Description
The (1) SAPDatabase and (2) SAPInstance scripts in OCF Resource Agents (aka resource-agents or cluster-agents) 1.0.3 in Linux-HA place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | resource-agents | 3.9.2-7.el6 | RHSA-2011:1580 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Cluster 5 | rgmanager | 2.0.52-21.el5 | RHSA-2011:1000 |
| Red Hat Rhel Cluster 4 | rgmanager | 1.9.88-2.el4 | RHSA-2011:0264 |
Advisories 3
- RHSA-2011:1580 Red Hat Security Advisory: resource-agents security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2011:1000 Red Hat Security Advisory: rgmanager security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2011:0264 Red Hat Security Advisory: rgmanager security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=639044
- ADV-2011-0416 vdb-entry
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598549
- RHSA-2011:0264 vendor-advisory
- RHSA-2011:1000 vendor-advisory
- 43372 third-party-advisory
- RHSA-2011:1580 vendor-advisory
- GLSA-201110-18 vendor-advisory