Vulnerabilities > CVE-2010-3389 - Unspecified vulnerability in Linux-Ha OCF Resource Agents 1.0.3

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Red Hat Security Advisory RHSA-2011:1580. The text 
# itself is copyright (C) Red Hat, Inc.
#

include("compat.inc");

if (description)
{
  script_id(64007);
  script_version("1.17");
  script_cvs_date("Date: 2019/10/25 13:36:16");

  script_cve_id("CVE-2010-3389");
  script_bugtraq_id(44359);
  script_xref(name:"RHSA", value:"2011:1580");

  script_name(english:"RHEL 6 : resource-agents (RHSA-2011:1580)");
  script_summary(english:"Checks the rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Red Hat host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"An updated resource-agents package that fixes one security issue,
several bugs, and adds multiple enhancements is now available for Red
Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low
security impact. A Common Vulnerability Scoring System (CVSS) base
score, which gives a detailed severity rating, is available from the
CVE link in the References section.

The resource-agents package contains a set of scripts to interface
with several services to operate in a High Availability environment
for both Pacemaker and rgmanager service managers.

It was discovered that certain resource agent scripts set the
LD_LIBRARY_PATH environment variable to an insecure value containing
empty path elements. A local user able to trick a user running those
scripts to run them while working from an attacker-writable directory
could use this flaw to escalate their privileges via a specially
crafted dynamic library. (CVE-2010-3389)

Red Hat would like to thank Raphael Geissert for reporting this issue.

This update also fixes the following bugs :

* When using the Sybase database and the ASEHAagent resource in the
cluster.conf file, it was not possible to run more than one ASEHAagent
per Sybase installation. Consequently, a second ASEHA (Sybase Adaptive
Server Enterprise (ASE) with the High Availability Option) agent could
not be run. This bug has been fixed and it is now possible to use two
ASEHA agents using the same Sybase installation. (BZ#711852)

* The s/lang scripts, which implement internal functionality for the
rgmanager package, while the central_processing option is in use, were
included in the wrong package. Now, the rgmanager and resource-agents
packages require each other for installation to prevent problems when
they are used separately. (BZ#693518)

* Previously, the oracledb.sh script was using the 'shutdown abort'
command as the first attempt to shut down a database. With this
update, oracledb.sh first attempts a graceful shutdown via the
'shutdown immediate' command before forcing the shutdown. (BZ#689801)

* Previously, when setting up a service on a cluster with a shared IP
resource and an Apache resource, the generated httpd.conf file
contained a bug in the line describing the shared IP address (the
'Listen' line). Now, the Apache resource agent generates the 'Listen'
line properly. (BZ#667217)

* If a high-availability (HA) cluster service was defined with an
Apache resource and was named with two words, such as 'kickstart
httpd', the service never started because it could not find a
directory with the space character in its name escaped. Now, Apache
resources work properly if a name contains a space as described above.
(BZ#667222)

* When inheritance was used in the cluster.conf file, a bug in the
/usr/share/cluster/nfsclient.sh file prevented it from monitoring NFS
exports properly. Consequently, monitoring of NFS exports to NFS
clients resulted in an endless loop. This bug has been fixed and the
monitoring now works as expected. (BZ#691814)

* Previously, the postgres-8 resource agent did not detect when a
PostgreSQL server failed to start. This bug has been fixed and
postgres-8 now works as expected in the described scenario.
(BZ#694816)

* When using the Pacemaker resource manager, the fs.sh resource agent
reported an error condition, if called with the 'monitor' parameter
and the referenced device did not exist. Consequently, the error
condition prevented the resource from being started. Now, fs.sh
returns the proper response code in the described scenario, thus
fixing this bug. (BZ#709400)

* Previously, numerous RGManager resource agents returned incorrect
response codes when coupled with the Pacemaker resource manager. Now,
the agents have been updated to work with Pacemaker properly.
(BZ#727643)

This update also adds the following enhancement :

* With this update, when the network is removed from a node using the
netfs.sh resource agent, it now recovers faster than previously.
(BZ#678497)

As well, this update upgrades the resource-agents package to upstream
version 3.9.2, which provides a number of bug fixes and enhancements
over the previous version. (BZ#707127)

All users of resource-agents are advised to upgrade to this updated
package, which corrects these issues and adds these enhancements."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2010-3389"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/errata/RHSA-2011:1580"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"Update the affected resource-agents and / or resource-agents-debuginfo
packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:resource-agents");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:resource-agents-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6");

  script_set_attribute(attribute:"vuln_publication_date", value:"2010/10/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2011/12/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2013/01/24");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Red Hat Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
os_ver = os_ver[1];
if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 6.x", "Red Hat " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);

yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
if (!empty_or_null(yum_updateinfo)) 
{
  rhsa = "RHSA-2011:1580";
  yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
  if (!empty_or_null(yum_report))
  {
    security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : yum_report 
    );
    exit(0);
  }
  else
  {
    audit_message = "affected by Red Hat security advisory " + rhsa;
    audit(AUDIT_OS_NOT, audit_message);
  }
}
else
{
  flag = 0;
  if (rpm_check(release:"RHEL6", cpu:"i686", reference:"resource-agents-3.9.2-7.el6")) flag++;
  if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"resource-agents-3.9.2-7.el6")) flag++;
  if (rpm_check(release:"RHEL6", cpu:"i686", reference:"resource-agents-debuginfo-3.9.2-7.el6")) flag++;
  if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"resource-agents-debuginfo-3.9.2-7.el6")) flag++;

  if (flag)
  {
    security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get() + redhat_report_package_caveat()
    );
    exit(0);
  }
  else
  {
    tested = pkg_tests_get();
    if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
    else audit(AUDIT_PACKAGE_NOT_INSTALLED, "resource-agents / resource-agents-debuginfo");
  }
}

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Gentoo Linux Security Advisory GLSA 201412-09.
#
# The advisory text is Copyright (C) 2001-2019 Gentoo Foundation, Inc.
# and licensed under the Creative Commons - Attribution / Share Alike 
# license. See http://creativecommons.org/licenses/by-sa/3.0/
#

include("compat.inc");

if (description)
{
  script_id(79962);
  script_version("1.6");
  script_cvs_date("Date: 2019/08/12 17:35:38");

  script_cve_id("CVE-2007-4370", "CVE-2009-4023", "CVE-2009-4111", "CVE-2010-0778", "CVE-2010-1780", "CVE-2010-1782", "CVE-2010-1783", "CVE-2010-1784", "CVE-2010-1785", "CVE-2010-1786", "CVE-2010-1787", "CVE-2010-1788", "CVE-2010-1790", "CVE-2010-1791", "CVE-2010-1792", "CVE-2010-1793", "CVE-2010-1807", "CVE-2010-1812", "CVE-2010-1814", "CVE-2010-1815", "CVE-2010-2526", "CVE-2010-2901", "CVE-2010-3255", "CVE-2010-3257", "CVE-2010-3259", "CVE-2010-3362", "CVE-2010-3374", "CVE-2010-3389", "CVE-2010-3812", "CVE-2010-3813", "CVE-2010-3999", "CVE-2010-4042", "CVE-2010-4197", "CVE-2010-4198", "CVE-2010-4204", "CVE-2010-4206", "CVE-2010-4492", "CVE-2010-4493", "CVE-2010-4577", "CVE-2010-4578", "CVE-2011-0007", "CVE-2011-0465", "CVE-2011-0482", "CVE-2011-0721", "CVE-2011-0727", "CVE-2011-0904", "CVE-2011-0905", "CVE-2011-1072", "CVE-2011-1097", "CVE-2011-1144", "CVE-2011-1425", "CVE-2011-1572", "CVE-2011-1760", "CVE-2011-1951", "CVE-2011-2471", "CVE-2011-2472", "CVE-2011-2473", "CVE-2011-2524", "CVE-2011-3365", "CVE-2011-3366", "CVE-2011-3367");
  script_bugtraq_id(25297, 37081, 37395, 41148, 41976, 42033, 42034, 42035, 42036, 42037, 42038, 42041, 42042, 42043, 42044, 42045, 42046, 42049, 43047, 43079, 43081, 43083, 43672, 44204, 44206, 44241, 44349, 44359, 44563, 44954, 44960, 45170, 45390, 45715, 45718, 45719, 45720, 45721, 45722, 45788, 46426, 46473, 46605, 47063, 47064, 47135, 47189, 47650, 47652, 47681, 47800, 48241, 48926, 49925);
  script_xref(name:"GLSA", value:"201412-09");
  script_xref(name:"IAVA", value:"2017-A-0098");

  script_name(english:"GLSA-201412-09 : Multiple packages, Multiple vulnerabilities fixed in 2011");
  script_summary(english:"Checks for updated package(s) in /var/db/pkg");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Gentoo host is missing one or more security-related
patches."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The remote host is affected by the vulnerability described in GLSA-201412-09
(Multiple packages, Multiple vulnerabilities fixed in 2011)

    Vulnerabilities have been discovered in the packages listed below.
      Please review the CVE identifiers in the Reference section for details.
      FMOD Studio
      PEAR Mail
      LVM2
      GnuCash
      xine-lib
      Last.fm Scrobbler
      WebKitGTK+
      shadow tool suite
      PEAR
      unixODBC
      Resource Agents
      mrouted
      rsync
      XML Security Library
      xrdb
      Vino
      OProfile
      syslog-ng
      sFlow Toolkit
      GNOME Display Manager
      libsoup
      CA Certificates
      Gitolite
      QtCreator
      Racer
  
Impact :

    A context-dependent attacker may be able to gain escalated privileges,
      execute arbitrary code, cause Denial of Service, obtain sensitive
      information, or otherwise bypass security restrictions.
  
Workaround :

    There are no known workarounds at this time."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security.gentoo.org/glsa/201412-09"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"All FMOD Studio users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=media-libs/fmod-4.38.00'
    All PEAR Mail users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=dev-php/PEAR-Mail-1.2.0'
    All LVM2 users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=sys-fs/lvm2-2.02.72'
    All GnuCash users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=app-office/gnucash-2.4.4'
    All xine-lib users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=media-libs/xine-lib-1.1.19'
    All Last.fm Scrobbler users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose
      '>=media-sound/lastfmplayer-1.5.4.26862-r3'
    All WebKitGTK+ users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=net-libs/webkit-gtk-1.2.7'
    All shadow tool suite users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=sys-apps/shadow-4.1.4.3'
    All PEAR users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=dev-php/PEAR-PEAR-1.9.2-r1'
    All unixODBC users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=dev-db/unixODBC-2.3.0-r1'
    All Resource Agents users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose
      '>=sys-cluster/resource-agents-1.0.4-r1'
    All mrouted users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=net-misc/mrouted-3.9.5'
    All rsync users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=net-misc/rsync-3.0.8'
    All XML Security Library users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=dev-libs/xmlsec-1.2.17'
    All xrdb users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=x11-apps/xrdb-1.0.9'
    All Vino users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=net-misc/vino-2.32.2'
    All OProfile users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=dev-util/oprofile-0.9.6-r1'
    All syslog-ng users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=app-admin/syslog-ng-3.2.4'
    All sFlow Toolkit users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=net-analyzer/sflowtool-3.20'
    All GNOME Display Manager users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=gnome-base/gdm-3.8.4-r3'
    All libsoup users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=net-libs/libsoup-2.34.3'
    All CA Certificates users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose
      '>=app-misc/ca-certificates-20110502-r1'
    All Gitolite users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=dev-vcs/gitolite-1.5.9.1'
    All QtCreator users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=dev-util/qt-creator-2.1.0'
    Gentoo has discontinued support for Racer. We recommend that users
      unmerge Racer:
      # emerge --unmerge 'games-sports/racer-bin'
    NOTE: This is a legacy GLSA. Updates for all affected architectures have
      been available since 2012. It is likely that your system is already no
      longer affected by these issues."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'Racer v0.5.3 Beta 5 Buffer Overflow');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:'CANVAS');
  script_cwe_id(94);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:PEAR-Mail");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:PEAR-PEAR");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:ca-certificates");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:fmod");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:gdm");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:gitolite");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:gnucash");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:lastfmplayer");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:libsoup");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:lvm2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:mrouted");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:oprofile");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:qt-creator");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:racer-bin");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:resource-agents");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:rsync");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:sflowtool");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:shadow");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:syslog-ng");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:unixODBC");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:vino");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:webkit-gtk");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:xine-lib");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:xmlsec");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:xrdb");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");

