Test ID:	1.3.6.1.4.1.25623.1.0.122446
Category:	Oracle Linux Local Security Checks
Title:	Oracle: Security Advisory (ELSA-2009-1341)
Summary:	The remote host is missing an update for the 'cman' package(s) announced via the ELSA-2009-1341 advisory.
Description:	Summary: The remote host is missing an update for the 'cman' package(s) announced via the ELSA-2009-1341 advisory. Vulnerability Insight: [2.0.115-1] - RSA II fencing agent has been fixed. - Resolves: rhbz#493802 [2.0.114-1] - local variable 'verbose_filename' referenced before assignment has been fixed - RSA II fencing agent has been fixed. - Resolves: rhbz#493802 rhbz#514758 [2.0.113-1] - Limitations with 2-node fence_scsi are now properly documented in the man page. - Resolves: rhbz#512998 [2.0.112-1] - The pexpect exception is now properly checked in fence agents. - Resolves: rhbz#501586 [2.0.111-1] - cman_tool leave remove does now properly reduces quorum. - Resolves: rhbz#505258 [2.0.110-1] - Updated fence_lpar man page to remove options that do not yet exist. - Resolves: rhbz#498045 [2.0.108-1] - A semaphore leak in cman has been fixed. - Resolves: rhbz#505594 [2.0.107-1] - Added man page for lpar fencing agent (fence_lpar). - Resolves: rhbz#498045 [2.0.106-1] - The lssyscfg command can take longer than the shell timeout which will cause fencing to fail, we now wait longer for the lssyscfg command to complete. - Resolves: rhbz#504705 [2.0.105-1] - The fencing agents no longer fail with pexpect exceptions. - Resolves: rhbz#501586 [2.0.104-1] - Broadcast communications are now possible with cman - fence_lpar can now login to IVM systems - Resolves: rhbz#502674 rhbz#492808 [2.0.103-1] - fence_apc no longer fails with a pexpect exception - symlink vulnerabilities in fance_apc_snmp were fixed - The virsh fencing agent was added. - Resolves: rhbz#496629 rhbz#498952 rhbz#501586 [2.0.102-1] - Correct return code is checked during disk scanning check. - Resolves: rhbz#484956 [2.0.101-1] - The SCSI fence agent now verifies that sg_persist is installed properly. - The DRAC5 fencing agent now properly handles a modulename. - QDisk now logs warning messages if it appears it's I/O to shared storage is hung. - Resolves: rhbz#496724 rhbz#500450 rhbz#500567 [2.0.100-1] - Support has been added for ePowerSwitch 8+ devices - cluster.conf files can now have more than 52 entries inside a block inside [block] - The output of the group_tool dump sub commands are no longer NULL padded. - Using device='' instead of label='' no longer causes qdiskd to incorrectly exit - The IPMI fencing agent has been modified to timeout after 10 seconds. It is also now possible to specify a different timeout with the '-t' option. - The IPMI fencing agent now allows punctuation in the password - Quickly starting and stopping the cman service no longer causes the cluster membership to become inconsistent across the cluster - An issue with lock syncing causing 'receive_own from ...' errors in syslog has been fixed - An issue which caused gfs_controld to segfault when mounting hundreds of filesystems has been fixed - The LPAR fencing agent now properly reports status when an LPAR is in Open Firmware - The APC SNMP fencing agent now properly recognizes outletStatusOn and outletStatusOff returns codes from the SNMP agent - ... [Please see the references for more information on the vulnerabilities] Affected Software/OS: 'cman' package(s) on Oracle Linux 5. Solution: Please install the updated package(s). CVSS Score: 6.9 CVSS Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2008-4579 31904 http://www.securityfocus.com/bid/31904 32387 http://secunia.com/advisories/32387 32390 http://secunia.com/advisories/32390 36530 http://secunia.com/advisories/36530 43362 http://secunia.com/advisories/43362 ADV-2011-0419 http://www.vupen.com/english/advisories/2011/0419 FEDORA-2008-9042 https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00666.html RHSA-2009:1341 http://www.redhat.com/support/errata/RHSA-2009-1341.html RHSA-2011:0266 http://www.redhat.com/support/errata/RHSA-2011-0266.html USN-875-1 http://www.ubuntu.com/usn/USN-875-1 [oss-security] 20081013 Re: CVE Request http://www.openwall.com/lists/oss-security/2008/10/13/3 http://bugs.gentoo.org/show_bug.cgi?id=240576 https://bugzilla.redhat.com/show_bug.cgi?id=467386 oval:org.mitre.oval:def:10799 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10799 Common Vulnerability Exposure (CVE) ID: CVE-2008-6552 BugTraq ID: 32179 http://www.securityfocus.com/bid/32179 http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00163.html http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00164.html http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00165.html http://osvdb.org/50299 http://osvdb.org/50300 http://osvdb.org/50301 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11404 RedHat Security Advisories: RHSA-2009:1337 http://rhn.redhat.com/errata/RHSA-2009-1337.html http://www.redhat.com/support/errata/RHSA-2009-1339.html http://www.redhat.com/support/errata/RHSA-2011-0264.html http://www.redhat.com/support/errata/RHSA-2011-0265.html http://secunia.com/advisories/32602 http://secunia.com/advisories/32616 http://secunia.com/advisories/36555 http://secunia.com/advisories/43367 http://secunia.com/advisories/43372 http://www.vupen.com/english/advisories/2011/0416 http://www.vupen.com/english/advisories/2011/0417 XForce ISS Database: clusterproject-unspecified-priv-escalation(46412) https://exchange.xforce.ibmcloud.com/vulnerabilities/46412
Copyright	Copyright (C) 2015 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.