ID de Prueba:	1.3.6.1.4.1.25623.1.0.58999
Categoría:	Red Hat Local Security Checks
Título:	RedHat Security Advisory RHSA-2007:0983
Resumen:	NOSUMMARY
Descripción:	Description: The remote host is missing updates announced in advisory RHSA-2007:0983. The Conga package is a web-based administration tool for remote cluster and storage management. A flaw was found in ricci during a code audit. A remote attacker who is able to connect to ricci could cause ricci to temporarily refuse additional connections, resulting in a denial of service. (CVE-2007-4136) Additionally, these updated packages fix the following bugs: * entering an invalid password when creating a new cluster with the luci web application caused a UnboundLocalError error. * conga did not set the the nodename attribute for instances of manual fencing, resulting in manual fencing being non-functional. * conga did not provide a way to remove a dead node from a cluster. Attempting to remove a dead node from a cluster resulted in an error, reporting that that the node name cannot be reached. * during cluster formation Conga reboots the cluster nodes. During reboot errors about not being able to communicate with nodes are displayed. These errors can safely be ignored, and have been removed in these updated packages. * when building a new cluster on Red Hat Enterprise Linux 4, Conga did not generate node ID attributes for clusternode tags. The node ID attributes are needed by programs such as qdisk. * during Quorum Partition Configuration, a TypeError error occurred if you did not configure heuristics. * when passing arguments to fence_scsi, Conga used the nodename attribute instead of the node attribute, resulting in an invalid XML file being passed to fence_scsi. The nodename attribute is now supported. * conga did not handle the restart operation correctly. In certain situations this resulted in nodes not being started, stopped, and restarted correctly. These issues were caused by clusters starting while others were still in the process of stopping. This has been resolved in these updated packages. * probing storage using luci and the Mozilla Firefox 2 web browser on Microsoft Windows XP appeared to never finish, when in fact it had. After probing, clicking the node name in the storage list correctly showed the storage for that node. As well, these updated packages add the following enhancements: * the Conga web interface now supports the Microsoft Internet Explorer web browser, versions 6.0 and later. * in previous packages, Conga required a minimum score to be configured even when heuristics were not being used. A minimum score is no longer required. All Conga users are advised to upgrade to these updated packages, which fix this vulnerability, resolve these issues, and add these enhancements. Solution: Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date http://rhn.redhat.com/errata/RHSA-2007-0983.html http://www.redhat.com/security/updates/classification/#moderate Risk factor : Medium CVSS Score: 5.0
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2007-4136 BugTraq ID: 26393 http://www.securityfocus.com/bid/26393 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9871 RedHat Security Advisories: RHSA-2007:0640 http://rhn.redhat.com/errata/RHSA-2007-0640.html http://securitytracker.com/id?1018921 http://secunia.com/advisories/27611 XForce ISS Database: rhel-congaricci-dos(38358) https://exchange.xforce.ibmcloud.com/vulnerabilities/38358
Copyright	Copyright (c) 2007 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 99761 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.