Joined: 12 May 2004
|Posted: Tue Jul 10, 2012 5:26 am Post subject: [ GLSA 201207-07 ] Keepalived: Denial of Service
|Gentoo Linux Security Advisory
Title: Keepalived: Denial of Service (GLSA 201207-07)
Date: July 09, 2012
Keepalived uses world-writable PID files, allowing a local attacker
to kill arbitrary processes.
Keepalived is a strong & robust keepalive facility to the Linux
Virtual Server project.
Vulnerable: < 1.2.2-r3
Unaffected: >= 1.2.2-r3
Architectures: All supported architectures
The "pidfile_write()" function in pidfile.c in Keepalived writes PID
files with insecure permissions.
A local attacker may be able to cause a Denial of Service of arbitrary
There is no known workaround at this time.
All Keepalived users should upgrade to the latest version:
|# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-cluster/keepalived-1.2.2-r3"