Hello,

I cannot process the security update due to dependencies issues: 'Error: 
Missing Dependency: device-mapper >= 1.02.39-1.el5_5.1 is needed by 
package lvm2-2.02.56-8.el5_5.6.x86_64 (sl-security)'.

Device-mapper (i386 and 86_64) are installed:

rpm -qa device-mapper
device-mapper-1.02.39-1.el5.x86_64
device-mapper-1.02.39-1.el5.i386

Package-cleanup --problems does not report any flaw ...


I'm running SL 5.5  on the following configuration:  2.6.18-194.8.1.el5 
#1 SMP Thu Jul 1 16:05:53 EDT 2010 x86_64 x86_64 x86_64 GNU/Linux.



Best regards,




Le 01.08.2010 06:29, Connie Sieh a écrit :
>
> Issue date:        2010-07-28
> CVE Names:         CVE-2010-2526
> Description:
>
> It was discovered that the cluster logical volume manager daemon (clvmd)
> did not verify the credentials of clients connecting to its control UNIX
> abstract socket, allowing local, unprivileged users to send control
> commands that were intended to only be available to the privileged root
> user. This could allow a local, unprivileged user to cause clvmd to exit,
> or request clvmd to activate, deactivate, or reload any logical volume on
> the local system or another system in the cluster. (CVE-2010-2526)
>
> Note: This update changes clvmd to use a pathname-based socket rather 
> than
> an abstract socket. As such, the lvm2 update 2010:0569, which changes
> LVM to also use this pathname-based socket, must also be installed for 
> LVM
> to be able to communicate with the updated clvmd.
>
> All lvm2-cluster users should upgrade to this updated package, which
> contains a backported patch to correct this issue. After installing the
> updated package, clvmd must be restarted for the update to take effect.
>
> 5. Bugs fixed
>
>  CVE-2010-2526 lvm2-cluster: insecurity when communicating between 
> lvm2 and clvmd
>
> 6. Package List:
>
> SRPM:
>   lvm2-cluster-2.02.56-7.el5_5.4.src.rpm
>
> i386:
>   lvm2-cluster-2.02.56-7.el5_5.4.i386.rpm
>
> x86_64:
>   lvm2-cluster-2.02.56-7.el5_5.4.x86_64.rpm
>
>
> lvm2 update included because of dependency.
>
> i386:
>   lvm2-2.02.56-8.el5_5.6.i386.rpm
> x86_64:
>   lvm2-2.02.56-8.el5_5.6.x86_64.rpm
>
> -Connie Sieh
> -Troy Dawson