Detections
Analytics
Debian DLA-2519-1 : pacemaker security update
high Nessus Plugin ID 144814
Language:
Synopsis
The remote Debian host is missing a security update.Description
Several security vulnerabilities were addressed in pacemaker, a cluster resource manager.CVE-2018-16877
A flaw was found in the way pacemaker's client-server authentication was implemented. A local attacker could use this flaw, and combine it with other IPC weaknesses, to achieve local privilege escalation.
CVE-2018-16878
An insufficient verification inflicted preference of uncontrolled processes can lead to denial of service.
CVE-2020-25654
An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the haclient group could use IPC communication with various daemons directly to perform certain tasks that they would be prevented by ACLs from doing if they went through the configuration.
For Debian 9 stretch, these problems have been fixed in version 1.1.24-0+deb9u1.
We recommend that you upgrade your pacemaker packages.
For the detailed security status of pacemaker please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/pacemaker
NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
Solution
Upgrade the affected packages.See Also
https://lists.debian.org/debian-lts-announce/2021/01/msg00007.html
https://packages.debian.org/source/stretch/pacemaker
https://security-tracker.debian.org/tracker/source-package/pacemaker
Plugin Details
Severity: High
ID: 144814
File Name: debian_DLA-2519.nasl
Version: 1.4
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 1/11/2021
Updated: 1/30/2024
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 9
Temporal Score: 6.7
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2020-25654
CVSS v3
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.8
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS Score Source: CVE-2018-16877
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:libcrmservice3, p-cpe:/a:debian:debian_linux:libcrmservice-dev, p-cpe:/a:debian:debian_linux:libcrmcluster4, cpe:/o:debian:debian_linux:9.0, p-cpe:/a:debian:debian_linux:pacemaker-remote, p-cpe:/a:debian:debian_linux:pacemaker-doc, p-cpe:/a:debian:debian_linux:pacemaker-common, p-cpe:/a:debian:debian_linux:liblrmd-dev, p-cpe:/a:debian:debian_linux:libpe-rules2, p-cpe:/a:debian:debian_linux:libpengine10, p-cpe:/a:debian:debian_linux:libstonithd2, p-cpe:/a:debian:debian_linux:libpengine-dev, p-cpe:/a:debian:debian_linux:libcib-dev, p-cpe:/a:debian:debian_linux:libcrmcommon-dev, p-cpe:/a:debian:debian_linux:pacemaker, p-cpe:/a:debian:debian_linux:libcrmcommon3, p-cpe:/a:debian:debian_linux:pacemaker-resource-agents, p-cpe:/a:debian:debian_linux:liblrmd1, p-cpe:/a:debian:debian_linux:libpe-status10, p-cpe:/a:debian:debian_linux:libcib4, p-cpe:/a:debian:debian_linux:libtransitioner2, p-cpe:/a:debian:debian_linux:libcrmcluster-dev, p-cpe:/a:debian:debian_linux:libstonithd-dev, p-cpe:/a:debian:debian_linux:pacemaker-cli-utils
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Ease: No known exploits are available
Patch Publication Date: 1/6/2021
Vulnerability Publication Date: 4/18/2019