Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of connections to the blocking sockets, which allows remote attackers to cause a denial of service (connection blocking).

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-1635 advisory.

    [1.1.10-14]
    - Log: crmd: Supply arguments in the correct order         Resolves: rhbz#996850
    - Fix: Invalid formatting of log message causes crash         Resolves: rhbz#996850

    [1.1.10-13]
    - Fix: cman: Start clvmd and friends from the init script if enabled

    [1.1.10-12]
    - Fix: Consistently use 'Slave' as the role for unpromoted master/slave resources         Resolves: rhbz#1011618
    - Fix: pengine: Location constraints with role=Started should prevent masters from running at all         Resolves: rhbz#902407
    - Fix: crm_resource: Observe --master modifier for --move         Resolves: rhbz#902407

    [1.1.10-11]     + Fix: cman: Do not start pacemaker if cman startup fails       + Fix: Fencing: Observe pcmk_host_list during automatic unfencing         Resolves: rhbz#996850

    [1.1.10-10]
    - Remove unsupported resource agent         Resolves: rhbz#1005678
    - Provide a meaningful error if --master is used for primitives and groups

    [1.1.10-9]     + Fix: xml: Location constraints are allowed to specify a role       + Bug rhbz#902407 - crm_resource: Handle --ban for master/slave resources as advertised         Resolves: rhbz#902407

    [1.1.10-8]     + Fix: mcp: Remove LSB hints that instruct chkconfig to start pacemaker at boot time         Resolves: rhbz#997346

    [1.1.10-7]     + Fencing: Support agents that need the host to be unfenced at startup         Resolves: rhbz#996850       + Fix: crm_report: Collect corosync quorum data         Resolves: rhbz#989292

    [1.1.10-6]
    - Regenerate patches to have meaningful names

    [1.1.10-5]     + Fix: systemd: Prevent glib assertion - only call g_error_free with non-NULL arguments       + Fix: systemd: Prevent additional use-of-NULL assertions in g_error_free       + Fix: logging: glib CRIT messages should not produce core files in the background       + Fix: crmd: Correcty update the history cache when recurring ops change their return code       + Log: crm_mon: Unmangle the output for failed operations       + Log: cib: Correctly log short-form xml diffs       + Log: pengine: Better indicate when a resource has failed

    [1.1.10-4]     + Fix: crmd: Prevent crash by passing log arguments in the correct order       + Fix: pengine: Do not re-allocate clone instances that are blocked in the Stopped state       + Fix: pengine: Do not allow colocation with blocked clone instances

    [1.1.10-3]     + Fix: pengine: Do not restart resources that depend on unmanaged resources       + Fix: crmd: Prevent recurring monitors being cancelled due to notify operations

    [1.1.10-2]
    - Drop rgmanager 'provides' directive

    [1.1.10-1]
    - Update source tarball to revision: Pacemaker-1.1.10
    - See included ChangeLog file or https://raw.github.com/ClusterLabs/pacemaker/master/ChangeLog for full     details

    - Resolves: rhbz#891766
    - Resolves: rhbz#902407
    - Resolves: rhbz#908450
    - Resolves: rhbz#913093
    - Resolves: rhbz#951340
    - Resolves: rhbz#951371
    - Related: rhbz#987355

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated pacemaker packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Pacemaker is a high-availability cluster resource manager with a powerful policy engine.

A denial of service flaw was found in the way Pacemaker performed authentication and processing of remote connections in certain circumstances. When Pacemaker was configured to allow remote Cluster Information Base (CIB) configuration or resource management, a remote attacker could use this flaw to cause Pacemaker to block indefinitely (preventing it from serving other requests). (CVE-2013-0281)

Note: The default Pacemaker configuration in Red Hat Enterprise Linux 6 has the remote CIB management functionality disabled.

The pacemaker package has been upgraded to upstream version 1.1.10, which provides a number of bug fixes and enhancements over the previous version :

* Pacemaker no longer assumes unknown cman nodes are safely stopped.

* The core dump file now converts all exit codes into positive 'errno' values.

* Pacemaker ensures a return to a stable state after too many fencing failures, and initiates a shutdown if a node claimed to be fenced is still active.

* The crm_error tool adds the ability to list and print error symbols.

* The crm_resource command allows individual resources to be reprobed, and implements the '--ban' option for moving resources away from nodes. The '--clear' option has replaced the '--unmove' option. Also, crm_resource now supports OCF tracing when using the '--force' option.

* The IPC mechanism restores the ability for members of the haclient group to connect to the cluster.

* The Policy Engine daemon allows active nodes in the current membership to be fenced without quorum.

* Policy Engine now suppresses meaningless IDs when displaying anonymous clone status, supports maintenance mode for a single node, and correctly handles the recovered resources before they are operated on.

* XML configuration files are now checked for non-printing characters and replaced with their octal equivalent when exporting XML text.
Also, a more reliable buffer allocation strategy has been implemented to prevent lockups.

(BZ#987355)

Additional bug fixes :

* The 'crm_resource --move' command was designed for atomic resources and could not handle resources on clones, masters, or slaves present on multiple nodes. Consequently, crm_resource could not obtain enough information to move a resource and did not perform any action. The '--ban' and '--clear' options have been added to allow the administrator to instruct the cluster unambiguously. Clone, master, and slave resources can now be navigated within the cluster as expected. (BZ#902407)

* The hacluster user account did not have a user identification (UID) or group identification (GID) number reserved on the system. Thus, UID and GID values were picked randomly during the installation process.
The UID and GID number 189 was reserved for hacluster and is now used consistently for all installations. (BZ#908450)

* Certain clusters used node host names that did not match the output of the 'uname -n' command. Thus, the default node name used by the crm_standby and crm_failcount commands was incorrect and caused the cluster to ignore the update by the administrator. The crm_node command is now used instead of the uname utility in helper scripts. As a result, the cluster behaves as expected. (BZ#913093)

* Due to incorrect return code handling, internal recovery logic of the crm_mon utility was not executed when a configuration updated failed to apply, leading to an assertion failure. Return codes are now checked correctly, and the recovery of an expected error state is now handled transparently. (BZ#951371)

* cman's automatic unfencing feature failed when combined with Pacemaker. Support for automated unfencing in Pacemaker has been added, and the unwanted behavior no longer occurs. (BZ#996850)

All pacemaker users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements.

A denial of service flaw was found in the way Pacemaker performed authentication and processing of remote connections in certain circumstances. When Pacemaker was configured to allow remote Cluster Information Base (CIB) configuration or resource management, a remote attacker could use this flaw to cause Pacemaker to block indefinitely (preventing it from serving other requests). (CVE-2013-0281)

Note: The default Pacemaker configuration in Scientific Linux 6 has the remote CIB management functionality disabled.

The pacemaker package has been upgraded to upstream version 1.1.10, which provides a number of bug fixes and enhancements over the previous version :

  - Pacemaker no longer assumes unknown cman nodes are     safely stopped.

  - The core dump file now converts all exit codes into     positive 'errno' values.

  - Pacemaker ensures a return to a stable state after too     many fencing failures, and initiates a shutdown if a     node claimed to be fenced is still active.

  - The crm_error tool adds the ability to list and print     error symbols.

  - The crm_resource command allows individual resources to     be reprobed, and implements the '--ban' option for     moving resources away from nodes. The ' --clear' option     has replaced the '--unmove' option. Also, crm_resource     now supports OCF tracing when using the '--force'     option.

  - The IPC mechanism restores the ability for members of     the haclient group to connect to the cluster.

  - The Policy Engine daemon allows active nodes in the     current membership to be fenced without quorum.

  - Policy Engine now suppresses meaningless IDs when     displaying anonymous clone status, supports maintenance     mode for a single node, and correctly handles the     recovered resources before they are operated on.

  - XML configuration files are now checked for non-printing     characters and replaced with their octal equivalent when     exporting XML text. Also, a more reliable buffer     allocation strategy has been implemented to prevent     lockups.

Additional bug fixes :

  - The 'crm_resource --move' command was designed for     atomic resources and could not handle resources on     clones, masters, or slaves present on multiple nodes.
    Consequently, crm_resource could not obtain enough     information to move a resource and did not perform any     action. The '--ban' and '--clear' options have been     added to allow the administrator to instruct the cluster     unambiguously. Clone, master, and slave resources can     now be navigated within the cluster as expected.

  - The hacluster user account did not have a user     identification (UID) or group identification (GID)     number reserved on the system. Thus, UID and GID values     were picked randomly during the installation process.
    The UID and GID number 189 was reserved for hacluster     and is now used consistently for all installations.

  - Certain clusters used node host names that did not match     the output of the 'uname -n' command. Thus, the default     node name used by the crm_standby and crm_failcount     commands was incorrect and caused the cluster to ignore     the update by the administrator. The crm_node command is     now used instead of the uname utility in helper scripts.
    As a result, the cluster behaves as expected.

  - Due to incorrect return code handling, internal recovery     logic of the crm_mon utility was not executed when a     configuration updated failed to apply, leading to an     assertion failure. Return codes are now checked     correctly, and the recovery of an expected error state     is now handled transparently.

  - cman's automatic unfencing feature failed when combined     with Pacemaker. Support for automated unfencing in     Pacemaker has been added, and the unwanted behavior no     longer occurs.

ID	Name	Product	Family	Severity
181104	Oracle Linux 6 : pacemaker (ELSA-2013-1635)	Nessus	Oracle Linux Local Security Checks	high
79169	CentOS 6 : pacemaker (CESA-2013:1635)	Nessus	CentOS Local Security Checks	medium
71197	Scientific Linux Security Update : pacemaker on SL6.x i386/x86_64 (20131121)	Nessus	Scientific Linux Local Security Checks	medium
71012	RHEL 6 : pacemaker (RHSA-2013:1635)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2013-0281

high

Tenable Plugins

high

medium

medium

medium