piranha security update

CentOS Errata and Security Advisory CESA-2014:0175

Piranha provides high-availability and load-balancing services for Red Hat
Enterprise Linux. The piranha packages contain various tools to administer
and configure the Linux Virtual Server (LVS), as well as the heartbeat and
failover components. LVS is a dynamically-adjusted kernel routing mechanism
that provides load balancing, primarily for Web and FTP servers.

It was discovered that the Piranha Configuration Tool did not properly
restrict access to its web pages. A remote attacker able to connect to the
Piranha Configuration Tool web server port could use this flaw to read or
modify the LVS configuration without providing valid administrative
credentials. (CVE-2013-6492)

This update also fixes the following bug:

• When the lvsd service attempted to start, the sem_timedwait() function
  received the interrupted function call (EINTR) error and exited, causing
  the lvsd service to fail to start. With this update, EINTR errors are
  correctly ignored during the start-up of the lvsd service. (BZ#1055709)

All piranha users are advised to upgrade to this updated package, which
contains backported patches to correct these issues.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2014-February/082319.html

Affected packages:
piranha

Upstream details at:
https://access.redhat.com/errata/RHSA-2014:0175