RHSA-2010:0567: Moderate: lvm2-cluster security update

First published: Wed Jul 28 2010(Updated: )

The lvm2-cluster package contains support for Logical Volume Management<br>(LVM) in a clustered environment.<br>It was discovered that the cluster logical volume manager daemon (clvmd)<br>did not verify the credentials of clients connecting to its control UNIX<br>abstract socket, allowing local, unprivileged users to send control<br>commands that were intended to only be available to the privileged root<br>user. This could allow a local, unprivileged user to cause clvmd to exit,<br>or request clvmd to activate, deactivate, or reload any logical volume on<br>the local system or another system in the cluster. (CVE-2010-2526)<br>Note: This update changes clvmd to use a pathname-based socket rather than<br>an abstract socket. As such, the lvm2 update RHBA-2010:0569, which changes<br>LVM to also use this pathname-based socket, must also be installed for LVM<br>to be able to communicate with the updated clvmd.<br>All lvm2-cluster users should upgrade to this updated package, which<br>contains a backported patch to correct this issue. After installing the<br>updated package, clvmd must be restarted for the update to take effect.<br>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-errata
• anchor-id/RHSA-2010:0567
• agent/title
• agent/severity
• agent/references
• agent/tags
• agent/type
• agent/event
• agent/description
• agent/remedy
• agent/last-modified-date
• agent/softwarecombine
• agent/first-publish-date
• package-manager/redhat