In the vrrpipsetshandler handler (fglobalparser.c) of keepalived through 2.3.1, an integer overflow can occur. NOTE: this CVE Record might not be worthwhile because an empty ipset name must be configured by the user.

In the vrrpipsetshandler handler (fglobalparser.c) of keepalived through 2.3.1, an integer overflow can occur. NOTE: this CVE Record might not be worthwhile because an empty ipset name must be configured by the user.

In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any property. This leads to access-control bypass in some situations in which an unrelated D-Bus system service has a settable (writable) property

keepalived 2.0.8 used mode 0666 when creating new temporary files upon a call to PrintData or PrintStats, potentially leaking sensitive information.

keepalived 2.0.8 didn't check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats. This allowed local users to overwrite arbitrary files if fs.protectedsymlinks is set to 0, as demonstrated by a symlink from /tmp/keepalived.data or /tmp/keepalived.stats to /etc/passwd.

keepalived before 2.0.7 has a heap-based buffer overflow when parsing HTTP status codes resulting in DoS or possibly unspecified other impact, because extractstatuscode in lib/html.c has no validation of the status code and instead writes an unlimited amount of data to the heap.

keepalived 2.0.8 didn't check for existing plain files when writing data to a temporary file upon a call to PrintData or PrintStats. If a local attacker had previously created a file with the expected name (e.g., /tmp/keepalived.data or /tmp/keepalived.stats), with read access for the attacker and write access for the keepalived process, then this potentially leaked sensitive information.

It was reported [1] that keepalived wrote its PID files in /var/run as world-writable files. This could allow an unprivileged user to change the referenced PID in the PID file, and upon a service restart or stop of keepalived, would kill the other process.

The keepalived daemonize code explicitly sets umask(0) which is the root cause of this flaw, so PID file creation should probably contain an explicit permissions settings.

For instance, as root:

service keepalived status keepalived (pid 9634) is running... cat /var/run/keepalived.pid 9634 ls -al /var/run/keepalived.pid -rw-rw-rw- 1 root root 5 May 10 15:13 /var/run/keepalived.pid

Then as an unprivileged user:

% echo $(ps ax|grep sshd|grep -v grep|cut -d ' ' -f 2) >/var/run/keepalived.pid % cat /var/run/keepalived.pid 1638

Back to root:

service keepalived status keepalived (pid 1638) is running... service keepalived stop Stopping keepalived: [ OK ] service sshd status openssh-daemon is stopped ps ax|grep sshd|grep -v grep ps ax|grep keepalived|grep -v grep 9634 ? Ss 0:00 /usr/sbin/keepalived -D 9636 ? S 0:00 /usr/sbin/keepalived -D 9637 ? S 0:00 /usr/sbin/keepalived -D

[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=626281

It was reported [1] that keepalived wrote its PID files in /var/run as world-writable files. This could allow an unprivileged user to change the referenced PID in the PID file, and upon a service restart or stop of keepalived, would kill the other process.

The keepalived daemonize code explicitly sets umask(0) which is the root cause of this flaw, so PID file creation should probably contain an explicit permissions settings.

For instance, as root:

service keepalived status keepalived (pid 9634) is running... cat /var/run/keepalived.pid 9634 ls -al /var/run/keepalived.pid -rw-rw-rw- 1 root root 5 May 10 15:13 /var/run/keepalived.pid

Then as an unprivileged user:

% echo $(ps ax|grep sshd|grep -v grep|cut -d ' ' -f 2) >/var/run/keepalived.pid % cat /var/run/keepalived.pid 1638

Back to root:

service keepalived status keepalived (pid 1638) is running... service keepalived stop Stopping keepalived: [ OK ] service sshd status openssh-daemon is stopped ps ax|grep sshd|grep -v grep ps ax|grep keepalived|grep -v grep 9634 ? Ss 0:00 /usr/sbin/keepalived -D 9636 ? S 0:00 /usr/sbin/keepalived -D 9637 ? S 0:00 /usr/sbin/keepalived -D

[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=626281