[ GLSA 201207-07 ] Keepalived: Denial of Service

[GLSA]

Gentoo Linux Security Advisory

Title: Keepalived: Denial of Service (GLSA 201207-07)
Severity: normal
Exploitable: local
Date: July 09, 2012
Bug(s): #371469
ID: 201207-07

Synopsis

Keepalived uses world-writable PID files, allowing a local attacker
to kill arbitrary processes.


Background

Keepalived is a strong & robust keepalive facility to the Linux
Virtual Server project.


Affected Packages

Package: sys-cluster/keepalived
Vulnerable: < 1.2.2-r3
Unaffected: >= 1.2.2-r3
Architectures: All supported architectures


Description

The "pidfile_write()" function in pidfile.c in Keepalived writes PID
files with insecure permissions.


Impact

A local attacker may be able to cause a Denial of Service of arbitrary
processes.


Workaround

There is no known workaround at this time.

Resolution

All Keepalived users should upgrade to the latest version: