Race condition in pcsd in PCS 0.9.139 and earlier uses a global variable to validate usernames, which allows remote authenticated users to gain privileges by sending a command that is checked for security after another user is authenticated.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1700 advisory.

  - pcs: Incorrect authorization when using pcs web UI (CVE-2015-5189)

  - pcs: Command injection with root privileges. (CVE-2015-5190)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated pcs packages that fix two security issues are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

A command injection flaw was found in the pcsd web UI. An attacker able to trick a victim that was logged in to the pcsd web UI into visiting a specially crafted URL could use this flaw to execute arbitrary code with root privileges on the server hosting the web UI.
(CVE-2015-5190)

A race condition was found in the way the pcsd web UI backend performed authorization of user requests. An attacker could use this flaw to send a request that would be evaluated as originating from a different user, potentially allowing the attacker to perform actions with permissions of a more privileged user. (CVE-2015-5189)

These issues were discovered by Tomas Jelinek of Red Hat.

All pcs users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

A command injection flaw was found in the pcsd web UI. An attacker able to trick a victim that was logged in to the pcsd web UI into visiting a specially crafted URL could use this flaw to execute arbitrary code with root privileges on the server hosting the web UI.
(CVE-2015-5190)

A race condition was found in the way the pcsd web UI backend performed authorization of user requests. An attacker could use this flaw to send a request that would be evaluated as originating from a different user, potentially allowing the attacker to perform actions with permissions of a more privileged user. (CVE-2015-5189)

ID	Name	Product	Family	Severity
88636	RHEL 6 / 7 : pcs (RHSA-2015:1700)	Nessus	Red Hat Local Security Checks	critical
86502	CentOS 6 / 7 : pcs (CESA-2015:1700)	Nessus	CentOS Local Security Checks	high
85760	Scientific Linux Security Update : pcs on SL6.x, SL7.x i386/x86_64 (20150901)	Nessus	Scientific Linux Local Security Checks	high

Detections

Analytics

CVE-2015-5189

critical

Tenable Plugins

critical

high

high