CVE-2016-7035
Fixed in a distro release EPSS <1%CVSS 8.8
An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface. An attacker with an unprivileged account on a Pacemaker node could use this flaw to, for example, force the Local Resource Manager daemon to execute a script as root and thereby gain root access on the machine.
Products: clusterlabs pacemaker
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | pacemaker | 1.1.15-3 |
| Debian 13 | pacemaker | 1.1.15-3 |
| Debian 14 | pacemaker | 1.1.15-3 |
| Red Hat Enterprise Linux 6 | pacemaker | 0:1.1.14-8.el6_8.2 |
| Red Hat Enterprise Linux 6 | pacemaker-cli | 0:1.1.14-8.el6_8.2 |
| Red Hat Enterprise Linux 6 | pacemaker-cluster-libs | 0:1.1.14-8.el6_8.2 |
| Red Hat Enterprise Linux 6 | pacemaker-cts | 0:1.1.14-8.el6_8.2 |
| Red Hat Enterprise Linux 6 | pacemaker-debuginfo | 0:1.1.14-8.el6_8.2 |
| Red Hat Enterprise Linux 6 | pacemaker-doc | 0:1.1.14-8.el6_8.2 |
| Red Hat Enterprise Linux 6 | pacemaker-libs | 0:1.1.14-8.el6_8.2 |
| Red Hat Enterprise Linux 6 | pacemaker-libs-devel | 0:1.1.14-8.el6_8.2 |
| Red Hat Enterprise Linux 6 | pacemaker-remote | 0:1.1.14-8.el6_8.2 |
| Red Hat Enterprise Linux 7 | pacemaker | 0:1.1.15-11.el7_3.2 |
| Red Hat Enterprise Linux 7 | pacemaker-cli | 0:1.1.15-11.el7_3.2 |
| Red Hat Enterprise Linux 7 | pacemaker-cluster-libs | 0:1.1.15-11.el7_3.2 |
| Red Hat Enterprise Linux 7 | pacemaker-cts | 0:1.1.15-11.el7_3.2 |
| Red Hat Enterprise Linux 7 | pacemaker-debuginfo | 0:1.1.15-11.el7_3.2 |
| Red Hat Enterprise Linux 7 | pacemaker-doc | 0:1.1.15-11.el7_3.2 |
| Red Hat Enterprise Linux 7 | pacemaker-libs | 0:1.1.15-11.el7_3.2 |
| Red Hat Enterprise Linux 7 | pacemaker-libs-devel | 0:1.1.15-11.el7_3.2 |
| Red Hat Enterprise Linux 7 | pacemaker-nagios-plugins-metadata | 0:1.1.15-11.el7_3.2 |
| Red Hat Enterprise Linux 7 | pacemaker-remote | 0:1.1.15-11.el7_3.2 |
| SUSE Linux Enterprise High Availability Extension 11 SP4 | pacemaker | 1.1.12-18.1 |
| SUSE Linux Enterprise High Availability Extension 12 SP1 | pacemaker | 1.1.13-20.1 |
| SUSE Linux Enterprise High Availability Extension 12 SP2 | pacemaker | 1.1.15-21.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP1 | pacemaker | 1.1.13-20.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP2 | pacemaker | 1.1.15-21.1 |
| Ubuntu 14.04 LTS | pacemaker | 1.1.10+git20130802-1ubuntu2.4 |
| Ubuntu 16.04 LTS | pacemaker | 1.1.14-2ubuntu1.2 |