Description
Buffer overflow in cluster/cman/daemon/daemon.c in cman (redhat-cluster-suite) before 20070622 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via long client messages.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | cman +1 | 2.0.64-1.0.1.el5 | RHSA-2007:0559 |
Advisories 1
- RHSA-2007:0559 Red Hat Security Advisory: cman security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- clusterproject-processclient-bo(35034) vdb-entry
- http://sourceware.org/cgi-bin/cvsweb.cgi/cluster/cman/daemon/daemon.c.diff?cvsroot=cluster&r1=1.34&r2=1.35
- 25818 third-party-advisory
- 25886 third-party-advisory
- oval:org.mitre.oval:def:9524 vdb-entry signature
- 24595 vdb-entry
- 1018323 vdb-entry
- RHSA-2007:0559 vendor-advisory
- 37497 vdb-entry
- USN-476-1 vendor-advisory
- https://launchpad.net/bugs/121780
- [cluster-devel] 20070619 cluster/cman/daemon daemon.c mailing-list
- 25799 third-party-advisory