Pacemaker before 1.1.13 does not properly evaluate added nodes, which allows remote read-only users to gain privileges via an acl command.

The remote host is affected by the vulnerability described in GLSA-201710-08 (Pacemaker: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Pacemaker. Please       review the referenced CVE identifiers for details.
  Impact :

    A remote attacker could execute arbitrary code or a local attacker could       escalate privileges.
  Workaround :

    There is no known workaround at this time.

Security fix for CVE-2015-1867: issue allegedly present in pacemaker-1.1.12, fixed in pacemaker-1.1.13. * * * pacemaker-1.1.13-3.fc{21,22,23} - Update to Pacemaker-1.1.13 post-release + patches (sync) - Add nagios-plugins-metadata subpackage enabling support of selected Nagios plugins as resources recognized by Pacemaker - Several specfile improvements: drop irrelevant stuff, rehash the included/excluded files + dependencies, add check scriptlet, reflect current packaging practice, do minor cleanups (mostly adopted from another spec)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was found in the way pacemaker, a cluster resource manager, evaluated added nodes in certain situations. A user with read-only access could potentially assign any other existing roles to themselves and then add privileges to other users as well. (CVE-2015-1867)

The pacemaker packages have been upgraded to upstream version 1.1.13, which provides a number of bug fixes and enhancements over the previous version.

This update also fixes the following bugs :

  - When a Pacemaker cluster included an Apache resource,     and Apache's mod_systemd module was enabled, systemd     rejected notifications sent by Apache. As a consequence,     a large number of errors in the following format     appeared in the system log :

Got notification message from PID XXXX, but reception only permitted for PID YYYY

With this update, the lrmd daemon now unsets the 'NOTIFY_SOCKET' variable in the described circumstances, and these error messages are no longer logged.

  - Previously, specifying a remote guest node as a part of     a group resource in a Pacemaker cluster caused the node     to stop working. This update adds support for remote     guests in Pacemaker group resources, and the described     problem no longer occurs.

  - When a resource in a Pacemaker cluster failed to start,     Pacemaker updated the resource's last failure time and     incremented its fail count even if the 'on-fail=ignore'     option was used. This in some cases caused unintended     resource migrations when a resource start failure     occurred. Now, Pacemaker does not update the fail count     when 'on-fail=ignore' is used. As a result, the failure     is displayed in the cluster status output, but is     properly ignored and thus does not cause resource     migration.

  - Previously, Pacemaker supported semicolon characters     (';') as delimiters when parsing the pcmk_host_map     string, but not when parsing the pcmk_host_list string.
    To ensure consistent user experience, semicolons are now     supported as delimiters for parsing pcmk_host_list, as     well.

In addition, this update adds the following enhancements :

  - If a Pacemaker location constraint has the     'resource-discovery=never' option, Pacemaker now does     not attempt to determine whether a specified service is     running on the specified node. In addition, if multiple     location constraints for a given resource specify     'resource- discovery=exclusive', then Pacemaker attempts     resource discovery only on the nodes specified in those     constraints. This allows Pacemaker to skip resource     discovery on nodes where attempting the operation would     lead to error or other undesirable behavior.

  - The procedure of configuring fencing for redundant power     supplies has been simplified in order to prevent     multiple nodes accessing cluster resources at the same     time and thus causing data corruption. For further     information, see the 'Fencing: Configuring STONITH'     chapter of the High Availability Add-On Reference     manual.

  - The output of the 'crm_mon' and 'pcs_status' commands     has been modified to be clearer and more concise, and     thus easier to read when reporting the status of a     Pacemaker cluster with a large number of remote nodes     and cloned resources.

Updated pacemaker packages that fix one security issue, several bugs, and add two enhancements are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Pacemaker Resource Manager is a collection of technologies working together to provide data integrity and the ability to maintain application availability in the event of a failure.

A flaw was found in the way pacemaker, a cluster resource manager, evaluated added nodes in certain situations. A user with read-only access could potentially assign any other existing roles to themselves and then add privileges to other users as well. (CVE-2015-1867)

The pacemaker packages have been upgraded to upstream version 1.1.13, which provides a number of bug fixes and enhancements over the previous version. (BZ#1234680)

This update also fixes the following bugs :

* When a Pacemaker cluster included an Apache resource, and Apache's mod_systemd module was enabled, systemd rejected notifications sent by Apache. As a consequence, a large number of errors in the following format appeared in the system log :

Got notification message from PID XXXX, but reception only permitted for PID YYYY

With this update, the lrmd daemon now unsets the 'NOTIFY_SOCKET' variable in the described circumstances, and these error messages are no longer logged. (BZ#1150184)

* Previously, specifying a remote guest node as a part of a group resource in a Pacemaker cluster caused the node to stop working. This update adds support for remote guests in Pacemaker group resources, and the described problem no longer occurs. (BZ#1168637)

* When a resource in a Pacemaker cluster failed to start, Pacemaker updated the resource's last failure time and incremented its fail count even if the 'on-fail=ignore' option was used. This in some cases caused unintended resource migrations when a resource start failure occurred. Now, Pacemaker does not update the fail count when 'on-fail=ignore' is used. As a result, the failure is displayed in the cluster status output, but is properly ignored and thus does not cause resource migration. (BZ#1200849)

