An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface. An attacker with an unprivileged account on a Pacemaker node could use this flaw to, for example, force the Local Resource Manager daemon to execute a script as root and thereby gain root access on the machine.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade pacemaker-docUpgrade pacemaker-cluster-libsUpgrade pacemakerUpgrade pacemaker-cliUpgrade pacemaker-remoteUpgrade pacemaker-libs-develUpgrade pacemaker-ctsUpgrade pacemaker-libs | Nov 14, 2016 | Nov 3, 2016 |
| Debian | — | Upgrade pacemaker | Jul 30, 2024 | Sep 10, 2018 |
| Gentoo Linux | — | Upgrade sys-cluster/pacemaker. | Oct 30, 2017 | Oct 8, 2017 |
| Redhat_linux | — | Upgrade pacemaker-nagios-plugins-metadataUpgrade pacemaker-cliUpgrade pacemaker-libsUpgrade pacemaker-libs-develUpgrade pacemakerUpgrade pacemaker-docUpgrade pacemaker-ctsUpgrade pacemaker-cluster-libsUpgrade pacemaker-remoteUpgrade pacemaker-debuginfo | Nov 7, 2016 | Nov 3, 2016 |
| Suse | — | Upgrade libpacemaker-develUpgrade pacemaker-cliUpgrade pacemaker-ctsUpgrade pacemaker-remoteUpgrade pacemakerUpgrade libpacemaker3 | Nov 23, 2016 | Nov 3, 2016 |
| Ubuntu | — | Upgrade pacemaker | Oct 25, 2017 | Nov 3, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub