ID CVE-2013-0281
Summary Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of connections to the blocking sockets, which allows remote attackers to cause a denial of service (connection blocking).
References
Vulnerable Configurations
  • Red Hat Enterprise Linux 6.0
    cpe:2.3:o:redhat:enterprise_linux:6.0
  • Clusterlabs Pacemaker 1.1.10
    cpe:2.3:a:clusterlabs:pacemaker:1.1.10
CVSS
Base: 4.3 (as of 25-11-2013 - 10:40)
Impact:
Exploitability:
CWE CWE-399
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
nessus via4
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20131121_PACEMAKER_ON_SL6_X.NASL
    description A denial of service flaw was found in the way Pacemaker performed authentication and processing of remote connections in certain circumstances. When Pacemaker was configured to allow remote Cluster Information Base (CIB) configuration or resource management, a remote attacker could use this flaw to cause Pacemaker to block indefinitely (preventing it from serving other requests). (CVE-2013-0281) Note: The default Pacemaker configuration in Scientific Linux 6 has the remote CIB management functionality disabled. The pacemaker package has been upgraded to upstream version 1.1.10, which provides a number of bug fixes and enhancements over the previous version : - Pacemaker no longer assumes unknown cman nodes are safely stopped. - The core dump file now converts all exit codes into positive 'errno' values. - Pacemaker ensures a return to a stable state after too many fencing failures, and initiates a shutdown if a node claimed to be fenced is still active. - The crm_error tool adds the ability to list and print error symbols. - The crm_resource command allows individual resources to be reprobed, and implements the '--ban' option for moving resources away from nodes. The ' --clear' option has replaced the '--unmove' option. Also, crm_resource now supports OCF tracing when using the '--force' option. - The IPC mechanism restores the ability for members of the haclient group to connect to the cluster. - The Policy Engine daemon allows active nodes in the current membership to be fenced without quorum. - Policy Engine now suppresses meaningless IDs when displaying anonymous clone status, supports maintenance mode for a single node, and correctly handles the recovered resources before they are operated on. - XML configuration files are now checked for non-printing characters and replaced with their octal equivalent when exporting XML text. Also, a more reliable buffer allocation strategy has been implemented to prevent lockups. Additional bug fixes : - The 'crm_resource --move' command was designed for atomic resources and could not handle resources on clones, masters, or slaves present on multiple nodes. Consequently, crm_resource could not obtain enough information to move a resource and did not perform any action. The '--ban' and '--clear' options have been added to allow the administrator to instruct the cluster unambiguously. Clone, master, and slave resources can now be navigated within the cluster as expected. - The hacluster user account did not have a user identification (UID) or group identification (GID) number reserved on the system. Thus, UID and GID values were picked randomly during the installation process. The UID and GID number 189 was reserved for hacluster and is now used consistently for all installations. - Certain clusters used node host names that did not match the output of the 'uname -n' command. Thus, the default node name used by the crm_standby and crm_failcount commands was incorrect and caused the cluster to ignore the update by the administrator. The crm_node command is now used instead of the uname utility in helper scripts. As a result, the cluster behaves as expected. - Due to incorrect return code handling, internal recovery logic of the crm_mon utility was not executed when a configuration updated failed to apply, leading to an assertion failure. Return codes are now checked correctly, and the recovery of an expected error state is now handled transparently. - cman's automatic unfencing feature failed when combined with Pacemaker. Support for automated unfencing in Pacemaker has been added, and the unwanted behavior no longer occurs.
    last seen 2019-02-21
    modified 2018-12-31
    plugin id 71197
    published 2013-12-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=71197
    title Scientific Linux Security Update : pacemaker on SL6.x i386/x86_64
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2013-1635.NASL
    description Updated pacemaker packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. Pacemaker is a high-availability cluster resource manager with a powerful policy engine. A denial of service flaw was found in the way Pacemaker performed authentication and processing of remote connections in certain circumstances. When Pacemaker was configured to allow remote Cluster Information Base (CIB) configuration or resource management, a remote attacker could use this flaw to cause Pacemaker to block indefinitely (preventing it from serving other requests). (CVE-2013-0281) Note: The default Pacemaker configuration in Red Hat Enterprise Linux 6 has the remote CIB management functionality disabled. The pacemaker package has been upgraded to upstream version 1.1.10, which provides a number of bug fixes and enhancements over the previous version : * Pacemaker no longer assumes unknown cman nodes are safely stopped. * The core dump file now converts all exit codes into positive 'errno' values. * Pacemaker ensures a return to a stable state after too many fencing failures, and initiates a shutdown if a node claimed to be fenced is still active. * The crm_error tool adds the ability to list and print error symbols. * The crm_resource command allows individual resources to be reprobed, and implements the '--ban' option for moving resources away from nodes. The '--clear' option has replaced the '--unmove' option. Also, crm_resource now supports OCF tracing when using the '--force' option. * The IPC mechanism restores the ability for members of the haclient group to connect to the cluster. * The Policy Engine daemon allows active nodes in the current membership to be fenced without quorum. * Policy Engine now suppresses meaningless IDs when displaying anonymous clone status, supports maintenance mode for a single node, and correctly handles the recovered resources before they are operated on. * XML configuration files are now checked for non-printing characters and replaced with their octal equivalent when exporting XML text. Also, a more reliable buffer allocation strategy has been implemented to prevent lockups. (BZ#987355) Additional bug fixes : * The 'crm_resource --move' command was designed for atomic resources and could not handle resources on clones, masters, or slaves present on multiple nodes. Consequently, crm_resource could not obtain enough information to move a resource and did not perform any action. The '--ban' and '--clear' options have been added to allow the administrator to instruct the cluster unambiguously. Clone, master, and slave resources can now be navigated within the cluster as expected. (BZ#902407) * The hacluster user account did not have a user identification (UID) or group identification (GID) number reserved on the system. Thus, UID and GID values were picked randomly during the installation process. The UID and GID number 189 was reserved for hacluster and is now used consistently for all installations. (BZ#908450) * Certain clusters used node host names that did not match the output of the 'uname -n' command. Thus, the default node name used by the crm_standby and crm_failcount commands was incorrect and caused the cluster to ignore the update by the administrator. The crm_node command is now used instead of the uname utility in helper scripts. As a result, the cluster behaves as expected. (BZ#913093) * Due to incorrect return code handling, internal recovery logic of the crm_mon utility was not executed when a configuration updated failed to apply, leading to an assertion failure. Return codes are now checked correctly, and the recovery of an expected error state is now handled transparently. (BZ#951371) * cman's automatic unfencing feature failed when combined with Pacemaker. Support for automated unfencing in Pacemaker has been added, and the unwanted behavior no longer occurs. (BZ#996850) All pacemaker users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 79169
    published 2014-11-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79169
    title CentOS 6 : pacemaker (CESA-2013:1635)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2013-1635.NASL
    description Updated pacemaker packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. Pacemaker is a high-availability cluster resource manager with a powerful policy engine. A denial of service flaw was found in the way Pacemaker performed authentication and processing of remote connections in certain circumstances. When Pacemaker was configured to allow remote Cluster Information Base (CIB) configuration or resource management, a remote attacker could use this flaw to cause Pacemaker to block indefinitely (preventing it from serving other requests). (CVE-2013-0281) Note: The default Pacemaker configuration in Red Hat Enterprise Linux 6 has the remote CIB management functionality disabled. The pacemaker package has been upgraded to upstream version 1.1.10, which provides a number of bug fixes and enhancements over the previous version : * Pacemaker no longer assumes unknown cman nodes are safely stopped. * The core dump file now converts all exit codes into positive 'errno' values. * Pacemaker ensures a return to a stable state after too many fencing failures, and initiates a shutdown if a node claimed to be fenced is still active. * The crm_error tool adds the ability to list and print error symbols. * The crm_resource command allows individual resources to be reprobed, and implements the '--ban' option for moving resources away from nodes. The '--clear' option has replaced the '--unmove' option. Also, crm_resource now supports OCF tracing when using the '--force' option. * The IPC mechanism restores the ability for members of the haclient group to connect to the cluster. * The Policy Engine daemon allows active nodes in the current membership to be fenced without quorum. * Policy Engine now suppresses meaningless IDs when displaying anonymous clone status, supports maintenance mode for a single node, and correctly handles the recovered resources before they are operated on. * XML configuration files are now checked for non-printing characters and replaced with their octal equivalent when exporting XML text. Also, a more reliable buffer allocation strategy has been implemented to prevent lockups. (BZ#987355) Additional bug fixes : * The 'crm_resource --move' command was designed for atomic resources and could not handle resources on clones, masters, or slaves present on multiple nodes. Consequently, crm_resource could not obtain enough information to move a resource and did not perform any action. The '--ban' and '--clear' options have been added to allow the administrator to instruct the cluster unambiguously. Clone, master, and slave resources can now be navigated within the cluster as expected. (BZ#902407) * The hacluster user account did not have a user identification (UID) or group identification (GID) number reserved on the system. Thus, UID and GID values were picked randomly during the installation process. The UID and GID number 189 was reserved for hacluster and is now used consistently for all installations. (BZ#908450) * Certain clusters used node host names that did not match the output of the 'uname -n' command. Thus, the default node name used by the crm_standby and crm_failcount commands was incorrect and caused the cluster to ignore the update by the administrator. The crm_node command is now used instead of the uname utility in helper scripts. As a result, the cluster behaves as expected. (BZ#913093) * Due to incorrect return code handling, internal recovery logic of the crm_mon utility was not executed when a configuration updated failed to apply, leading to an assertion failure. Return codes are now checked correctly, and the recovery of an expected error state is now handled transparently. (BZ#951371) * cman's automatic unfencing feature failed when combined with Pacemaker. Support for automated unfencing in Pacemaker has been added, and the unwanted behavior no longer occurs. (BZ#996850) All pacemaker users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 71012
    published 2013-11-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=71012
    title RHEL 6 : pacemaker (RHSA-2013:1635)
redhat via4
advisories
bugzilla
id 1011618
title Slave roles inconsistent in pcs status xml (or crm_mon)
oval
AND
  • OR
    • comment Red Hat Enterprise Linux 6 Client is installed
      oval oval:com.redhat.rhsa:tst:20100842001
    • comment Red Hat Enterprise Linux 6 Server is installed
      oval oval:com.redhat.rhsa:tst:20100842002
    • comment Red Hat Enterprise Linux 6 Workstation is installed
      oval oval:com.redhat.rhsa:tst:20100842003
    • comment Red Hat Enterprise Linux 6 ComputeNode is installed
      oval oval:com.redhat.rhsa:tst:20100842004
  • OR
    • AND
      • comment pacemaker is earlier than 0:1.1.10-14.el6
        oval oval:com.redhat.rhsa:tst:20131635005
      • comment pacemaker is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20131635006
    • AND
      • comment pacemaker-cli is earlier than 0:1.1.10-14.el6
        oval oval:com.redhat.rhsa:tst:20131635013
      • comment pacemaker-cli is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20131635014
    • AND
      • comment pacemaker-cluster-libs is earlier than 0:1.1.10-14.el6
        oval oval:com.redhat.rhsa:tst:20131635015
      • comment pacemaker-cluster-libs is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20131635016
    • AND
      • comment pacemaker-cts is earlier than 0:1.1.10-14.el6
        oval oval:com.redhat.rhsa:tst:20131635017
      • comment pacemaker-cts is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20131635018
    • AND
      • comment pacemaker-doc is earlier than 0:1.1.10-14.el6
        oval oval:com.redhat.rhsa:tst:20131635011
      • comment pacemaker-doc is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20131635012
    • AND
      • comment pacemaker-libs is earlier than 0:1.1.10-14.el6
        oval oval:com.redhat.rhsa:tst:20131635007
      • comment pacemaker-libs is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20131635008
    • AND
      • comment pacemaker-libs-devel is earlier than 0:1.1.10-14.el6
        oval oval:com.redhat.rhsa:tst:20131635009
      • comment pacemaker-libs-devel is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20131635010
    • AND
      • comment pacemaker-remote is earlier than 0:1.1.10-14.el6
        oval oval:com.redhat.rhsa:tst:20131635019
      • comment pacemaker-remote is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20131635020
rhsa
id RHSA-2013:1635
released 2013-11-21
severity Low
title RHSA-2013:1635: pacemaker security, bug fix, and enhancement update (Low)
rpms
  • pacemaker-0:1.1.10-14.el6
  • pacemaker-cli-0:1.1.10-14.el6
  • pacemaker-cluster-libs-0:1.1.10-14.el6
  • pacemaker-cts-0:1.1.10-14.el6
  • pacemaker-doc-0:1.1.10-14.el6
  • pacemaker-libs-0:1.1.10-14.el6
  • pacemaker-libs-devel-0:1.1.10-14.el6
  • pacemaker-remote-0:1.1.10-14.el6
refmap via4
confirm
Last major update 27-02-2014 - 18:15
Published 23-11-2013 - 06:55
Last modified 22-04-2019 - 13:48
Back to Top