CVE-2015-1867
First published: Mon Apr 13 2015(Updated: )
Franck Grosjean of Red Hat reports: Description of problem: acl definitions are not enforced and could be bypassed by a user without write access to the cib Version-Release number of selected component (if applicable): RedHat Enterprise Linux 6.6 pcs --version = 0.9.123 pacemakerd --version = Pacemaker 1.1.11 How reproducible: a user with a read-only role can assign any other existing roles to himself and then gain any kind of access from any role (rw access to the cib if this kind of role exist). Steps to Reproduce: 1. create a role read-only pcs acl role create read-only description="Read only access" read xpath /cib 2. create a role admin pcs acl role create admin description="Admin access" write xpath /cib 3. create an account (local + pcs) 4. open a session with this roaccount account 5. add admin role to your account pcs acl role assign admin to rocluster 6. check new acl pushed as a read-only user pcs acl User: rocluster Roles: read-only admin Role: read-only Description: Read only access Permission: read xpath /cib (read-only-read) Role: admin Description: Admin access Permission: write xpath /cib (admin-write) 7. add/delete/modify anything Actual results: obtain rw access to the cib Expected results: must not be possible with read-only access to the cib to assign a role Additional info: Introduced in: <a href="https://github.com/ClusterLabs/pacemaker/commit/f242c1ef">https://github.com/ClusterLabs/pacemaker/commit/f242c1ef</a> Fixed in: <a href="https://github.com/ClusterLabs/pacemaker/commit/84ac07c">https://github.com/ClusterLabs/pacemaker/commit/84ac07c</a>
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat Enterprise Linux High Availability | =6.0 | |
| Red Hat Enterprise Linux High Availability | =7.0 | |
| Red Hat Enterprise Linux Resilient Storage | =6.0 | |
| Red Hat Enterprise Linux Resilient Storage | =7.0 | |
| CentOS Pacemaker-libs | <=1.1.12 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/ClusterLabs/pacemaker/commit/f242c1ef
- https://github.com/ClusterLabs/pacemaker/commit/84ac07c
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1238846
- https://rhn.redhat.com/errata/RHSA-2015-1424.html
- https://rhn.redhat.com/errata/RHSA-2015-2383.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1211370
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170610.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169671.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169995.html
- http://rhn.redhat.com/errata/RHSA-2015-1424.html
- http://rhn.redhat.com/errata/RHSA-2015-2383.html
- http://www.securityfocus.com/bid/74231
- https://security.gentoo.org/glsa/201710-08
Frequently Asked Questions
What is the severity of CVE-2015-1867?
CVE-2015-1867 is classified as a medium severity vulnerability.
How do I fix CVE-2015-1867?
To fix CVE-2015-1867, update the affected packages to the latest version where the vulnerability is patched.
What systems are affected by CVE-2015-1867?
CVE-2015-1867 affects Red Hat Enterprise Linux versions 6.0, 6.6, 7.0, and certain versions of the Pacemaker Command Line Interface.
What is the nature of the vulnerability in CVE-2015-1867?
CVE-2015-1867 allows users without write access to bypass access control list (ACL) definitions.
Who reported the CVE-2015-1867 vulnerability?
CVE-2015-1867 was reported by Franck Grosjean of Red Hat.
- collector/redhat-bugzilla
- alias/CVE-2015-1867
- agent/first-publish-date
- agent/last-modified-date
- agent/type
- agent/description
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/event
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/redhat
- canonical/red hat enterprise linux high availability
- version/red hat enterprise linux high availability/6.0
- version/red hat enterprise linux high availability/7.0
- canonical/red hat enterprise linux resilient storage
- version/red hat enterprise linux resilient storage/6.0
- version/red hat enterprise linux resilient storage/7.0
- vendor/clusterlabs
- canonical/centos pacemaker-libs
- version/centos pacemaker-libs/1.1.12