Vulnerabilities > CVE-2006-3121 - Resource Management Errors vulnerability in High Availability Linux Project Heartbeat
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
PARTIAL Summary
The peel_netstring function in cl_netstring.c in the heartbeat subsystem in High-Availability Linux before 1.2.5, and 2.0 before 2.0.7, allows remote attackers to cause a denial of service (crash) via the length parameter in a heartbeat message.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Exploit-Db
description | Linux-HA Heartbeat 2.0.6 Remote Denial of Service Vulnerability. CVE-2006-3121. Dos exploit for linux platform |
id | EDB-ID:28386 |
last seen | 2016-02-03 |
modified | 2006-08-13 |
published | 2006-08-13 |
reporter | Yan Rong Ge |
source | https://www.exploit-db.com/download/28386/ |
title | Linux-HA Heartbeat <= 2.0.6 - Remote Denial of Service Vulnerability |
Nessus
NASL family SuSE Local Security Checks NASL id SUSE_HEARTBEAT-2139.NASL description This update fixes both a local and a remote denial of service attack within heartbeat, as well as numerous other bugs in the messaging and membership layer, GUI, Cluster Resource Manager, Local Resource Manager and Resource Agents. (CVE-2006-3815,CVE-2006-3121) last seen 2020-06-01 modified 2020-06-02 plugin id 27263 published 2007-10-17 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/27263 title openSUSE 10 Security Update : heartbeat (heartbeat-2139) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update heartbeat-2139. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(27263); script_version ("1.13"); script_cvs_date("Date: 2019/10/25 13:36:28"); script_cve_id("CVE-2006-3121", "CVE-2006-3815"); script_name(english:"openSUSE 10 Security Update : heartbeat (heartbeat-2139)"); script_summary(english:"Check for the heartbeat-2139 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "This update fixes both a local and a remote denial of service attack within heartbeat, as well as numerous other bugs in the messaging and membership layer, GUI, Cluster Resource Manager, Local Resource Manager and Resource Agents. (CVE-2006-3815,CVE-2006-3121)" ); script_set_attribute( attribute:"solution", value:"Update the affected heartbeat packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:heartbeat"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:heartbeat-cmpi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:heartbeat-ldirectord"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:heartbeat-pils"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:heartbeat-stonith"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:10.1"); script_set_attribute(attribute:"patch_publication_date", value:"2006/09/27"); script_set_attribute(attribute:"plugin_publication_date", value:"2007/10/17"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2007-2019 Tenable Network Security, Inc."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE10\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "10.1", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE10.1", reference:"heartbeat-2.0.7-1.3") ) flag++; if ( rpm_check(release:"SUSE10.1", reference:"heartbeat-cmpi-2.0.7-1.3") ) flag++; if ( rpm_check(release:"SUSE10.1", reference:"heartbeat-ldirectord-2.0.7-1.3") ) flag++; if ( rpm_check(release:"SUSE10.1", reference:"heartbeat-pils-2.0.7-1.3") ) flag++; if ( rpm_check(release:"SUSE10.1", reference:"heartbeat-stonith-2.0.7-1.3") ) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "heartbeat"); }
NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-200608-23.NASL description The remote host is affected by the vulnerability described in GLSA-200608-23 (Heartbeat: Denial of Service) Yan Rong Ge discovered that the peel_netstring() function in cl_netstring.c does not validate the last seen 2020-06-01 modified 2020-06-02 plugin id 22285 published 2006-08-30 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/22285 title GLSA-200608-23 : Heartbeat: Denial of Service NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-335-1.NASL description Yan Rong Ge discovered that heartbeat did not sufficiently verify some packet input data, which could lead to an out-of-boundary memory access. A remote attacker could exploit this to crash the daemon (Denial of Service). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 27914 published 2007-11-10 reporter Ubuntu Security Notice (C) 2007-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/27914 title Ubuntu 5.04 / 5.10 / 6.06 LTS : heartbeat vulnerability (USN-335-1) NASL family Mandriva Local Security Checks NASL id MANDRAKE_MDKSA-2006-142.NASL description Two vulnerabilities in heartbeat prior to 2.0.6 was discovered by Yan Rong Ge. The first is that heartbeat would set insecure permissions in an shmget call for shared memory, allowing a local attacker to cause an unspecified denial of service via unknown vectors (CVE-2006-3815). The second is a remote vulnerability that could allow allow the master control process to read invalid memory due to a specially crafted heartbeat message and die of a SEGV, all prior to any authentication (CVE-2006-3121). Updated packages have been patched to correct these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 23891 published 2006-12-16 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/23891 title Mandrake Linux Security Advisory : heartbeat (MDKSA-2006:142) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-1151.NASL description Yan Rong Ge discovered out-of-boundary memory access in heartbeat, the subsystem for High-Availability Linux. This could be used by a remote attacker to cause a denial of service. last seen 2020-06-01 modified 2020-06-02 plugin id 22693 published 2006-10-14 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/22693 title Debian DSA-1151-1 : heartbeat - out-of-bounds read
References
- http://secunia.com/advisories/21505
- http://secunia.com/advisories/21511
- http://secunia.com/advisories/21518
- http://secunia.com/advisories/21521
- http://secunia.com/advisories/21629
- http://security.gentoo.org/glsa/glsa-200608-23.xml
- http://www.debian.org/security/2006/dsa-1151
- http://www.linux-ha.org/_cache/SecurityIssues__sec03.txt
- http://www.linux-ha.org/SecurityIssues
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:142
- http://www.securityfocus.com/bid/19516
- http://www.ubuntu.com/usn/usn-335-1
- http://www.vupen.com/english/advisories/2006/3288
- https://exchange.xforce.ibmcloud.com/vulnerabilities/28396