Security Advisory Low: pacemaker security, bug fix, and enhancement update

Advisory: RHSA-2013:1635-2
Type: Security Advisory
Severity: Low
Issued on: 2013-11-21
Last updated on: 2013-11-21
Affected Products: Red Hat Enterprise Linux High Availability (v. 6)
Red Hat Enterprise Linux Resilient Storage (v. 6)
Red Hat Enterprise Linux Server (v. 6)
CVEs (cve.mitre.org): CVE-2013-0281

Details

Updated pacemaker packages that fix one security issue, several bugs, and
add various enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Pacemaker is a high-availability cluster resource manager with a powerful
policy engine.

A denial of service flaw was found in the way Pacemaker performed
authentication and processing of remote connections in certain
circumstances. When Pacemaker was configured to allow remote Cluster
Information Base (CIB) configuration or resource management, a remote
attacker could use this flaw to cause Pacemaker to block indefinitely
(preventing it from serving other requests). (CVE-2013-0281)

Note: The default Pacemaker configuration in Red Hat Enterprise Linux 6 has
the remote CIB management functionality disabled.

The pacemaker package has been upgraded to upstream version 1.1.10, which
provides a number of bug fixes and enhancements over the previous version:

* Pacemaker no longer assumes unknown cman nodes are safely stopped.

* The core dump file now converts all exit codes into positive 'errno'
values.

* Pacemaker ensures a return to a stable state after too many fencing
failures, and initiates a shutdown if a node claimed to be fenced is still
active.

* The crm_error tool adds the ability to list and print error symbols.

* The crm_resource command allows individual resources to be reprobed, and
implements the "--ban" option for moving resources away from nodes.
The "--clear" option has replaced the "--unmove" option. Also, crm_resource
now supports OCF tracing when using the "--force" option.

* The IPC mechanism restores the ability for members of the haclient group
to connect to the cluster.

* The Policy Engine daemon allows active nodes in the current membership to
be fenced without quorum.

* Policy Engine now suppresses meaningless IDs when displaying anonymous
clone status, supports maintenance mode for a single node, and correctly
handles the recovered resources before they are operated on.

* XML configuration files are now checked for non-printing characters and
replaced with their octal equivalent when exporting XML text. Also, a more
reliable buffer allocation strategy has been implemented to prevent
lockups.

(BZ#987355)

Additional bug fixes:

* The "crm_resource --move" command was designed for atomic resources and
could not handle resources on clones, masters, or slaves present on
multiple nodes. Consequently, crm_resource could not obtain enough
information to move a resource and did not perform any action. The "--ban"
and "--clear" options have been added to allow the administrator to
instruct the cluster unambiguously. Clone, master, and slave resources can
now be navigated within the cluster as expected. (BZ#902407)

* The hacluster user account did not have a user identification (UID) or
group identification (GID) number reserved on the system. Thus, UID and GID
values were picked randomly during the installation process. The UID and
GID number 189 was reserved for hacluster and is now used consistently for
all installations. (BZ#908450)

* Certain clusters used node host names that did not match the output of
the "uname -n" command. Thus, the default node name used by the crm_standby
and crm_failcount commands was incorrect and caused the cluster to ignore
the update by the administrator. The crm_node command is now used instead
of the uname utility in helper scripts. As a result, the cluster behaves as
expected. (BZ#913093)

* Due to incorrect return code handling, internal recovery logic of the
crm_mon utility was not executed when a configuration updated failed to
apply, leading to an assertion failure. Return codes are now checked
correctly, and the recovery of an expected error state is now handled
transparently. (BZ#951371)

* cman's automatic unfencing feature failed when combined with Pacemaker.
Support for automated unfencing in Pacemaker has been added, and the
unwanted behavior no longer occurs. (BZ#996850)

All pacemaker users are advised to upgrade to these updated packages, which
contain backported patches to correct these issues and add these
enhancements.


Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

Updated packages

Red Hat Enterprise Linux High Availability (v. 6)

SRPMS:
pacemaker-1.1.10-14.el6.src.rpm
File outdated by:  RHBA-2014:0431
    MD5: e5869cb897d31c3fe525c9b1b6b433ff
SHA-256: be1e616f983c81bcb8071e77e58cba8744720af7111430589083832b8c63d6fe
 
IA-32:
pacemaker-1.1.10-14.el6.i686.rpm
File outdated by:  RHSA-2015:1424
    MD5: c641e036ccffde7d7bca17f08a500e6c
SHA-256: 68c862e0d5c3d0819d2bd4d908ad1fa7420eede6b1fa972df0ec6c8d2eb31a4b
pacemaker-cli-1.1.10-14.el6.i686.rpm
File outdated by:  RHSA-2015:1424
    MD5: d056e5aa7452ab0059ecddf586b14f58
SHA-256: 786c3ef557b41d4a0ef2734a2278ec80e8f0446d4828b636c87fc84a503d0be6
pacemaker-cluster-libs-1.1.10-14.el6.i686.rpm
File outdated by:  RHSA-2015:1424
    MD5: 2c5f11f60fb82a4f9025196e64d44ab0
SHA-256: 959a813472f159c02d81229dbc21a0f48cb445e9892a5f2b30fd8461c759813b
pacemaker-cts-1.1.10-14.el6.i686.rpm
File outdated by:  RHSA-2015:1424
    MD5: 2768ba2e61234b35f6708f9302c536f0
SHA-256: bf998cb71883162864c8c1bf52f244100b0659b5bad7c6594c5960a49dfaf71b
pacemaker-debuginfo-1.1.10-14.el6.i686.rpm
File outdated by:  RHSA-2015:1424
    MD5: 9ee0bfffab4aeaa9094e9798e720c4b5
SHA-256: be1f891d1359c4dfaf24b3a97c6aca721ff1c341bcbad9a79267194fd87f435f
pacemaker-doc-1.1.10-14.el6.i686.rpm
File outdated by:  RHSA-2015:1424
    MD5: 24ea0a64d3f6ece11e6df7b639e44178
SHA-256: d0690aafae9e5700ed95f1620a677c26bab78c41e135c3fe0f42c25ec6171f40
pacemaker-libs-1.1.10-14.el6.i686.rpm
File outdated by:  RHSA-2015:1424
    MD5: 290e8a8812aa293e81172c4f612bbe05
SHA-256: f069a2e3cc915ec2327acd679a4dbb4d4225385ed58f704390051bd1eff6805b
pacemaker-libs-devel-1.1.10-14.el6.i686.rpm
File outdated by:  RHSA-2015:1424
    MD5: a7c6208d54dd937e1ebf35bb3c75c845
SHA-256: cf21e41322e102741731e68bac5a07332479b259a399062b6cc6afd81fdbff0e
 
x86_64:
pacemaker-1.1.10-14.el6.x86_64.rpm
File outdated by:  RHSA-2015:1424
    MD5: f1f1d4d2b18938f54ea20e8bac2928a2
SHA-256: f934c8d1a39bf4fef949eeba5a1bf248e2b45fd1540d16490cd23cd38bdd820a
pacemaker-cli-1.1.10-14.el6.x86_64.rpm
File outdated by:  RHSA-2015:1424
    MD5: ac3aac4a1c4bd3d0873aab3ea15c3c70
SHA-256: 62d90f11e492b313cd892342c92a08040511d1365c8397ea259fca257001619d
pacemaker-cluster-libs-1.1.10-14.el6.i686.rpm
File outdated by:  RHSA-2015:1424
    MD5: 2c5f11f60fb82a4f9025196e64d44ab0
SHA-256: 959a813472f159c02d81229dbc21a0f48cb445e9892a5f2b30fd8461c759813b
pacemaker-cluster-libs-1.1.10-14.el6.x86_64.rpm
File outdated by:  RHSA-2015:1424
    MD5: 64692902f30e09cf16d738c3ad438722
SHA-256: c2c07352dd12e51e432c3ec767b6cb1d252d0071f0d87fc6ed7d940761f3f0a0
pacemaker-cts-1.1.10-14.el6.x86_64.rpm
File outdated by:  RHSA-2015:1424
    MD5: ba4af02beb477721cd35eb0dda1a60a0
SHA-256: ee165afab9069383ee0d27b824a4ceba280783882acb225aae0807cc280178c3
pacemaker-debuginfo-1.1.10-14.el6.i686.rpm
File outdated by:  RHSA-2015:1424
    MD5: 9ee0bfffab4aeaa9094e9798e720c4b5
SHA-256: be1f891d1359c4dfaf24b3a97c6aca721ff1c341bcbad9a79267194fd87f435f
pacemaker-debuginfo-1.1.10-14.el6.x86_64.rpm
File outdated by:  RHSA-2015:1424
    MD5: 8cc8aa222c8da0d1402232eddbc9f7b2
SHA-256: 5530b306ea447607568633c559be178de77a52f9c9a583b67bdf9d63fb8f9843
pacemaker-doc-1.1.10-14.el6.x86_64.rpm
File outdated by:  RHSA-2015:1424
    MD5: 9b7ef08e6f02eca3f7e775b836f607ad
SHA-256: 9637263f0ea3c231b766be2c67de67f04c9a9d9a6208cd36c895ec3c99e133b5
pacemaker-libs-1.1.10-14.el6.i686.rpm
File outdated by:  RHSA-2015:1424
    MD5: 290e8a8812aa293e81172c4f612bbe05
SHA-256: f069a2e3cc915ec2327acd679a4dbb4d4225385ed58f704390051bd1eff6805b
pacemaker-libs-1.1.10-14.el6.x86_64.rpm
File outdated by:  RHSA-2015:1424
    MD5: 4b928a1d15adb59d7b9e3d78b053f1f5
SHA-256: 20bf6bc6f74b95f181a11f2fce16023f3837c295f45334f68221f9610f7c6cdc
pacemaker-libs-devel-1.1.10-14.el6.i686.rpm
File outdated by:  RHSA-2015:1424
    MD5: a7c6208d54dd937e1ebf35bb3c75c845
SHA-256: cf21e41322e102741731e68bac5a07332479b259a399062b6cc6afd81fdbff0e
pacemaker-libs-devel-1.1.10-14.el6.x86_64.rpm
File outdated by:  RHSA-2015:1424
    MD5: b78a8360dfd315e8dde190759b2628b5
SHA-256: 6f71a668c5c41d9993c0730ce912232bb25e209e1521465cfe7558f9f81b2386
 
