CVE-2008-6560 : Buffer overflow in CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9 and R

Buffer overflow in CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9 and Red Hat Enterprise Linux (RHEL) 5 allows attackers to cause a denial of service (CPU consumption and memory corruption) via a cluster.conf file with many lines. NOTE: it is not clear whether this issue crosses privilege boundaries in realistic uses of the product.

Published 2009-03-31 14:09:53

Updated 2025-04-09 00:30:58

Source MITRE

View at NVD, CVE.org

Vulnerability category: OverflowMemory CorruptionDenial of service

Products affected by CVE-2008-6560

Redhat » Cman
Versions up to, including, (<=) 2.03.08-1
cpe:2.3:a:redhat:cman:*:*:*:*:*:*:*:*
Matching versions
When used together with: Redhat » Fedora » Version: 9
When used together with: Redhat » Linux » Version: 5.0 Enterprise Edition
Redhat » Cman » Version: 2.03.04-1
cpe:2.3:a:redhat:cman:2.03.04-1:*:*:*:*:*:*:*
Matching versions
When used together with: Redhat » Fedora » Version: 9
When used together with: Redhat » Linux » Version: 5.0 Enterprise Edition
Redhat » Cman » Version: 2.03.03-1
cpe:2.3:a:redhat:cman:2.03.03-1:*:*:*:*:*:*:*
Matching versions
When used together with: Redhat » Fedora » Version: 9
When used together with: Redhat » Linux » Version: 5.0 Enterprise Edition
Redhat » Cman » Version: 2.03.07-1
cpe:2.3:a:redhat:cman:2.03.07-1:*:*:*:*:*:*:*
Matching versions
When used together with: Redhat » Fedora » Version: 9
When used together with: Redhat » Linux » Version: 5.0 Enterprise Edition
Redhat » Cman » Version: 2.03.05-1
cpe:2.3:a:redhat:cman:2.03.05-1:*:*:*:*:*:*:*
Matching versions
When used together with: Redhat » Fedora » Version: 9
When used together with: Redhat » Linux » Version: 5.0 Enterprise Edition

Exploit prediction scoring system (EPSS) score for CVE-2008-6560

EPSS FAQ

1.03%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 75 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2008-6560

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.8	HIGH	AV:N/AC:L/Au:N/C:N/I:N/A:C	10.0	6.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Complete

CWE ids for CVE-2008-6560

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Assigned by: nvd@nist.gov (Primary)

Vendor statements for CVE-2008-6560

Red Hat 2009-08-04

Red Hat does not consider this to be a security issue. The misbehaviour of CMAN is triggered by corrupted / specially crafted cluster.conf configuration file. Ability to edit this file is restricted to system administrator, therefore no privilege boundary is crossed.

References for CVE-2008-6560