  script_set_attribute(attribute:"vuln_publication_date", value:"2007/08/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2014/12/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/12/15");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Gentoo Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("qpkg.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (qpkg_check(package:"dev-db/unixODBC", unaffected:make_list("ge 2.3.0-r1"), vulnerable:make_list("lt 2.3.0-r1"))) flag++;
if (qpkg_check(package:"sys-apps/shadow", unaffected:make_list("ge 4.1.4.3"), vulnerable:make_list("lt 4.1.4.3"))) flag++;
if (qpkg_check(package:"games-sports/racer-bin", unaffected:make_list(), vulnerable:make_list("ge 0.5.0-r1"))) flag++;
if (qpkg_check(package:"sys-cluster/resource-agents", unaffected:make_list("ge 1.0.4-r1"), vulnerable:make_list("lt 1.0.4-r1"))) flag++;
if (qpkg_check(package:"net-misc/rsync", unaffected:make_list("ge 3.0.8"), vulnerable:make_list("lt 3.0.8"))) flag++;
if (qpkg_check(package:"sys-fs/lvm2", unaffected:make_list("ge 2.02.72"), vulnerable:make_list("lt 2.02.72"))) flag++;
if (qpkg_check(package:"app-office/gnucash", unaffected:make_list("ge 2.4.4"), vulnerable:make_list("lt 2.4.4"))) flag++;
if (qpkg_check(package:"dev-util/qt-creator", unaffected:make_list("ge 2.1.0"), vulnerable:make_list("lt 2.1.0"))) flag++;
if (qpkg_check(package:"dev-vcs/gitolite", unaffected:make_list("ge 1.5.9.1"), vulnerable:make_list("lt 1.5.9.1"))) flag++;
if (qpkg_check(package:"app-misc/ca-certificates", unaffected:make_list("ge 20110502-r1"), vulnerable:make_list("lt 20110502-r1"))) flag++;
if (qpkg_check(package:"net-analyzer/sflowtool", unaffected:make_list("ge 3.20"), vulnerable:make_list("lt 3.20"))) flag++;
if (qpkg_check(package:"net-libs/libsoup", unaffected:make_list("ge 2.34.3"), vulnerable:make_list("lt 2.34.3"))) flag++;
if (qpkg_check(package:"x11-apps/xrdb", unaffected:make_list("ge 1.0.9"), vulnerable:make_list("lt 1.0.9"))) flag++;
if (qpkg_check(package:"media-libs/fmod", unaffected:make_list("ge 4.38.00"), vulnerable:make_list("lt 4.38.00"))) flag++;
if (qpkg_check(package:"dev-libs/xmlsec", unaffected:make_list("ge 1.2.17"), vulnerable:make_list("lt 1.2.17"))) flag++;
if (qpkg_check(package:"app-admin/syslog-ng", unaffected:make_list("ge 3.2.4"), vulnerable:make_list("lt 3.2.4"))) flag++;
if (qpkg_check(package:"net-misc/mrouted", unaffected:make_list("ge 3.9.5"), vulnerable:make_list("lt 3.9.5"))) flag++;
if (qpkg_check(package:"gnome-base/gdm", unaffected:make_list("ge 3.8.4-r3"), vulnerable:make_list("lt 3.8.4-r3"))) flag++;
if (qpkg_check(package:"media-libs/xine-lib", unaffected:make_list("ge 1.1.19"), vulnerable:make_list("lt 1.1.19"))) flag++;
if (qpkg_check(package:"dev-php/PEAR-PEAR", unaffected:make_list("ge 1.9.2-r1"), vulnerable:make_list("lt 1.9.2-r1"))) flag++;
if (qpkg_check(package:"dev-php/PEAR-Mail", unaffected:make_list("ge 1.2.0"), vulnerable:make_list("lt 1.2.0"))) flag++;
if (qpkg_check(package:"dev-util/oprofile", unaffected:make_list("ge 0.9.6-r1"), vulnerable:make_list("lt 0.9.6-r1"))) flag++;
if (qpkg_check(package:"net-libs/webkit-gtk", unaffected:make_list("ge 1.2.7"), vulnerable:make_list("lt 1.2.7"))) flag++;
if (qpkg_check(package:"net-misc/vino", unaffected:make_list("ge 2.32.2"), vulnerable:make_list("lt 2.32.2"))) flag++;
if (qpkg_check(package:"media-sound/lastfmplayer", unaffected:make_list("ge 1.5.4.26862-r3"), vulnerable:make_list("lt 1.5.4.26862-r3"))) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = qpkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "dev-db/unixODBC / sys-apps/shadow / games-sports/racer-bin / etc");
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Red Hat Security Advisory RHSA-2011:1000 and 
# CentOS Errata and Security Advisory 2011:1000 respectively.
#

include("compat.inc");

if (description)
{
  script_id(56262);
  script_version("1.13");
  script_cvs_date("Date: 2019/10/25 13:36:06");

  script_cve_id("CVE-2010-3389");
  script_bugtraq_id(44359);
  script_xref(name:"RHSA", value:"2011:1000");

  script_name(english:"CentOS 5 : rgmanager (CESA-2011:1000)");
  script_summary(english:"Checks rpm output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote CentOS host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"An updated rgmanager package that fixes one security issue, several
bugs, and adds multiple enhancements is now available for Red Hat
Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low
security impact. A Common Vulnerability Scoring System (CVSS) base
score, which gives a detailed severity rating, is available from the
CVE link in the References section.

The rgmanager package contains the Red Hat Resource Group Manager,
which provides the ability to create and manage high-availability
server applications in the event of system downtime.

It was discovered that certain resource agent scripts set the
LD_LIBRARY_PATH environment variable to an insecure value containing
empty path elements. A local user able to trick a user running those
scripts to run them while working from an attacker-writable directory
could use this flaw to escalate their privileges via a
specially crafted dynamic library. (CVE-2010-3389)

Red Hat would like to thank Raphael Geissert for reporting this issue.

This update also fixes the following bugs :

* The failover domain 'nofailback' option was not honored if a service
was in the 'starting' state. This bug has been fixed. (BZ#669440)

* PID files with white spaces in the file name are now handled
correctly. (BZ#632704)

* The /usr/sbin/rhev-check.sh script can now be used from within Cron.
(BZ#634225)

* The clustat utility now reports the correct version. (BZ#654160)

* The oracledb.sh agent now attempts to try the 'shutdown immediate'
command instead of using the 'shutdown abort' command. (BZ#633992)

* The SAPInstance and SAPDatabase scripts now use proper directory
name quoting so they no longer collide with directory names like '/u'.
(BZ#637154)

* The clufindhostname utility now returns the correct value in all
cases. (BZ#592613)

* The nfsclient resource agent now handles paths with trailing slashes
correctly. (BZ#592624)

* The last owner of a service is now reported correctly after a
failover. (BZ#610483)

* The /usr/share/cluster/fs.sh script no longer runs the 'quotaoff'
command if quotas were not configured. (BZ#637678)

* The 'listen' line in the /etc/httpd/conf/httpd.conf file generated
by the Apache resource agent is now correct. (BZ#675739)

* The tomcat-5 resource agent no longer generates incorrect
configurations. (BZ#637802)

