Gentoo Archives: gentoo-announce

From: Raphael Marichez <falco@g.o>
To: gentoo-announce@g.o
Cc: bugtraq@×××××××××××××.com, full-disclosure@××××××××××××××.uk, security-alerts@×××××××××××××.com
Subject: [gentoo-announce] [ GLSA 200704-04 ] OpenPBS: Multiple vulnerabilities
Date: Tue, 03 Apr 2007 23:14:52
Message-Id: 20070403224630.GE5998@falco.falcal.net
1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2 Gentoo Linux Security Advisory GLSA 200704-04
3 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4 http://security.gentoo.org/
5 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7 Severity: High
8 Title: OpenPBS: Multiple vulnerabilities
9 Date: April 03, 2007
10 Bugs: #153495
11 ID: 200704-04
12
13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15 Synopsis
16 ========
17
18 OpenPBS contains unspecified vulnerabilities which may allow for the
19 remote execution of arbitrary code or a Denial of Service.
20
21 Background
22 ==========
23
24 OpenPBS is the original version of the Portable Batch System. It is a
25 flexible batch queueing system developed for NASA in the early to
26 mid-1990s.
27
28 Affected packages
29 =================
30
31 -------------------------------------------------------------------
32 Package / Vulnerable / Unaffected
33 -------------------------------------------------------------------
34 1 sys-cluster/openpbs <= 2.3.16-r4 Vulnerable!
35 -------------------------------------------------------------------
36 NOTE: Certain packages are still vulnerable. Users should migrate
37 to another package if one is available or wait for the
38 existing packages to be marked stable by their
39 architecture maintainers.
40
41 Description
42 ===========
43
44 SUSE reported vulnerabilities due to unspecified errors in OpenPBS.
45
46 Impact
47 ======
48
49 By unspecified attack vectors an attacker might be able execute
50 arbitrary code with the privileges of the user running openpbs, which
51 might be the root user.
52
53 Workaround
54 ==========
55
56 There is no known workaround at this time.
57
58 Resolution
59 ==========
60
61 OpenPBS has been masked in the Portage tree for replacement by Torque.
62 All OpenPBS users should unmerge OpenPBS and switch to Torque.
63
64
65 # emerge --ask --unmerge sys-cluster/openpbs
66 # emerge --sync
67 # emerge --ask --verbose sys-cluster/torque
68
69 References
70 ==========
71
72 [ 1 ] CVE-2006-5616
73 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5616
74
75 Availability
76 ============
77
78 This GLSA and any updates to it are available for viewing at
79 the Gentoo Security Website:
80
81 http://security.gentoo.org/glsa/glsa-200704-04.xml
82
83 Concerns?
84 =========
85
86 Security is a primary focus of Gentoo Linux and ensuring the
87 confidentiality and security of our users machines is of utmost
88 importance to us. Any security concerns should be addressed to
89 security@g.o or alternatively, you may file a bug at
90 http://bugs.gentoo.org.
91
92 License
93 =======
94
95 Copyright 2007 Gentoo Foundation, Inc; referenced text
96 belongs to its owner(s).
97
98 The contents of this document are licensed under the
99 Creative Commons - Attribution / Share Alike license.
100
101 http://creativecommons.org/licenses/by-sa/2.5