Test ID:	1.3.6.1.4.1.25623.1.0.881301
Category:	CentOS Local Security Checks
Title:	CentOS Update for rgmanager CESA-2011:1000 centos5 x86_64
Summary:	The remote host is missing an update for the 'rgmanager'; package(s) announced via the referenced advisory.
Description:	Summary: The remote host is missing an update for the 'rgmanager' package(s) announced via the referenced advisory. Vulnerability Insight: The rgmanager package contains the Red Hat Resource Group Manager, which provides the ability to create and manage high-availability server applications in the event of system downtime. It was discovered that certain resource agent scripts set the LD_LIBRARY_PATH environment variable to an insecure value containing empty path elements. A local user able to trick a user running those scripts to run them while working from an attacker-writable directory could use this flaw to escalate their privileges via a specially-crafted dynamic library. (CVE-2010-3389) Red Hat would like to thank Raphael Geissert for reporting this issue. This update also fixes the following bugs: * The failover domain 'nofailback' option was not honored if a service was in the 'starting' state. This bug has been fixed. (BZ#669440) * PID files with white spaces in the file name are now handled correctly. (BZ#632704) * The /usr/sbin/rhev-check.sh script can now be used from within Cron. (BZ#634225) * The clustat utility now reports the correct version. (BZ#654160) * The oracledb.sh agent now attempts to try the 'shutdown immediate' command instead of using the 'shutdown abort' command. (BZ#633992) * The SAPInstance and SAPDatabase scripts now use proper directory name quoting so they no longer collide with directory names like '/u'. (BZ#637154) * The clufindhostname utility now returns the correct value in all cases. (BZ#592613) * The nfsclient resource agent now handles paths with trailing slashes correctly. (BZ#592624) * The last owner of a service is now reported correctly after a failover. (BZ#610483) * The /usr/share/cluster/fs.sh script no longer runs the 'quotaoff' command if quotas were not configured. (BZ#637678) * The 'listen' line in the /etc/httpd/conf/httpd.conf file generated by the Apache resource agent is now correct. (BZ#675739) * The tomcat-5 resource agent no longer generates incorrect configurations. (BZ#637802) * The time required to stop an NFS resource when the server is unavailable has been reduced. (BZ#678494) * When using exclusive prioritization, a higher priority service now preempts a lower priority service after status check failures. (BZ#680256) * The postgres-8 resource agent now correctly detects failed start operations. (BZ#663827) * The handling of reference counts passed by rgmanager to resource agents now works properly, as expected. (BZ#692771) As well, this update adds the ... Description truncated, please see the referenced URL(s) for more information. Affected Software/OS: rgmanager on CentOS 5 Solution: Please install the updated packages. CVSS Score: 6.9 CVSS Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2010-3389 http://security.gentoo.org/glsa/glsa-201110-18.xml http://www.redhat.com/support/errata/RHSA-2011-0264.html http://www.redhat.com/support/errata/RHSA-2011-1000.html http://www.redhat.com/support/errata/RHSA-2011-1580.html http://secunia.com/advisories/43372 http://www.vupen.com/english/advisories/2011/0416
Copyright	Copyright (C) 2012 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.