Red Hat Enterprise Linux Resilient Storage (v. 6)

SRPMS:
pacemaker-1.1.10-14.el6.src.rpm
File outdated by:  RHBA-2014:0431
    MD5: e5869cb897d31c3fe525c9b1b6b433ff
SHA-256: be1e616f983c81bcb8071e77e58cba8744720af7111430589083832b8c63d6fe
 
IA-32:
pacemaker-1.1.10-14.el6.i686.rpm
File outdated by:  RHSA-2015:1424
    MD5: c641e036ccffde7d7bca17f08a500e6c
SHA-256: 68c862e0d5c3d0819d2bd4d908ad1fa7420eede6b1fa972df0ec6c8d2eb31a4b
pacemaker-cli-1.1.10-14.el6.i686.rpm
File outdated by:  RHSA-2015:1424
    MD5: d056e5aa7452ab0059ecddf586b14f58
SHA-256: 786c3ef557b41d4a0ef2734a2278ec80e8f0446d4828b636c87fc84a503d0be6
pacemaker-cluster-libs-1.1.10-14.el6.i686.rpm
File outdated by:  RHSA-2015:1424
    MD5: 2c5f11f60fb82a4f9025196e64d44ab0
SHA-256: 959a813472f159c02d81229dbc21a0f48cb445e9892a5f2b30fd8461c759813b
pacemaker-cts-1.1.10-14.el6.i686.rpm
File outdated by:  RHSA-2015:1424
    MD5: 2768ba2e61234b35f6708f9302c536f0
SHA-256: bf998cb71883162864c8c1bf52f244100b0659b5bad7c6594c5960a49dfaf71b
pacemaker-debuginfo-1.1.10-14.el6.i686.rpm
File outdated by:  RHSA-2015:1424
    MD5: 9ee0bfffab4aeaa9094e9798e720c4b5
SHA-256: be1f891d1359c4dfaf24b3a97c6aca721ff1c341bcbad9a79267194fd87f435f
pacemaker-doc-1.1.10-14.el6.i686.rpm
File outdated by:  RHSA-2015:1424
    MD5: 24ea0a64d3f6ece11e6df7b639e44178
SHA-256: d0690aafae9e5700ed95f1620a677c26bab78c41e135c3fe0f42c25ec6171f40
pacemaker-libs-1.1.10-14.el6.i686.rpm
File outdated by:  RHSA-2015:1424
    MD5: 290e8a8812aa293e81172c4f612bbe05
SHA-256: f069a2e3cc915ec2327acd679a4dbb4d4225385ed58f704390051bd1eff6805b
pacemaker-libs-devel-1.1.10-14.el6.i686.rpm
File outdated by:  RHSA-2015:1424
    MD5: a7c6208d54dd937e1ebf35bb3c75c845
SHA-256: cf21e41322e102741731e68bac5a07332479b259a399062b6cc6afd81fdbff0e
 
