keepalived: denial of service [LWN.net]

Package(s):

keepalived

CVE #(s):

CVE-2011-1784

Created:

July 10, 2012

Updated:

April 10, 2013

Description:

From the CVE entry:

The pidfile_write function in core/pidfile.c in keepalived 1.2.2 and earlier uses 0666 permissions for the (1) keepalived.pid, (2) checkers.pid, and (3) vrrp.pid files in /var/run/, which allows local users to kill arbitrary processes by writing a PID to one of these files.

Alerts:

Gentoo	201207-07	2012-07-09
Mageia	MGASA-2012-0188	2012-08-02
Fedora	FEDORA-2012-12377	2012-09-04
Fedora	FEDORA-2012-12367	2012-09-04
Mandriva	MDVSA-2013:096	2013-04-10

(Log in to post comments)