Synopsis

Moderate: conga security, bug fix, and enhancement update

Type/Severity

Security Advisory: Moderate

Topic

[Updated 29th November 2007]
Packages have been updated to include ppc and xenU packages.

Updated conga packages that fix a security flaw, several bugs, and add
enhancements are now available for Red Hat Cluster Suite.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

The Conga package is a web-based administration tool for remote cluster and
storage management.

A flaw was found in ricci during a code audit. A remote attacker who is
able to connect to ricci could cause ricci to temporarily refuse additional
connections, resulting in a denial of service. (CVE-2007-4136)

Additionally, these updated packages fix the following bugs:

• entering an invalid password when creating a new cluster with the luci
  web application caused a "UnboundLocalError" error.
  
• conga did not set the the "nodename" attribute for instances of manual
  fencing, resulting in manual fencing being non-functional.
  
• conga did not provide a way to remove a dead node from a cluster.
  Attempting to remove a dead node from a cluster resulted in an error,
  reporting that that the node name cannot be reached.
  
• during cluster formation Conga reboots the cluster nodes. During reboot
  errors about not being able to communicate with nodes are displayed. These
  errors can safely be ignored, and have been removed in these updated
  packages.
  
• when building a new cluster on Red Hat Enterprise Linux 4, Conga did not
  generate node ID attributes for clusternode tags. The node ID attributes
  are needed by programs such as qdisk.
  
• during Quorum Partition Configuration, a "TypeError" error occurred if
  you did not configure heuristics.
  
• when passing arguments to fence_scsi, Conga used the "nodename" attribute
  instead of the "node" attribute, resulting in an invalid XML file being
  passed to fence_scsi. The "nodename" attribute is now supported.
  
• conga did not handle the restart operation correctly. In certain
  situations this resulted in nodes not being started, stopped, and restarted
  correctly. These issues were caused by clusters starting while others were
  still in the process of stopping. This has been resolved in these updated
  packages.
  
• probing storage using luci and the Mozilla Firefox 2 web browser on
  Microsoft Windows XP appeared to never finish, when in fact it had. After
  probing, clicking the node name in the storage list correctly showed the
  storage for that node.
  

As well, these updated packages add the following enhancements:

• the Conga web interface now supports the Microsoft Internet Explorer web
  browser, versions 6.0 and later.
  
• in previous packages, Conga required a minimum score to be configured
  even when heuristics were not being used. A minimum score is no longer
  required.
  

All Conga users are advised to upgrade to these updated packages, which
fix this vulnerability, resolve these issues, and add these enhancements.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux High Availability (for RHEL Server) 4 x86_64
• Red Hat Enterprise Linux High Availability (for RHEL Server) 4 ppc
• Red Hat Enterprise Linux High Availability (for RHEL Server) 4 ia64
• Red Hat Enterprise Linux High Availability (for RHEL Server) 4 i386

Fixes

• BZ - 227723 - Entering bad password when creating a new cluster = UnboundLocalError: local variable 'e' referenced before assignment
• BZ - 238656 - conga does not set the "nodename" attribute for manual fencing
• BZ - 238727 - Conga provides no way to remove a dead node from a cluster
• BZ - 241414 - Installation using Conga shows "error" in message during reboot cycle.
• BZ - 245200 - Conga needs to support Internet Explorer 6.0 and later
• BZ - 253901 - No node IDs generated on new RHEL4 / DLM cluster
• BZ - 253905 - Quorum disk page: Minimum score does not need to be required
• BZ - 253906 - Quorum disk page: Error when trying to continue w/o a heuristic
• BZ - 286951 - conga passes fence_scsi nodename, where as it accepts only node
• BZ - 325501 - conga doesn't handle the cluster restart operation properly
• BZ - 336101 - CVE-2007-4136 ricci is vulnerable to a connect DoS attack
• BZ - 340101 - Storage redirection after probe does not work on WinXP with FF2

CVEs

• CVE-2007-4136

References

• http://www.redhat.com/security/updates/classification/#moderate

This erratum does not contain any packages.