Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.58999
Category:Red Hat Local Security Checks
Title:RedHat Security Advisory RHSA-2007:0983
Summary:NOSUMMARY
Description:Description:

The remote host is missing updates announced in
advisory RHSA-2007:0983.

The Conga package is a web-based administration tool for remote cluster and
storage management.

A flaw was found in ricci during a code audit. A remote attacker who is
able to connect to ricci could cause ricci to temporarily refuse additional
connections, resulting in a denial of service. (CVE-2007-4136)

Additionally, these updated packages fix the following bugs:

* entering an invalid password when creating a new cluster with the luci
web application caused a UnboundLocalError error.

* conga did not set the the nodename attribute for instances of manual
fencing, resulting in manual fencing being non-functional.

* conga did not provide a way to remove a dead node from a cluster.
Attempting to remove a dead node from a cluster resulted in an error,
reporting that that the node name cannot be reached.

* during cluster formation Conga reboots the cluster nodes. During reboot
errors about not being able to communicate with nodes are displayed. These
errors can safely be ignored, and have been removed in these updated
packages.

* when building a new cluster on Red Hat Enterprise Linux 4, Conga did not
generate node ID attributes for clusternode tags. The node ID attributes
are needed by programs such as qdisk.

* during Quorum Partition Configuration, a TypeError error occurred if
you did not configure heuristics.

* when passing arguments to fence_scsi, Conga used the nodename attribute
instead of the node attribute, resulting in an invalid XML file being
passed to fence_scsi. The nodename attribute is now supported.

* conga did not handle the restart operation correctly. In certain
situations this resulted in nodes not being started, stopped, and restarted
correctly. These issues were caused by clusters starting while others were
still in the process of stopping. This has been resolved in these updated
packages.

* probing storage using luci and the Mozilla Firefox 2 web browser on
Microsoft Windows XP appeared to never finish, when in fact it had. After
probing, clicking the node name in the storage list correctly showed the
storage for that node.

As well, these updated packages add the following enhancements:

* the Conga web interface now supports the Microsoft Internet Explorer web
browser, versions 6.0 and later.

* in previous packages, Conga required a minimum score to be configured
even when heuristics were not being used. A minimum score is no longer
required.

All Conga users are advised to upgrade to these updated packages, which
fix this vulnerability, resolve these issues, and add these enhancements.

Solution:
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date

http://rhn.redhat.com/errata/RHSA-2007-0983.html
http://www.redhat.com/security/updates/classification/#moderate

Risk factor : Medium

CVSS Score:
5.0

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2007-4136
BugTraq ID: 26393
http://www.securityfocus.com/bid/26393
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9871
RedHat Security Advisories: RHSA-2007:0640
http://rhn.redhat.com/errata/RHSA-2007-0640.html
http://securitytracker.com/id?1018921
http://secunia.com/advisories/27611
XForce ISS Database: rhel-congaricci-dos(38358)
https://exchange.xforce.ibmcloud.com/vulnerabilities/38358
CopyrightCopyright (c) 2007 E-Soft Inc. http://www.securityspace.com

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.