[ GLSA 200608-23 ] Heartbeat: Denial of Service

[Sune Kloppenborg Jeppesen <jaervosz () gentoo org>]

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200608-23
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Normal
     Title: Heartbeat: Denial of Service
      Date: August 24, 2006
      Bugs: #141894
        ID: 200608-23

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Heartbeat is vulnerable to a Denial of Service which can be triggered
by a remote attacker without authentication.

Background
==========

Heartbeat is a component of the High-Availability Linux project. It is
used to perform death-of-node detection, communications and cluster
management.

Affected packages
=================

    -------------------------------------------------------------------
     Package                /  Vulnerable  /                Unaffected
    -------------------------------------------------------------------
  1  sys-cluster/heartbeat       < 2.0.7                      >= 2.0.7

Description
===========

Yan Rong Ge discovered that the peel_netstring() function in
cl_netstring.c does not validate the "length" parameter of user input,
which can lead to an out-of-bounds memory access when processing
certain Heartbeat messages (CVE-2006-3121). Furthermore an unspecified
local DoS issue was fixed (CVE-2006-3815).

Impact
======

By sending a malicious UDP Heartbeat message, even before
authentication, a remote attacker can crash the master control process
of the cluster.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All Heartbeat users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=sys-cluster/heartbeat-2.0.7"

References
==========

  [ 1 ] CVE-2006-3121
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3121
  [ 2 ] CVE-2006-3815
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3815

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200608-23.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security () gentoo org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2006 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5

Attachment: _bin
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/