x86_64:
pacemaker-1.1.10-14.el6.x86_64.rpm
File outdated by:  RHSA-2015:1424
    MD5: f1f1d4d2b18938f54ea20e8bac2928a2
SHA-256: f934c8d1a39bf4fef949eeba5a1bf248e2b45fd1540d16490cd23cd38bdd820a
pacemaker-cli-1.1.10-14.el6.x86_64.rpm
File outdated by:  RHSA-2015:1424
    MD5: ac3aac4a1c4bd3d0873aab3ea15c3c70
SHA-256: 62d90f11e492b313cd892342c92a08040511d1365c8397ea259fca257001619d
pacemaker-cluster-libs-1.1.10-14.el6.i686.rpm
File outdated by:  RHSA-2015:1424
    MD5: 2c5f11f60fb82a4f9025196e64d44ab0
SHA-256: 959a813472f159c02d81229dbc21a0f48cb445e9892a5f2b30fd8461c759813b
pacemaker-cluster-libs-1.1.10-14.el6.x86_64.rpm
File outdated by:  RHSA-2015:1424
    MD5: 64692902f30e09cf16d738c3ad438722
SHA-256: c2c07352dd12e51e432c3ec767b6cb1d252d0071f0d87fc6ed7d940761f3f0a0
pacemaker-cts-1.1.10-14.el6.x86_64.rpm
File outdated by:  RHSA-2015:1424
    MD5: ba4af02beb477721cd35eb0dda1a60a0
SHA-256: ee165afab9069383ee0d27b824a4ceba280783882acb225aae0807cc280178c3
pacemaker-debuginfo-1.1.10-14.el6.i686.rpm
File outdated by:  RHSA-2015:1424
    MD5: 9ee0bfffab4aeaa9094e9798e720c4b5
SHA-256: be1f891d1359c4dfaf24b3a97c6aca721ff1c341bcbad9a79267194fd87f435f
pacemaker-debuginfo-1.1.10-14.el6.x86_64.rpm
File outdated by:  RHSA-2015:1424
    MD5: 8cc8aa222c8da0d1402232eddbc9f7b2
SHA-256: 5530b306ea447607568633c559be178de77a52f9c9a583b67bdf9d63fb8f9843
pacemaker-doc-1.1.10-14.el6.x86_64.rpm
File outdated by:  RHSA-2015:1424
    MD5: 9b7ef08e6f02eca3f7e775b836f607ad
SHA-256: 9637263f0ea3c231b766be2c67de67f04c9a9d9a6208cd36c895ec3c99e133b5
pacemaker-libs-1.1.10-14.el6.i686.rpm
File outdated by:  RHSA-2015:1424
    MD5: 290e8a8812aa293e81172c4f612bbe05
SHA-256: f069a2e3cc915ec2327acd679a4dbb4d4225385ed58f704390051bd1eff6805b
pacemaker-libs-1.1.10-14.el6.x86_64.rpm
File outdated by:  RHSA-2015:1424
    MD5: 4b928a1d15adb59d7b9e3d78b053f1f5
SHA-256: 20bf6bc6f74b95f181a11f2fce16023f3837c295f45334f68221f9610f7c6cdc
pacemaker-libs-devel-1.1.10-14.el6.i686.rpm
File outdated by:  RHSA-2015:1424
    MD5: a7c6208d54dd937e1ebf35bb3c75c845
SHA-256: cf21e41322e102741731e68bac5a07332479b259a399062b6cc6afd81fdbff0e
pacemaker-libs-devel-1.1.10-14.el6.x86_64.rpm
File outdated by:  RHSA-2015:1424
    MD5: b78a8360dfd315e8dde190759b2628b5
SHA-256: 6f71a668c5c41d9993c0730ce912232bb25e209e1521465cfe7558f9f81b2386
 
Red Hat Enterprise Linux Server (v. 6)

SRPMS:
pacemaker-1.1.10-14.el6.src.rpm
File outdated by:  RHBA-2014:0431
    MD5: e5869cb897d31c3fe525c9b1b6b433ff
SHA-256: be1e616f983c81bcb8071e77e58cba8744720af7111430589083832b8c63d6fe
 
IA-32:
pacemaker-debuginfo-1.1.10-14.el6.i686.rpm
File outdated by:  RHBA-2014:0431
    MD5: 9ee0bfffab4aeaa9094e9798e720c4b5
SHA-256: be1f891d1359c4dfaf24b3a97c6aca721ff1c341bcbad9a79267194fd87f435f
pacemaker-remote-1.1.10-14.el6.i686.rpm
File outdated by:  RHBA-2014:0431
    MD5: c00094c5d3dd55c993285e1b4143daa8
SHA-256: 25d0eae97261cab13557fdcc803cbd26358e4c30c428aa611924785c9b18a94e
 
x86_64:
pacemaker-debuginfo-1.1.10-14.el6.x86_64.rpm
File outdated by:  RHBA-2014:0431
    MD5: 8cc8aa222c8da0d1402232eddbc9f7b2
SHA-256: 5530b306ea447607568633c559be178de77a52f9c9a583b67bdf9d63fb8f9843
pacemaker-remote-1.1.10-14.el6.x86_64.rpm
File outdated by:  RHBA-2014:0431
    MD5: 4e15353044640a0ba21041a648986343
SHA-256: 5b889b7f1f6299f9fb9952beba11a19267789ef2136f3c227f6eca3f49be75a8
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

1011618 - Slave roles inconsistent in pcs status xml (or crm_mon)
891922 - CVE-2013-0281 pacemaker: remote DoS when CIB management is enabled caused by use of blocking sockets
902407 - Different results when moving Master/Slave resources
902459 - Persistent resource-related data after the resource is deleted
996850 - Unfence at cluster startup with fence_scsi
997346 - pacemaker enables itself on boot during installation


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/