CVE-2016-7035: High severity ClusterLabs Pacemaker vulnerability
An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface. An attacker with an unprivileged account on a Pacemaker node could use this flaw to, for example, force the Local Resource Manager daemon to execute a script as root and thereby gain root access on the machine.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this flaw?
The vulnerability ID for this flaw is CVE-2016-7035.
What is the severity of CVE-2016-7035?
CVE-2016-7035 has a severity score of 7.8 (high).
Which software versions are affected by this vulnerability?
Clusterlabs Pacemaker versions up to and including 1.1.16, Redhat Enterprise Linux Server versions 6.0, 7.0, Redhat Enterprise Linux Server Eus versions 7.3, 7.4, 7.5, and 7.6 are affected by this vulnerability.
How can an attacker exploit this vulnerability?
An attacker with an unprivileged account on a Pacemaker node could use this vulnerability to force the Local Resource Manager daemon to execute a script as root and gain root access.
What is the Common Weakness Enumeration (CWE) ID for this vulnerability?
The CWE ID for this vulnerability is CWE-285.