* The time required to stop an NFS resource when the server is
unavailable has been reduced. (BZ#678494)

* When using exclusive prioritization, a higher priority service now
preempts a lower priority service after status check failures.
(BZ#680256)

* The postgres-8 resource agent now correctly detects failed start
operations. (BZ#663827)

* The handling of reference counts passed by rgmanager to resource
agents now works properly, as expected. (BZ#692771)

As well, this update adds the following enhancements :

* It is now possible to disable updates to static routes by the IP
resource agent. (BZ#620700)

* It is now possible to use XFS as a file system within a cluster
service. (BZ#661893)

* It is now possible to use the 'clustat' command as a non-root user,
so long as that user is in the 'root' group. (BZ#510300)

* It is now possible to migrate virtual machines when central
processing is enabled. (BZ#525271)

* The rgmanager init script will now delay after stopping services in
order to allow time for other nodes to restart them. (BZ#619468)

* The handling of failed independent subtrees has been corrected.
(BZ#711521)

All users of Red Hat Resource Group Manager are advised to upgrade to
this updated package, which contains backported patches to correct
these issues and add these enhancements."
  );
  # https://lists.centos.org/pipermail/centos-announce/2011-September/017958.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?271005b4"
  );
  # https://lists.centos.org/pipermail/centos-announce/2011-September/017959.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?527df4dd"
  );
  # https://lists.centos.org/pipermail/centos-cr-announce/2011-September/000132.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?edde1c15"
  );
  # https://lists.centos.org/pipermail/centos-cr-announce/2011-September/000133.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?af063f2d"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected rgmanager package."
  );
  script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:rgmanager");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:5");

  script_set_attribute(attribute:"vuln_publication_date", value:"2010/10/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2011/09/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2011/09/23");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"CentOS Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/CentOS/release");
if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS");
os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS");
os_ver = os_ver[1];
if (! preg(pattern:"^5([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 5.x", "CentOS " + os_ver);

if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu);


flag = 0;
if (rpm_check(release:"CentOS-5", reference:"rgmanager-2.0.52-21.el5.centos")) flag++;


if (flag)
{
  cr_plugin_caveat = '\n' +
    'NOTE: The security advisory associated with this vulnerability has a\n' +
    'fixed package version that may only be available in the continuous\n' +
    'release (CR) repository for CentOS, until it is present in the next\n' +
    'point release of CentOS.\n\n' +

    'If an equal or higher package level does not exist in the baseline\n' +
    'repository for your major version of CentOS, then updates from the CR\n' +
    'repository will need to be applied in order to address the\n' +
    'vulnerability.\n';
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get() + cr_plugin_caveat
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "rgmanager");
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Red Hat Security Advisory RHSA-2011:1000. The text 
# itself is copyright (C) Red Hat, Inc.
#

if (NASL_LEVEL < 3000) exit(0);

include("compat.inc");

if (description)
{
  script_id(63992);
  script_version("1.11");
  script_cvs_date("Date: 2019/10/25 13:36:16");

  script_cve_id("CVE-2010-3389");
  script_bugtraq_id(44359);
  script_xref(name:"RHSA", value:"2011:1000");

  script_name(english:"RHEL 5 : rgmanager (RHSA-2011:1000)");
  script_summary(english:"Checks rpm output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Red Hat host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"An updated rgmanager package that fixes one security issue, several
bugs, and adds multiple enhancements is now available for Red Hat
Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low
security impact. A Common Vulnerability Scoring System (CVSS) base
score, which gives a detailed severity rating, is available from the
CVE link in the References section.

The rgmanager package contains the Red Hat Resource Group Manager,
which provides the ability to create and manage high-availability
server applications in the event of system downtime.

It was discovered that certain resource agent scripts set the
LD_LIBRARY_PATH environment variable to an insecure value containing
empty path elements. A local user able to trick a user running those
scripts to run them while working from an attacker-writable directory
could use this flaw to escalate their privileges via a
specially crafted dynamic library. (CVE-2010-3389)

Red Hat would like to thank Raphael Geissert for reporting this issue.

This update also fixes the following bugs :

* The failover domain 'nofailback' option was not honored if a service
was in the 'starting' state. This bug has been fixed. (BZ#669440)

* PID files with white spaces in the file name are now handled
correctly. (BZ#632704)

* The /usr/sbin/rhev-check.sh script can now be used from within Cron.
(BZ#634225)

* The clustat utility now reports the correct version. (BZ#654160)

* The oracledb.sh agent now attempts to try the 'shutdown immediate'
command instead of using the 'shutdown abort' command. (BZ#633992)

* The SAPInstance and SAPDatabase scripts now use proper directory
name quoting so they no longer collide with directory names like '/u'.
(BZ#637154)

* The clufindhostname utility now returns the correct value in all
cases. (BZ#592613)

* The nfsclient resource agent now handles paths with trailing slashes
correctly. (BZ#592624)

* The last owner of a service is now reported correctly after a
failover. (BZ#610483)

* The /usr/share/cluster/fs.sh script no longer runs the 'quotaoff'
command if quotas were not configured. (BZ#637678)

* The 'listen' line in the /etc/httpd/conf/httpd.conf file generated
by the Apache resource agent is now correct. (BZ#675739)

* The tomcat-5 resource agent no longer generates incorrect
configurations. (BZ#637802)

* The time required to stop an NFS resource when the server is
unavailable has been reduced. (BZ#678494)

* When using exclusive prioritization, a higher priority service now
preempts a lower priority service after status check failures.
(BZ#680256)

* The postgres-8 resource agent now correctly detects failed start
operations. (BZ#663827)

* The handling of reference counts passed by rgmanager to resource
agents now works properly, as expected. (BZ#692771)

As well, this update adds the following enhancements :

* It is now possible to disable updates to static routes by the IP
resource agent. (BZ#620700)

* It is now possible to use XFS as a file system within a cluster
service. (BZ#661893)

* It is now possible to use the 'clustat' command as a non-root user,
so long as that user is in the 'root' group. (BZ#510300)

* It is now possible to migrate virtual machines when central
processing is enabled. (BZ#525271)

* The rgmanager init script will now delay after stopping services in
order to allow time for other nodes to restart them. (BZ#619468)

* The handling of failed independent subtrees has been corrected.
(BZ#711521)

All users of Red Hat Resource Group Manager are advised to upgrade to
this updated package, which contains backported patches to correct
these issues and add these enhancements."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.redhat.com/security/data/cve/CVE-2010-3389.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://rhn.redhat.com/errata/RHSA-2011-1000.html"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected rgmanager package."
  );
  script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rgmanager");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:5");

  script_set_attribute(attribute:"patch_publication_date", value:"2011/07/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2013/01/24");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2013-2019 Tenable Network Security, Inc.");
  script_family(english:"Red Hat Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);

flag = 0;
if (rpm_check(release:"RHEL5", cpu:"i386", reference:"rgmanager-2.0.52-21.el5")) flag++;
if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"rgmanager-2.0.52-21.el5")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text is (C) Scientific Linux.
#

include("compat.inc");

if (description)
{
  script_id(60961);
  script_version("1.5");
  script_cvs_date("Date: 2019/10/25 13:36:19");

  script_cve_id("CVE-2008-6552", "CVE-2010-3389");

  script_name(english:"Scientific Linux Security Update : rgmanager on SL4.x i386/x86_64");
  script_summary(english:"Checks rpm output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Scientific Linux host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Multiple insecure temporary file use flaws were discovered in
rgmanager and various resource scripts run by rgmanager. A local
attacker could use these flaws to overwrite an arbitrary file writable
by the rgmanager process (i.e. user root) with the output of rgmanager
or a resource agent via a symbolic link attack. (CVE-2008-6552)

It was discovered that certain resource agent scripts set the
LD_LIBRARY_PATH environment variable to an insecure value containing
empty path elements. A local user able to trick a user running those
scripts to run them while working from an attacker-writable directory
could use this flaw to escalate their privileges via a specially
crafted dynamic library. (CVE-2010-3389)

This update also fixes the following bugs :

  - Previously, starting threads could incorrectly include a
    reference to an exited thread if that thread exited when
    rgmanager received a request to start a new thread. Due
    to this issue, the new thread did not retry and entered
    an infinite loop. This update ensures that new threads
    do not reference old threads. Now, new threads no longer
    enter an infinite loop in which the rgmanager enables
    and disables services without failing gracefully.
    (BZ#502872)

  - Previously, nfsclient.sh left temporary
    nfsclient-status-cache-$$ files in /tmp/. (BZ#506152)

  - Previously, the function local_node_name in
    /resources/utils/member_util.sh did not correctly check
    whether magma_tool failed. Due to this issue, empty
    strings could be returned. This update checks the input
    and rejects empty strings. (BZ#516758)

  - Previously, the file system agent could kill a process
    when an application used a mount point with a similar
    name to a mount point managed by rgmanager using
    force_unmount. With this update, the file system agent
    kills only the processes that access the mount point
    managed by rgmanager. (BZ#555901)

  - Previously, simultaneous execution of 'lvchange
    --deltag' from /etc/init.d/rgmanager caused a checksum
    error on High Availability Logical Volume Manager
    (HA-LVM). With this update, ownership of LVM tags is
    checked before removing them. (BZ#559582)

  - Previously, the isAlive check could fail if two nodes
    used the same file name. With this update, the isAlive
    function prevents two nodes from using the same file
    name. (BZ#469815)

