An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface. An attacker with an unprivileged account on a Pacemaker node could use this flaw to, for example, force the Local Resource Manager daemon to execute a script as root and thereby gain root access on the machine.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
21 Nov 2024, 02:57
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 7.2
v3 : 8.8 |
| References | () http://rhn.redhat.com/errata/RHSA-2016-2614.html - Third Party Advisory | |
| References | () http://rhn.redhat.com/errata/RHSA-2016-2675.html - Third Party Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2016/11/03/5 - Mailing List, Third Party Advisory | |
| References | () http://www.securityfocus.com/bid/94214 - Third Party Advisory, VDB Entry | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7035 - Issue Tracking, Third Party Advisory | |
| References | () https://github.com/ClusterLabs/pacemaker/commit/5d71e65049 - Third Party Advisory | |
| References | () https://lists.clusterlabs.org/pipermail/users/2016-November/004432.html - Mailing List, Vendor Advisory | |
| References | () https://security.gentoo.org/glsa/201710-08 - Third Party Advisory |
Information
Published : 2018-09-10 16:29
Updated : 2024-11-21 02:57
NVD link : CVE-2016-7035
Mitre link : CVE-2016-7035
CVE.ORG link : CVE-2016-7035
JSON object : View
Products Affected
redhat
- enterprise_linux_server
- enterprise_linux_server_eus
clusterlabs
- pacemaker
CWE
CWE-285
Improper Authorization