Joined: 12 May 2004
|Posted: Sat Dec 13, 2014 7:26 pm Post subject: [ GLSA 201412-15 ] MCollective: Privilege escalation
|Gentoo Linux Security Advisory
Title: MCollective: Privilege escalation (GLSA 201412-15)
Date: December 13, 2014
Bug(s): #513292, #517286
Two vulnerabilities have been found in MCollective, the worst of
which could lead to privilege escalation.
MCollective is a framework to build server orchestration or parallel job
Vulnerable: < 2.5.3
Unaffected: >= 2.5.3
Architectures: All supported architectures
Two vulnerabilities have been found in MCollective:
- An untrusted search path vulnerability exists in MCollective
- MCollective does not properly validate server certificates
A local attacker can execute arbitrary a Trojan horse shared library,
potentially resulting in arbitrary code execution and privilege
escalation. Furthermore, a local attacker may be able to establish
unauthorized MCollective connections.
There is no known workaround at this time.
All MCollective users should upgrade to the latest version:
|# emerge --sync
# emerge --ask --oneshot --verbose ">=app-admin/mcollective-2.5.3"