  - Previously, the S/Lang code could lead to unwanted
    S/Lang stack leaks during event processing. (BZ#507430)"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=469815"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=502872"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=506152"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=507430"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=516758"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=555901"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=559582"
  );
  # https://listserv.fnal.gov/scripts/wa.exe?A2=ind1102&L=scientific-linux-errata&T=0&P=2573
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?3312c7c6"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected rgmanager package."
  );
  script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C");
  script_cwe_id(59);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"x-cpe:/o:fermilab:scientific_linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2011/02/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/01");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Scientific Linux Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Scientific Linux " >!< release) audit(AUDIT_HOST_NOT, "running Scientific Linux");
if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Scientific Linux", cpu);


flag = 0;
if (rpm_check(release:"SL4", reference:"rgmanager-1.9.88-2.el4")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Gentoo Linux Security Advisory GLSA 201110-18.
#
# The advisory text is Copyright (C) 2001-2015 Gentoo Foundation, Inc.
# and licensed under the Creative Commons - Attribution / Share Alike 
# license. See http://creativecommons.org/licenses/by-sa/3.0/
#

include("compat.inc");

if (description)
{
  script_id(56593);
  script_version("1.7");
  script_cvs_date("Date: 2018/07/11 17:09:26");

  script_cve_id("CVE-2010-3389");
  script_bugtraq_id(44359);
  script_xref(name:"GLSA", value:"201110-18");

  script_name(english:"GLSA-201110-18 : rgmanager: Privilege escalation");
  script_summary(english:"Checks for updated package(s) in /var/db/pkg");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Gentoo host is missing one or more security-related
patches."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The remote host is affected by the vulnerability described in GLSA-201110-18
(rgmanager: Privilege escalation)

    A vulnerability has been discovered in rgmanager. Please review the CVE
      identifier referenced below for details.
  
Impact :

    A local attacker could gain escalated privileges.
  
Workaround :

    There is no known workaround at this time."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security.gentoo.org/glsa/201110-18"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"All rgmanager users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose
      '>=sys-cluster/rgmanager-2.03.09-r1'"
  );
  script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:rgmanager");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2011/10/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2011/10/24");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2011-2018 Tenable Network Security, Inc.");
  script_family(english:"Gentoo Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("qpkg.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (qpkg_check(package:"sys-cluster/rgmanager", unaffected:make_list("ge 2.03.09-r1"), vulnerable:make_list("lt 2.03.09-r1"))) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = qpkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "rgmanager");
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text is (C) Scientific Linux.
#

include("compat.inc");

if (description)
{
  script_id(61196);
  script_version("1.6");
  script_cvs_date("Date: 2019/10/25 13:36:20");

  script_cve_id("CVE-2010-3389");

  script_name(english:"Scientific Linux Security Update : resource-agents on SL6.x i386/x86_64");
  script_summary(english:"Checks rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Scientific Linux host is missing one or more security
updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The resource-agents package contains a set of scripts to interface
with several services to operate in a High Availability environment
for both Pacemaker and rgmanager service managers.

It was discovered that certain resource agent scripts set the
LD_LIBRARY_PATH environment variable to an insecure value containing
empty path elements. A local user able to trick a user running those
scripts to run them while working from an attacker-writable directory
could use this flaw to escalate their privileges via a specially
crafted dynamic library. (CVE-2010-3389)

This update also fixes the following bugs :

  - When using the Sybase database and the ASEHAagent
    resource in the cluster.conf file, it was not possible
    to run more than one ASEHAagent per Sybase installation.
    Consequently, a second ASEHA (Sybase Adaptive Server
    Enterprise (ASE) with the High Availability Option)
    agent could not be run. This bug has been fixed and it
    is now possible to use two ASEHA agents using the same
    Sybase installation.

  - The s/lang scripts, which implement internal
    functionality for the rgmanager package, while the
    central_processing option is in use, were included in
    the wrong package. Now, the rgmanager and
    resource-agents packages require each other for
    installation to prevent problems when they are used
    separately.

  - Previously, the oracledb.sh script was using the
    'shutdown abort' command as the first attempt to shut
    down a database. With this update, oracledb.sh first
    attempts a graceful shutdown via the 'shutdown
    immediate' command before forcing the shutdown.

  - Previously, when setting up a service on a cluster with
    a shared IP resource and an Apache resource, the
    generated httpd.conf file contained a bug in the line
    describing the shared IP address (the 'Listen' line).
    Now, the Apache resource agent generates the 'Listen'
    line properly.

  - If a high-availability (HA) cluster service was defined
    with an Apache resource and was named with two words,
    such as 'kickstart httpd', the service never started
    because it could not find a directory with the space
    character in its name escaped. Now, Apache resources
    work properly if a name contains a space as described
    above.

  - When inheritance was used in the cluster.conf file, a
    bug in the /usr/share/cluster/nfsclient.sh file
    prevented it from monitoring NFS exports properly.
    Consequently, monitoring of NFS exports to NFS clients
    resulted in an endless loop. This bug has been fixed and
    the monitoring now works as expected.

  - Previously, the postgres-8 resource agent did not detect
    when a PostgreSQL server failed to start. This bug has
    been fixed and postgres-8 now works as expected in the
    described scenario.

  - When using the Pacemaker resource manager, the fs.sh
    resource agent reported an error condition, if called
    with the 'monitor' parameter and the referenced device
    did not exist. Consequently, the error condition
    prevented the resource from being started. Now, fs.sh
    returns the proper response code in the described
    scenario, thus fixing this bug.

  - Previously, numerous RGManager resource agents returned
    incorrect response codes when coupled with the Pacemaker
    resource manager. Now, the agents have been updated to
    work with Pacemaker properly.

This update also adds the following enhancement :

  - With this update, when the network is removed from a
    node using the netfs.sh resource agent, it now recovers
    faster than previously.

As well, this update upgrades the resource-agents package to upstream
version 3.9.2, which provides a number of bug fixes and enhancements
over the previous version.

All users of resource-agents are advised to upgrade to this updated
package, which corrects these issues and adds these enhancements."
  );
  # https://listserv.fnal.gov/scripts/wa.exe?A2=ind1112&L=scientific-linux-errata&T=0&P=1684
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?c61ce342"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"Update the affected resource-agents and / or resource-agents-debuginfo
packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"x-cpe:/o:fermilab:scientific_linux");

  script_set_attribute(attribute:"vuln_publication_date", value:"2010/10/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2011/12/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/01");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Scientific Linux Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Scientific Linux " >!< release) audit(AUDIT_HOST_NOT, "running Scientific Linux");
if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Scientific Linux", cpu);


flag = 0;
if (rpm_check(release:"SL6", reference:"resource-agents-3.9.2-7.el6")) flag++;
if (rpm_check(release:"SL6", reference:"resource-agents-debuginfo-3.9.2-7.el6")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text is (C) Scientific Linux.
#

include("compat.inc");

if (description)
{
  script_id(61091);
  script_version("1.6");
  script_cvs_date("Date: 2019/10/25 13:36:19");

  script_cve_id("CVE-2010-3389");

  script_name(english:"Scientific Linux Security Update : rgmanager on SL5.x i386/x86_64");
  script_summary(english:"Checks rpm output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Scientific Linux host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The rgmanager package contains the Resource Group Manager, which
provides the ability to create and manage high-availability server
applications in the event of system downtime.

It was discovered that certain resource agent scripts set the
LD_LIBRARY_PATH environment variable to an insecure value containing
empty path elements. A local user able to trick a user running those
scripts to run them while working from an attacker-writable directory
could use this flaw to escalate their privileges via a specially
crafted dynamic library. (CVE-2010-3389)

This update also fixes the following bugs :

  - The failover domain 'nofailback' option was not honored
    if a service was in the 'starting' state. This bug has
    been fixed.

  - PID files with white spaces in the file name are now
    handled correctly.

  - The /usr/sbin/rhev-check.sh script can now be used from
    within Cron.

  - The clustat utility now reports the correct version.

  - The oracledb.sh agent now attempts to try the 'shutdown
    immediate' command instead of using the 'shutdown abort'
    command.

  - The SAPInstance and SAPDatabase scripts now use proper
    directory name quoting so they no longer collide with
    directory names like '/u'.

  - The clufindhostname utility now returns the correct
    value in all cases.

  - The nfsclient resource agent now handles paths with
    trailing slashes correctly.

  - The last owner of a service is now reported correctly
    after a failover.

  - The /usr/share/cluster/fs.sh script no longer runs the
    'quotaoff' command if quotas were not configured.

  - The 'listen' line in the /etc/httpd/conf/httpd.conf file
    generated by the Apache resource agent is now correct.

  - The tomcat-5 resource agent no longer generates
    incorrect configurations.

  - The time required to stop an NFS resource when the
    server is unavailable has been reduced.

  - When using exclusive prioritization, a higher priority
    service now preempts a lower priority service after
    status check failures.

  - The postgres-8 resource agent now correctly detects
    failed start operations.

  - The handling of reference counts passed by rgmanager to
    resource agents now works properly, as expected.

As well, this update adds the following enhancements :

  - It is now possible to disable updates to static routes
    by the IP resource agent.

  - It is now possible to use XFS as a file system within a
    cluster service.

  - It is now possible to use the 'clustat' command as a
    non-root user, so long as that user is in the 'root'
    group.

  - It is now possible to migrate virtual machines when
    central processing is enabled.

  - The rgmanager init script will now delay after stopping
    services in order to allow time for other nodes to
    restart them.

  - The handling of failed independent subtrees has been
    corrected.

All users of Resource Group Manager are advised to upgrade to this
updated package, which contains backported patches to correct these
issues and add these enhancements."
  );
  # https://listserv.fnal.gov/scripts/wa.exe?A2=ind1108&L=scientific-linux-errata&T=0&P=788
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?a157718a"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected rgmanager package."
  );
  script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"x-cpe:/o:fermilab:scientific_linux");

  script_set_attribute(attribute:"vuln_publication_date", value:"2010/10/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2011/07/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/01");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Scientific Linux Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Scientific Linux " >!< release) audit(AUDIT_HOST_NOT, "running Scientific Linux");
if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Scientific Linux", cpu);


flag = 0;
if (rpm_check(release:"SL5", reference:"rgmanager-2.0.52-21.el5")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");