* Previously, Pacemaker supported semicolon characters (';') as delimiters when parsing the pcmk_host_map string, but not when parsing the pcmk_host_list string. To ensure consistent user experience, semicolons are now supported as delimiters for parsing pcmk_host_list, as well. (BZ#1206232)

In addition, this update adds the following enhancements :

* If a Pacemaker location constraint has the 'resource-discovery=never' option, Pacemaker now does not attempt to determine whether a specified service is running on the specified node. In addition, if multiple location constraints for a given resource specify 'resource-discovery=exclusive', then Pacemaker attempts resource discovery only on the nodes specified in those constraints. This allows Pacemaker to skip resource discovery on nodes where attempting the operation would lead to error or other undesirable behavior. (BZ#1108853)

* The procedure of configuring fencing for redundant power supplies has been simplified in order to prevent multiple nodes accessing cluster resources at the same time and thus causing data corruption.
For further information, see the 'Fencing: Configuring STONITH' chapter of the High Availability Add-On Reference manual. (BZ#1206647)

* The output of the 'crm_mon' and 'pcs_status' commands has been modified to be clearer and more concise, and thus easier to read when reporting the status of a Pacemaker cluster with a large number of remote nodes and cloned resources. (BZ#1115840)

All pacemaker users are advised to upgrade to these updated packages, which correct these issues and add these enhancements.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:2383 advisory.

    The Pacemaker Resource Manager is a collection of technologies working     together to provide data integrity and the ability to maintain     application availability in the event of a failure.

    A flaw was found in the way pacemaker, a cluster resource manager,     evaluated added nodes in certain situations. A user with read-only access     could potentially assign any other existing roles to themselves and then     add privileges to other users as well. (CVE-2015-1867)

    The pacemaker packages have been upgraded to upstream version 1.1.13, which     provides a number of bug fixes and enhancements over the previous version.
    (BZ#1234680)

    This update also fixes the following bugs:

    * When a Pacemaker cluster included an Apache resource, and Apache's     mod_systemd module was enabled, systemd rejected notifications sent by     Apache. As a consequence, a large number of errors in the following format     appeared in the system log:

      Got notification message from PID XXXX, but reception only permitted       for PID YYYY

    With this update, the lrmd daemon now unsets the NOTIFY_SOCKET variable     in the described circumstances, and these error messages are no longer     logged. (BZ#1150184)

    * Previously, specifying a remote guest node as a part of a group resource     in a Pacemaker cluster caused the node to stop working. This update adds     support for remote guests in Pacemaker group resources, and the described     problem no longer occurs. (BZ#1168637)

    * When a resource in a Pacemaker cluster failed to start, Pacemaker updated     the resource's last failure time and incremented its fail count even if the     on-fail=ignore option was used. This in some cases caused unintended     resource migrations when a resource start failure occurred. Now, Pacemaker     does not update the fail count when on-fail=ignore is used. As a result,     the failure is displayed in the cluster status output, but is properly     ignored and thus does not cause resource migration. (BZ#1200849)

    * Previously, Pacemaker supported semicolon characters (;) as delimiters     when parsing the pcmk_host_map string, but not when parsing the     pcmk_host_list string. To ensure consistent user experience, semicolons are     now supported as delimiters for parsing pcmk_host_list, as well.
    (BZ#1206232)

    In addition, this update adds the following enhancements:

    * If a Pacemaker location constraint has the resource-discovery=never     option, Pacemaker now does not attempt to determine whether a specified     service is running on the specified node. In addition, if multiple location     constraints for a given resource specify resource-discovery=exclusive,     then Pacemaker attempts resource discovery only on the nodes specified in     those constraints. This allows Pacemaker to skip resource discovery on     nodes where attempting the operation would lead to error or other     undesirable behavior. (BZ#1108853)

    * The procedure of configuring fencing for redundant power supplies has     been simplified in order to prevent multiple nodes accessing cluster     resources at the same time and thus causing data corruption. For further     information, see the Fencing: Configuring STONITH chapter of the High     Availability Add-On Reference manual. (BZ#1206647)

    * The output of the crm_mon and pcs_status commands has been modified     to be clearer and more concise, and thus easier to read when reporting     the status of a Pacemaker cluster with a large number of remote nodes and     cloned resources. (BZ#1115840)

    All pacemaker users are advised to upgrade to these updated packages, which     correct these issues and add these enhancements.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A flaw was found in the way pacemaker, a cluster resource manager, evaluated added nodes in certain situations. A user with read-only access could potentially assign any other existing roles to themselves and then add privileges to other users as well. (CVE-2015-1867)

This update also fixes the following bugs :

  - Due to a race condition, nodes that gracefully shut down     occasionally had difficulty rejoining the cluster. As a     consequence, nodes could come online and be shut down     again immediately by the cluster. This bug has been     fixed, and the 'shutdown' attribute is now cleared     properly.

