The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2016:2596 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    The following packages have been upgraded to a newer upstream version: pcs (0.9.152). (BZ#1299847)

    Security Fix(es):

    * A Cross-Site Request Forgery (CSRF) flaw was found in the pcsd web UI. A remote attacker could provide a     specially crafted web page that, when visited by a user with a valid pcsd session, would allow the     attacker to trigger requests on behalf of the user, for example removing resources or restarting/removing     nodes. (CVE-2016-0720)

    * It was found that pcsd did not invalidate cookies on the server side when a user logged out. This could     potentially allow an attacker to perform session fixation attacks on pcsd. (CVE-2016-0721)

    These issues were discovered by Martin Prpic (Red Hat Product Security).

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for pcs is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

The following packages have been upgraded to a newer upstream version:
pcs (0.9.152). (BZ#1299847)

Security Fix(es) :

* A Cross-Site Request Forgery (CSRF) flaw was found in the pcsd web UI. A remote attacker could provide a specially crafted web page that, when visited by a user with a valid pcsd session, would allow the attacker to trigger requests on behalf of the user, for example removing resources or restarting/removing nodes. (CVE-2016-0720)

* It was found that pcsd did not invalidate cookies on the server side when a user logged out. This could potentially allow an attacker to perform session fixation attacks on pcsd. (CVE-2016-0721)

These issues were discovered by Martin Prpic (Red Hat Product Security).

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

Added missing python-lxml dependency ---- * Re-synced to upstream sources * Security fix for CVE-2016-0720, CVE-2016-0721 * Rubygems built with RELRO * Spec file cleanup * Fixed multilib .pyc/.pyo issue

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Cross-site request forgery (CSRF) vulnerability in pcsd web UI in pcs before 0.9.149. (CVE-2016-0720)

Note that Nessus relies on the presence of the package as reported by the vendor.

- Re-synced to upstream sources * Security fix for     CVE-2016-0720, CVE-2016-0721

    - Rubygems built with RELRO * Spec file cleanup * Fixed       multilib .pyc/.pyo issue ---- * Re-synced to upstream       sources * Security fix for CVE-2016-0720,       CVE-2016-0721 * Rubygems built with RELRO * Spec file       cleanup * Fixed multilib .pyc/.pyo issue

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The following packages have been upgraded to a newer upstream version:
pcs (0.9.152).

Security Fix(es) :

  - A Cross-Site Request Forgery (CSRF) flaw was found in     the pcsd web UI. A remote attacker could provide a     specially crafted web page that, when visited by a user     with a valid pcsd session, would allow the attacker to     trigger requests on behalf of the user, for example     removing resources or restarting/removing nodes.
    (CVE-2016-0720)

  - It was found that pcsd did not invalidate cookies on the     server side when a user logged out. This could     potentially allow an attacker to perform session     fixation attacks on pcsd. (CVE-2016-0721)

These issues were discovered by Martin Prpic (Red Hat Product Security).

Additional Changes :

ID	Name	Product	Family	Published	Updated	Severity
94559	RHEL 7 : pcs (RHSA-2016:2596)	Nessus	Red Hat Local Security Checks	11/4/2016	4/15/2025	high
95342	CentOS 7 : pcs (CESA-2016:2596)	Nessus	CentOS Local Security Checks	11/28/2016	1/4/2021	high
89516	Fedora 22 : pcs-0.9.149-2.fc22 (2016-3b20c4ec9d)	Nessus	Fedora Local Security Checks	3/4/2016	1/11/2021	high
219503	Linux Distros Unpatched Vulnerability : CVE-2016-0720	Nessus	Misc.	3/4/2025	3/4/2025	high
89617	Fedora 23 : pcs-0.9.149-2.fc23 (2016-cdd4228cc7)	Nessus	Fedora Local Security Checks	3/4/2016	1/11/2021	high
95853	Scientific Linux Security Update : pcs on SL7.x x86_64 (20161103)	Nessus	Scientific Linux Local Security Checks	12/15/2016	1/14/2021	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high