Several format string bugs in heartbeat were reported to us during the weekend.
Most of them cannot be exploited except when running heartbeat in debug mode.
However, there is one such bug that can be exploited by _anyone_ as long as
he can send a packet to the heartbeat daemon. Exploiting this bug will give
remote attackers root privilege on the victim host.

I believe (and lmb as well as heartbeat's developer, Alan Robertson) agree that
we should at least fix the latter bug in UnitedLinux. The fix is a one-liner.
I have already built binary RPMs with this one-line fix and given them to
Alan Robertson for testing. He ran a stress-test with 1000 fail-overs on the
fixed package.

The one-line patch looks like this:

        if ((namelen = strcspn(nvline, EQUAL)) <= 0
        ||      nvline[namelen] != '=') {
                ha_log(LOG_WARNING, "ha_msg_add_nv: line doesn't contain '='");
-               ha_log(LOG_INFO, nvline);
+               ha_log(LOG_INFO, "%s", nvline);
                return(HA_FAIL);
        }

Which I hope is trivial enough to accept the fix at this stage.

The remaining format string bugs will be fixed via a securiy update we will
publish soon.