  - Prior to this update, the pacemaker utility caused an     unexpected termination of the attrd daemon after a     system update to Scientific Linux 6.6. The bug has been     fixed so that attrd no longer crashes when pacemaker     starts.

  - Previously, the access control list (ACL) of the     pacemaker utility allowed a role assignment to the     Cluster Information Base (CIB) with a read-only     permission. With this update, ACL is enforced and can no     longer be bypassed by the user without the write     permission, thus fixing this bug.

  - Prior to this update, the ClusterMon (crm_mon) utility     did not trigger an external agent script with the '-E'     parameter to monitor the Cluster Information Base (CIB)     when the pacemaker utility was used. A patch has been     provided to fix this bug, and crm_mon now calls the     agent script when the '-E' parameter is used.

Updated pacemaker packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Pacemaker Resource Manager is a collection of technologies working together to provide data integrity and the ability to maintain application availability in the event of a failure.

A flaw was found in the way pacemaker, a cluster resource manager, evaluated added nodes in certain situations. A user with read-only access could potentially assign any other existing roles to themselves and then add privileges to other users as well. (CVE-2015-1867)

This update also fixes the following bugs :

* Due to a race condition, nodes that gracefully shut down occasionally had difficulty rejoining the cluster. As a consequence, nodes could come online and be shut down again immediately by the cluster. This bug has been fixed, and the 'shutdown' attribute is now cleared properly. (BZ#1198638)

* Prior to this update, the pacemaker utility caused an unexpected termination of the attrd daemon after a system update to Red Hat Enterprise Linux 6.6. The bug has been fixed so that attrd no longer crashes when pacemaker starts. (BZ#1205292)

* Previously, the access control list (ACL) of the pacemaker utility allowed a role assignment to the Cluster Information Base (CIB) with a read-only permission. With this update, ACL is enforced and can no longer be bypassed by the user without the write permission, thus fixing this bug. (BZ#1207621)

* Prior to this update, the ClusterMon (crm_mon) utility did not trigger an external agent script with the '-E' parameter to monitor the Cluster Information Base (CIB) when the pacemaker utility was used. A patch has been provided to fix this bug, and crm_mon now calls the agent script when the '-E' parameter is used. (BZ#1208896)

Users of pacemaker are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:1424 advisory.

    The Pacemaker Resource Manager is a collection of technologies working     together to provide data integrity and the ability to maintain application     availability in the event of a failure.

    A flaw was found in the way pacemaker, a cluster resource manager,     evaluated added nodes in certain situations. A user with read-only access     could potentially assign any other existing roles to themselves and then     add privileges to other users as well. (CVE-2015-1867)

    This update also fixes the following bugs:

    * Due to a race condition, nodes that gracefully shut down occasionally had     difficulty rejoining the cluster. As a consequence, nodes could come online     and be shut down again immediately by the cluster. This bug has been fixed,     and the shutdown attribute is now cleared properly. (BZ#1198638)

    * Prior to this update, the pacemaker utility caused an unexpected     termination of the attrd daemon after a system update to Red Hat Enterprise     Linux 6.6. The bug has been fixed so that attrd no longer crashes when     pacemaker starts. (BZ#1205292)

    * Previously, the access control list (ACL) of the pacemaker utility     allowed a role assignment to the Cluster Information Base (CIB) with a     read-only permission. With this update, ACL is enforced and can no longer     be bypassed by the user without the write permission, thus fixing this bug.
    (BZ#1207621)

    * Prior to this update, the ClusterMon (crm_mon) utility did not trigger an     external agent script with the -E parameter to monitor the Cluster     Information Base (CIB) when the pacemaker utility was used. A patch has     been provided to fix this bug, and crm_mon now calls the agent script when     the -E parameter is used. (BZ#1208896)

    Users of pacemaker are advised to upgrade to these updated packages, which     contain backported patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
103726	GLSA-201710-08 : Pacemaker: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
89464	Fedora 23 : pacemaker-1.1.13-3.fc23 (2015-f9864ecd8f)	Nessus	Fedora Local Security Checks	high
89462	Fedora 22 : pacemaker-1.1.13-3.fc22 (2015-f6860d8f9d)	Nessus	Fedora Local Security Checks	high
89444	Fedora 21 : pacemaker-1.1.13-3.fc21 (2015-e5e36bbb87)	Nessus	Fedora Local Security Checks	high
87568	Scientific Linux Security Update : pacemaker on SL7.x x86_64 (20151119)	Nessus	Scientific Linux Local Security Checks	high
87155	CentOS 7 : pacemaker (CESA-2015:2383)	Nessus	CentOS Local Security Checks	high
86987	RHEL 7 : pacemaker (RHSA-2015:2383)	Nessus	Red Hat Local Security Checks	critical
85204	Scientific Linux Security Update : pacemaker on SL6.x i386/x86_64 (20150722)	Nessus	Scientific Linux Local Security Checks	high
85020	CentOS 6 : pacemaker (CESA-2015:1424)	Nessus	CentOS Local Security Checks	high
84946	RHEL 6 : pacemaker (RHSA-2015:1424)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2015-1867

critical

Tenable Plugins

high

high

high

high

high

high

critical

high

high

critical