Bug 566711

Summary:	am-utils: incorrect use of tcp_wrappers
Product:	[Fedora] Fedora	Reporter:	Tomas Hoger <thoger>
Component:	am-utils	Assignee:	Karel Zak <kzak>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	low	Docs Contact:
Priority:	low
Version:	rawhide	CC:	kzak
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	am-utils-6.1.5-16.fc13	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-04-09 03:56:20 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Tomas Hoger 2010-02-19 14:16:38 UTC

Description of problem:
am-utils' amqsvc_is_client_allowed() (amd/amq_svc.c) is based on good_client() used by nfs-utils and portmap and is affected by similar problems as described here:

  https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2008-4552#c8

With certain hosts.{allow,deny} rules, expected host access control restrictions may not be applied correctly.  The problem does not affect
configurations that has deny:ALL and only allow access for specific hosts /
networks.

Version-Release number of selected component (if applicable):
am-utils-6.1.5-14.fc12

Additional info:
This was reported upstream (Erez Zadok) some months ago, but got no reply.

Comment 1 Karel Zak 2010-02-19 14:57:05 UTC

(In reply to comment #0)
> This was reported upstream (Erez Zadok) some months ago, but got no reply.    

 It's better to use upstream mailing list (am-utils.sunysb.edu) where is some activity in last months.

Comment 2 Tomas Hoger 2010-02-19 20:04:35 UTC

Can you pass the info to the list?  Bug referenced in comment #0 should have enough info about the issues, and the nfs-utils fix should be applicable to am-utils with minimal changes.

Comment 3 Karel Zak 2010-02-26 23:25:26 UTC

(In reply to comment #2)
> Can you pass the info to the list?  

 I have sent a patch and all information to the list. We will see...

Comment 4 Fedora Update System 2010-03-01 22:33:13 UTC

am-utils-6.1.5-16.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/am-utils-6.1.5-16.fc13

Comment 5 Fedora Update System 2010-03-02 16:24:30 UTC

am-utils-6.1.5-16.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/am-utils-6.1.5-16.fc13

Comment 6 Fedora Update System 2010-03-02 16:27:18 UTC

am-utils-6.1.5-16.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/am-utils-6.1.5-16.fc13

Comment 7 Fedora Update System 2010-03-03 08:14:23 UTC

am-utils-6.1.5-16.fc13 has been pushed to the Fedora 13 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update am-utils'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F13/FEDORA-2010-3494

Comment 8 Fedora Update System 2010-04-09 03:56:15 UTC

am-utils-6.1.5-16.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.