An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface. An attacker with an unprivileged account on a Pacemaker node could use this flaw to, for example, force the Local Resource Manager daemon to execute a script as root and thereby gain root access on the machine.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3462-1 advisory.

    Jan Pokorn and Alain Moulle discovered that Pacemaker incorrectly handled the IPC interface. A local     attacker could possibly use this issue to execute arbitrary code with root privileges. (CVE-2016-7035)

    Alain Moulle discovered that Pacemaker incorrectly handled authentication. A remote attacker could     possibly use this issue to shut down connections, leading to a denial of service. This issue only affected     Ubuntu 16.04 LTS. (CVE-2016-7797)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201710-08 (Pacemaker: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Pacemaker. Please       review the referenced CVE identifiers for details.
  Impact :

    A remote attacker could execute arbitrary code or a local attacker could       escalate privileges.
  Workaround :

    There is no known workaround at this time.

Security Fix(es) :

  - An authorization flaw was found in Pacemaker, where it     did not properly guard its IPC interface. An attacker     with an unprivileged account on a Pacemaker node could     use this flaw to, for example, force the Local Resource     Manager daemon to execute a script as root and thereby     gain root access on the machine. (CVE-2016-7035)

Bug Fix(es) :

  - The version of Pacemaker in Scientific Linux 7.3     incorporated an increase in the version number of the     remote node protocol. Consequently, cluster nodes     running Pacemaker in Scientific Linux 7.3 and remote     nodes running earlier versions of Scientific Linux were     not able to communicate with each other unless special     precautions were taken. This update preserves the     rolling upgrade capability.

This update for pacemaker fixes the following issues :

  - remote: Allow cluster and remote LRM API versions to     diverge (bsc#1009076)

  - libcrmcommon: fix CVE-2016-7035 (improper IPC guarding)     (bsc#1007433)

  - sysconfig: minor tweaks (typo, wording)

  - spec: more robust check for systemd being in use

  - spec: defines instead of some globals + error     suppression

  - various: issues discovered via valgrind and coverity

  - attrd_updater: fix usage of HAVE_ATOMIC_ATTRD

  - crmd: cl#5185 - Record pending operations in the CIB     before they are performed (bsc#1003565)

  - ClusterMon: fix to avoid matching other process with the     same PID

  - mcp: improve comments for sysconfig options

  - remove openssl-devel and libselinux-devel as build     dependencies

  - tools: crm_standby --version/--help should work without     cluster

  - libpengine: only log startup-fencing warning once

  - pacemaker.service: do not mistakenly suggest killing     fenced

  - libcrmcommon: report errors consistently when waiting     for data on connection (bsc#986644)

  - remote: Correctly calculate the remaining timeouts when     receiving messages (bsc#986644)

  - libfencing: report added node ID correctly

  - crm_mon: Do not call setenv with null value

  - pengine: Do not fence a maintenance node if it shuts     down cleanly (bsc#1000743)

  - ping: Avoid temporary files for fping check (bsc#987348)

  - all: clarify licensing and copyrights

  - crmd: Resend the shutdown request if the DC forgets

  - ping: Avoid temp files in fping_check (bsc#987348)

  - crmd: Ensure the R_SHUTDOWN is set whenever we ask the     DC to shut us down

  - crmd: clear remote node operation history only when it     comes up

  - libcib,libfencing,libtransition: handle memory     allocation errors without CRM_CHECK()

  - tools: make crm_mon XML schema handle resources with     multiple active

  - pengine: set OCF_RESKEY_CRM_meta_notify_active_* for     multistate resources

  - pengine: avoid null dereference in new same-node     ordering option

  - lrmd,libcluster: ensure g_hash_table_foreach() is never     passed a null table

  - crmd: don't log warning if abort_unless_down() can't     find down event

  - lib: Correction of the deletion of the notice     registration.

  - stonithd: Correction of the wrong connection process     name.

  - crmd: Keep a state of LRMD in the DC node latest.

  - pengine: avoid transition loop for start-then-stop +     unfencing

  - libpengine: allow pe_order_same_node option for     constraints

  - cts: Restart systemd-journald with 'systemctl restart     systemd-journald.socket' (bsc#995365)

  - libcrmcommon: properly handle XML comments when     comparing v2 patchset diffs

  - crmd: don't abort transitions for CIB comment changes

  - libcrmcommon: log XML comments correctly

  - libcrmcommon: remove extraneous format specifier from     log message

  - remote: cl#5269 - Notify other clients of a new     connection only if the handshake has completed     (bsc#967388, bsc#1002767, CVE-2016-7797)

This update was imported from the SUSE:SLE-12-SP1:Update update project.

This update for pacemaker fixes the following issues :

Security issues fixed :

  - CVE-2016-7797: Notify other clients of a new connection     only if the handshake has completed (bsc#967388,     bsc#1002767).

  - CVE-2016-7035: Fixed improper IPC guarding in pacemaker     (bsc#1007433).

Bug fixes :

  - bsc#1003565: crmd: Record pending operations in the CIB     before they are performed

  - bsc#1000743: pengine: Do not fence a maintenance node if     it shuts down cleanly

  - bsc#987348: ping: Avoid temporary files for fping check

  - bsc#986644: libcrmcommon: report errors consistently     when waiting for data on connection

  - bsc#986644: remote: Correctly calculate the remaining     timeouts when receiving messages

This update was imported from the SUSE:SLE-12-SP2:Update update project.

An update for pacemaker is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Pacemaker cluster resource manager is a collection of technologies working together to provide data integrity and the ability to maintain application availability in the event of a failure.

Security Fix(es) :

* An authorization flaw was found in Pacemaker, where it did not properly guard its IPC interface. An attacker with an unprivileged account on a Pacemaker node could use this flaw to, for example, force the Local Resource Manager daemon to execute a script as root and thereby gain root access on the machine. (CVE-2016-7035)

This issue was discovered by Jan 'poki' Pokorny (Red Hat) and Alain Moulle (ATOS/BULL).

Bug Fix(es) :

* The version of Pacemaker in Red Hat Enterprise Linux 7.3 incorporated an increase in the version number of the remote node protocol. Consequently, cluster nodes running Pacemaker in Red Hat Enterprise Linux 7.3 and remote nodes running earlier versions of Red Hat Enterprise Linux were not able to communicate with each other unless special precautions were taken. This update preserves the rolling upgrade capability. (BZ#1389023)

Security fix for CVE-2016-7035 (improper IPC guarding)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for pacemaker is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Pacemaker cluster resource manager is a collection of technologies working together to provide data integrity and the ability to maintain application availability in the event of a failure.

Security Fix(es) :

* An authorization flaw was found in Pacemaker, where it did not properly guard its IPC interface. An attacker with an unprivileged account on a Pacemaker node could use this flaw to, for example, force the Local Resource Manager daemon to execute a script as root and thereby gain root access on the machine. (CVE-2016-7035)

This issue was discovered by Jan 'poki' Pokorny (Red Hat) and Alain Moulle (ATOS/BULL).

Security Fix(es) :

  - An authorization flaw was found in Pacemaker, where it     did not properly guard its IPC interface. An attacker     with an unprivileged account on a Pacemaker node could     use this flaw to, for example, force the Local Resource     Manager daemon to execute a script as root and thereby     gain root access on the machine. (CVE-2016-7035)

This issue was discovered by Jan 'poki' Pokorny (Red Hat) and Alain Moulle (ATOS/BULL).

ID	Name	Product	Family	Severity
104143	Ubuntu 14.04 LTS / 16.04 LTS : Pacemaker vulnerabilities (USN-3462-1)	Nessus	Ubuntu Local Security Checks	high
103726	GLSA-201710-08 : Pacemaker: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
95852	Scientific Linux Security Update : pacemaker on SL7.x x86_64 (20161103)	Nessus	Scientific Linux Local Security Checks	high
95753	openSUSE Security Update : pacemaker (openSUSE-2016-1447)	Nessus	SuSE Local Security Checks	high
95531	openSUSE Security Update : pacemaker (openSUSE-2016-1376)	Nessus	SuSE Local Security Checks	high
95353	CentOS 7 : pacemaker (CESA-2016:2614)	Nessus	CentOS Local Security Checks	high
94857	Fedora 25 : pacemaker (2016-c1cbcc4528)	Nessus	Fedora Local Security Checks	high
94742	CentOS 6 : pacemaker (CESA-2016:2675)	Nessus	CentOS Local Security Checks	high
94657	Fedora 23 : pacemaker (2016-2a159ef513)	Nessus	Fedora Local Security Checks	high
94653	Scientific Linux Security Update : pacemaker on SL6.x i386/x86_64 (20161108)	Nessus	Scientific Linux Local Security Checks	high
94651	RHEL 6 : pacemaker (RHSA-2016:2675)	Nessus	Red Hat Local Security Checks	high
94604	RHEL 7 : pacemaker (RHSA-2016:2614)	Nessus	Red Hat Local Security Checks	high
94590	Fedora 24 : pacemaker (2016-242ff9a2fa)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2016-7035

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high