fence: Multiple symlink vulnerabilities

1. Gentoo Linux Security Advisory

Package	Vulnerable versions	Unaffected versions	Architecture(s)
sys-cluster/fence	< 2.03.09		All supported architectures

Related bugreports: #240576

fence contains multiple programs containing vulnerabilities that may allow local users to overwrite arbitrary files via a symlink attack.

2. Impact Information

fence is an I/O group fencing system.

The fence_apc, fence_apc_snmp (CVE-2008-4579) and fence_manual (CVE-2008-4580) programs contain symlink vulnerabilities.

These vulnerabilities may allow arbitrary files to be overwritten with root privileges.

3. Resolution Information

There is no known workaround at this time.

Gentoo discontinued support for fence. All fence users should uninstall and choose another software that provides the same functionality.

Code Listing 3.1: Resolution

# emerge --unmerge sys-cluster/fence

4. References

Page updated September 29, 2010

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.