----------------------------------------------------------------------

Do you need accurate and reliable IDS / IPS / AV detection rules?

Get in-depth vulnerability details:
http://secunia.com/binary_analysis/sample_analysis/

----------------------------------------------------------------------

TITLE:
Cluster Project Unspecified Insecure Temporary Files

SECUNIA ADVISORY ID:
SA32602

VERIFY ADVISORY:
http://secunia.com/advisories/32602/

CRITICAL:
Less critical

IMPACT:
Privilege escalation

WHERE:
Local system

REVISION:
1.1 originally posted 2008-11-07

SOFTWARE:
Cluster Project 2.x
http://secunia.com/advisories/product/14606/

DESCRIPTION:
Some security issues have been reported in Cluster Project, which can
be exploited by malicious, local users to perform certain actions with
escalated privileges.

The security issues are caused due to unspecified scripts provided by
the CMAN, rgmanager, and gfs2 components using temporary files in an
insecure manner. This can be exploited to perform unspecified actions
with escalated privileges. 

The security issues are reported in versions prior to 2.03.09.

SOLUTION:
Update to version 2.03.09.

PROVIDED AND/OR DISCOVERED BY:
Reported via Fedora update advisories.

CHANGELOG:
2008-11-07: Updated "Description" section with information about
additionally affected components. Added links to the "Original
Advisory" section.

ORIGINAL ADVISORY:
FEDORA-2008-9458:
https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00163.html
https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00164.html
https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00165.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------