[ GLSA 201412-15 ] MCollective: Privilege escalation

[GLSA]

Gentoo Linux Security Advisory

Title: MCollective: Privilege escalation (GLSA 201412-15)
Severity: normal
Exploitable: local
Date: December 13, 2014
Bug(s): #513292, #517286
ID: 201412-15

Synopsis

Two vulnerabilities have been found in MCollective, the worst of
which could lead to privilege escalation.


Background

MCollective is a framework to build server orchestration or parallel job
execution systems.


Affected Packages

Package: app-admin/mcollective
Vulnerable: < 2.5.3
Unaffected: >= 2.5.3
Architectures: All supported architectures


Description

Two vulnerabilities have been found in MCollective:

• An untrusted search path vulnerability exists in MCollective
  (CVE-2014-3248)
  
• MCollective does not properly validate server certificates
  (CVE-2014-3251)
  

Impact

A local attacker can execute arbitrary a Trojan horse shared library,
potentially resulting in arbitrary code execution and privilege
escalation. Furthermore, a local attacker may be able to establish
unauthorized MCollective connections.


Workaround

There is no known workaround at this time.

Resolution

All MCollective users should upgrade to the latest version: