Vulnerabilities > CVE-2016-7797 - 7PK - Security Features vulnerability in multiple products

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
HIGH

Summary

Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection.

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-3462-1.NASL
    descriptionJan Pokorny and Alain Moulle discovered that Pacemaker incorrectly handled the IPC interface. A local attacker could possibly use this issue to execute arbitrary code with root privileges. (CVE-2016-7035) Alain Moulle discovered that Pacemaker incorrectly handled authentication. A remote attacker could possibly use this issue to shut down connections, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-7797). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id104143
    published2017-10-25
    reporterUbuntu Security Notice (C) 2017-2019 Canonical, Inc. / NASL script (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/104143
    titleUbuntu 14.04 LTS / 16.04 LTS : pacemaker vulnerabilities (USN-3462-1)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-1376.NASL
    descriptionThis update for pacemaker fixes the following issues : Security issues fixed : - CVE-2016-7797: Notify other clients of a new connection only if the handshake has completed (bsc#967388, bsc#1002767). - CVE-2016-7035: Fixed improper IPC guarding in pacemaker (bsc#1007433). Bug fixes : - bsc#1003565: crmd: Record pending operations in the CIB before they are performed - bsc#1000743: pengine: Do not fence a maintenance node if it shuts down cleanly - bsc#987348: ping: Avoid temporary files for fping check - bsc#986644: libcrmcommon: report errors consistently when waiting for data on connection - bsc#986644: remote: Correctly calculate the remaining timeouts when receiving messages This update was imported from the SUSE:SLE-12-SP2:Update update project.
    last seen2020-06-05
    modified2016-12-05
    plugin id95531
    published2016-12-05
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95531
    titleopenSUSE Security Update : pacemaker (openSUSE-2016-1376)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20161104_PACEMAKER_ON_SL7_X.NASL
    descriptionThe following packages have been upgraded to a newer upstream version: pacemaker (1.1.15). Security Fix(es) : - It was found that the connection between a pacemaker cluster and a pacemaker_remote node could be shut down using a new unauthenticated connection. A remote attacker could use this flaw to cause a denial of service. (CVE-2016-7797) Additional Changes :
    last seen2020-03-18
    modified2016-12-16
    plugin id95914
    published2016-12-16
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95914
    titleScientific Linux Security Update : pacemaker on SL7.x x86_64 (20161104)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2016-2578.NASL
    descriptionAn update for pacemaker is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The Pacemaker cluster resource manager is a collection of technologies working together to provide data integrity and the ability to maintain application availability in the event of a failure. The following packages have been upgraded to a newer upstream version: pacemaker (1.1.15). (BZ#1304771) Security Fix(es) : * It was found that the connection between a pacemaker cluster and a pacemaker_remote node could be shut down using a new unauthenticated connection. A remote attacker could use this flaw to cause a denial of service. (CVE-2016-7797) Red Hat would like to thank Alain Moulle (ATOS/BULL) for reporting this issue. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.
    last seen2020-06-01
    modified2020-06-02
    plugin id94541
    published2016-11-04
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/94541
    titleRHEL 7 : pacemaker (RHSA-2016:2578)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-1447.NASL
    descriptionThis update for pacemaker fixes the following issues : - remote: Allow cluster and remote LRM API versions to diverge (bsc#1009076) - libcrmcommon: fix CVE-2016-7035 (improper IPC guarding) (bsc#1007433) - sysconfig: minor tweaks (typo, wording) - spec: more robust check for systemd being in use - spec: defines instead of some globals + error suppression - various: issues discovered via valgrind and coverity - attrd_updater: fix usage of HAVE_ATOMIC_ATTRD - crmd: cl#5185 - Record pending operations in the CIB before they are performed (bsc#1003565) - ClusterMon: fix to avoid matching other process with the same PID - mcp: improve comments for sysconfig options - remove openssl-devel and libselinux-devel as build dependencies - tools: crm_standby --version/--help should work without cluster - libpengine: only log startup-fencing warning once - pacemaker.service: do not mistakenly suggest killing fenced - libcrmcommon: report errors consistently when waiting for data on connection (bsc#986644) - remote: Correctly calculate the remaining timeouts when receiving messages (bsc#986644) - libfencing: report added node ID correctly - crm_mon: Do not call setenv with null value - pengine: Do not fence a maintenance node if it shuts down cleanly (bsc#1000743) - ping: Avoid temporary files for fping check (bsc#987348) - all: clarify licensing and copyrights - crmd: Resend the shutdown request if the DC forgets - ping: Avoid temp files in fping_check (bsc#987348) - crmd: Ensure the R_SHUTDOWN is set whenever we ask the DC to shut us down - crmd: clear remote node operation history only when it comes up - libcib,libfencing,libtransition: handle memory allocation errors without CRM_CHECK() - tools: make crm_mon XML schema handle resources with multiple active - pengine: set OCF_RESKEY_CRM_meta_notify_active_* for multistate resources - pengine: avoid null dereference in new same-node ordering option - lrmd,libcluster: ensure g_hash_table_foreach() is never passed a null table - crmd: don
    last seen2020-06-05
    modified2016-12-13
    plugin id95753
    published2016-12-13
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95753
    titleopenSUSE Security Update : pacemaker (openSUSE-2016-1447)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2016-2578.NASL
    descriptionAn update for pacemaker is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The Pacemaker cluster resource manager is a collection of technologies working together to provide data integrity and the ability to maintain application availability in the event of a failure. The following packages have been upgraded to a newer upstream version: pacemaker (1.1.15). (BZ#1304771) Security Fix(es) : * It was found that the connection between a pacemaker cluster and a pacemaker_remote node could be shut down using a new unauthenticated connection. A remote attacker could use this flaw to cause a denial of service. (CVE-2016-7797) Red Hat would like to thank Alain Moulle (ATOS/BULL) for reporting this issue. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.
    last seen2020-06-01
    modified2020-06-02
    plugin id95325
    published2016-11-28
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95325
    titleCentOS 7 : pacemaker (CESA-2016:2578)

Redhat

advisories
bugzilla
id1379784
titleCVE-2016-7797 pacemaker: pacemaker remote nodes vulnerable to hijacking, resulting in a DoS attack
oval
OR
  • commentRed Hat Enterprise Linux must be installed
    ovaloval:com.redhat.rhba:tst:20070304026
  • AND
    • commentRed Hat Enterprise Linux 7 is installed
      ovaloval:com.redhat.rhba:tst:20150364027
    • OR
      • AND
        • commentpacemaker-cluster-libs is earlier than 0:1.1.15-11.el7
          ovaloval:com.redhat.rhsa:tst:20162578001
        • commentpacemaker-cluster-libs is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20131635006
      • AND
        • commentpacemaker-cli is earlier than 0:1.1.15-11.el7
          ovaloval:com.redhat.rhsa:tst:20162578003
        • commentpacemaker-cli is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20131635004
      • AND
        • commentpacemaker-nagios-plugins-metadata is earlier than 0:1.1.15-11.el7
          ovaloval:com.redhat.rhsa:tst:20162578005
        • commentpacemaker-nagios-plugins-metadata is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20152383014
      • AND
        • commentpacemaker-doc is earlier than 0:1.1.15-11.el7
          ovaloval:com.redhat.rhsa:tst:20162578007
        • commentpacemaker-doc is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20131635014
      • AND
        • commentpacemaker-libs-devel is earlier than 0:1.1.15-11.el7
          ovaloval:com.redhat.rhsa:tst:20162578009
        • commentpacemaker-libs-devel is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20131635002
      • AND
        • commentpacemaker is earlier than 0:1.1.15-11.el7
          ovaloval:com.redhat.rhsa:tst:20162578011
        • commentpacemaker is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20131635008
      • AND
        • commentpacemaker-remote is earlier than 0:1.1.15-11.el7
          ovaloval:com.redhat.rhsa:tst:20162578013
        • commentpacemaker-remote is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20131635016
      • AND
        • commentpacemaker-cts is earlier than 0:1.1.15-11.el7
          ovaloval:com.redhat.rhsa:tst:20162578015
        • commentpacemaker-cts is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20131635012
      • AND
        • commentpacemaker-libs is earlier than 0:1.1.15-11.el7
          ovaloval:com.redhat.rhsa:tst:20162578017
        • commentpacemaker-libs is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20131635010
rhsa
idRHSA-2016:2578
released2016-11-03
severityModerate
titleRHSA-2016:2578: pacemaker security, bug fix, and enhancement update (Moderate)
rpms
  • pacemaker-0:1.1.15-11.el7
  • pacemaker-cli-0:1.1.15-11.el7
  • pacemaker-cluster-libs-0:1.1.15-11.el7
  • pacemaker-cts-0:1.1.15-11.el7
  • pacemaker-debuginfo-0:1.1.15-11.el7
  • pacemaker-doc-0:1.1.15-11.el7
  • pacemaker-libs-0:1.1.15-11.el7
  • pacemaker-libs-devel-0:1.1.15-11.el7
  • pacemaker-nagios-plugins-metadata-0:1.1.15-11.el7
  • pacemaker-remote-0:1.1.15-11.el7