An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface. An attacker with an unprivileged account on a Pacemaker node could use this flaw to, for example, force the Local Resource Manager daemon to execute a script as root and thereby gain root access on the machine.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade pacemaker-libsUpgrade pacemaker-libs-develUpgrade pacemaker-ctsUpgrade pacemaker-remoteUpgrade pacemakerUpgrade pacemaker-docUpgrade pacemaker-cluster-libsUpgrade pacemaker-cli | Nov 14, 2016 | Nov 3, 2016 |
| Debian | — | Upgrade pacemaker | Jul 30, 2024 | Sep 10, 2018 |
| Gentoo Linux | — | Upgrade sys-cluster/pacemaker. | Oct 30, 2017 | Oct 8, 2017 |
| Redhat_linux | — | Upgrade pacemaker-libs-develUpgrade pacemaker-libsUpgrade pacemaker-cliUpgrade pacemaker-nagios-plugins-metadataUpgrade pacemaker-cluster-libsUpgrade pacemaker-remoteUpgrade pacemaker-debuginfoUpgrade pacemaker-ctsUpgrade pacemaker-docUpgrade pacemaker | Nov 7, 2016 | Nov 3, 2016 |
| Suse | — | Upgrade pacemaker-cliUpgrade libpacemaker-develUpgrade pacemaker-ctsUpgrade libpacemaker3Upgrade pacemakerUpgrade pacemaker-remote | Nov 23, 2016 | Nov 3, 2016 |
| Ubuntu | — | Upgrade pacemaker | Oct 25, 2017 | Nov 3, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub