when passing arguments to fence_scsi, Conga used the "nodename" attribute
instead of the "node" attribute, resulting in an invalid XML file being
passed to fence_scsi. The "nodename" attribute is now supported.

* conga did not handle the restart operation correctly. In certain
situations this resulted in nodes not being started, stopped, and restarted
correctly. These issues were caused by clusters starting while others were
still in the process of stopping. This has been resolved in these updated
packages.

* probing storage using luci and the Mozilla Firefox 2 web browser on
Microsoft Windows XP appeared to never finish, when in fact it had. After
probing, clicking the node name in the storage list correctly showed the
storage for that node.

As well, these updated packages add the following enhancements:

* the Conga web interface now supports the Microsoft Internet Explorer web
browser, versions 6.0 and later.

* in previous packages, Conga required a minimum score to be configured
even when heuristics were not being used. A minimum score is no longer
required.

All Conga users are advised to upgrade to these updated packages, which
fix this vulnerability, resolve these issues, and add these enhancements.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

5. Bug IDs fixed (http://bugzilla.redhat.com/):

227723 - Entering bad password when creating a new cluster = UnboundLocalError: local variable 'e' referenced before assignment
238656 - conga does not set the "nodename" attribute for manual fencing
238727 - Conga provides no way to remove a dead node from a cluster
241414 - Installation using Conga shows "error" in message during reboot cycle.
245200 - Conga needs to support Internet Explorer 6.0 and later
253901 - No node IDs generated on new RHEL4 / DLM cluster
253905 - Quorum disk page: Minimum score does not need to be required
253906 - Quorum disk page: Error when trying to continue w/o a heuristic
286951 - conga passes fence_scsi nodename, where as it accepts only node
325501 - conga doesn't handle the cluster restart operation properly
336101 - CVE-2007-4136 ricci is vulnerable to a connect DoS attack
340101 - Storage redirection after probe does not work on WinXP with FF2

6. RPMs required:

Red Hat Cluster Suite 4AS:

SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/RHCS/SRPMS/conga-0.11.0-3.src.rpm
b992c3a5173d7712bbfc342dc8b28414  conga-0.11.0-3.src.rpm

i386:
f54f296e498593ff0f0bb26333083217  conga-debuginfo-0.11.0-3.i386.rpm
aba9489bb5e5b33891f42afa30c1f6b8  luci-0.11.0-3.i386.rpm
2c414b9df48969dbe46423fa68f43599  ricci-0.11.0-3.i386.rpm

ia64:
b4124d5f5825535d25c6649c16344efb  conga-debuginfo-0.11.0-3.ia64.rpm
d7fe494639979615ac1927f3421294bf  luci-0.11.0-3.ia64.rpm
5eb8e073a575c78729217ea6f9a2d939  ricci-0.11.0-3.ia64.rpm

x86_64:
a7288c6eb4e9667f495bbe2be78f2372  conga-debuginfo-0.11.0-3.x86_64.rpm
2c657c9aaffd6b546d943d6b6a093260  luci-0.11.0-3.x86_64.rpm
21492794c454d2903645c4a808131dce  ricci-0.11.0-3.x86_64.rpm

Red Hat Cluster Suite 4ES:

SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/RHCS/SRPMS/conga-0.11.0-3.src.rpm
b992c3a5173d7712bbfc342dc8b28414  conga-0.11.0-3.src.rpm

i386:
f54f296e498593ff0f0bb26333083217  conga-debuginfo-0.11.0-3.i386.rpm
aba9489bb5e5b33891f42afa30c1f6b8  luci-0.11.0-3.i386.rpm
2c414b9df48969dbe46423fa68f43599  ricci-0.11.0-3.i386.rpm

ia64:
b4124d5f5825535d25c6649c16344efb  conga-debuginfo-0.11.0-3.ia64.rpm
d7fe494639979615ac1927f3421294bf  luci-0.11.0-3.ia64.rpm
5eb8e073a575c78729217ea6f9a2d939  ricci-0.11.0-3.ia64.rpm

x86_64:
a7288c6eb4e9667f495bbe2be78f2372  conga-debuginfo-0.11.0-3.x86_64.rpm
2c657c9aaffd6b546d943d6b6a093260  luci-0.11.0-3.x86_64.rpm
21492794c454d2903645c4a808131dce  ricci-0.11.0-3.x86_64.rpm

Red Hat Cluster Suite 4WS:

SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/RHCS/SRPMS/conga-0.11.0-3.src.rpm
b992c3a5173d7712bbfc342dc8b28414  conga-0.11.0-3.src.rpm

i386:
f54f296e498593ff0f0bb26333083217  conga-debuginfo-0.11.0-3.i386.rpm
aba9489bb5e5b33891f42afa30c1f6b8  luci-0.11.0-3.i386.rpm
2c414b9df48969dbe46423fa68f43599  ricci-0.11.0-3.i386.rpm

ia64:
b4124d5f5825535d25c6649c16344efb  conga-debuginfo-0.11.0-3.ia64.rpm
d7fe494639979615ac1927f3421294bf  luci-0.11.0-3.ia64.rpm
5eb8e073a575c78729217ea6f9a2d939  ricci-0.11.0-3.ia64.rpm

x86_64:
a7288c6eb4e9667f495bbe2be78f2372  conga-debuginfo-0.11.0-3.x86_64.rpm
2c657c9aaffd6b546d943d6b6a093260  luci-0.11.0-3.x86_64.rpm
21492794c454d2903645c4a808131dce  ricci-0.11.0-3.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4136
http://www.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2007 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFHRUAdXlSAg2UNWIIRAqrnAKDEGdaYoe6W14DrJnG/qW+BKSVgegCgoxnj
jJ++aTQhAumThDfTEYq+9w0=
=8ymP
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBR0YH+Ch9+71yA2DNAQLX8QQAgt/Nw1z/ZarVs1JbZDyk3dF3WNzqVd4w
gvzS9JtxRM8YcFUuaGsPzrvP+z2g8b4QriEmmcqA0NRswKtFgjUx8c6HKr7fxjXP
1dfD8L90uND2aDGj7/qlnIHRauDtkavPqhFFTyIBm+4ykUW6YBUYvHaA9MIElLFs
SvzC15sz3Dw=
=i8lE
-----END PGP SIGNATURE-----