ACL Bypass Flaw in pacemaker
Summary
DLA-2447-1: pacemaker - security update. Affects pacemaker versions < 1.1.16-1+deb9u1. Fixed in 1.1.16-1+deb9u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pacemaker is a cluster resource manager used for high availability and load balancing in Linux clusters. It provides a set of tools and services to manage cluster resources and ensure their availability. Pacemaker is commonly used in environments where system uptime and reliability are critical. However, a vulnerability has been discovered in pacemaker that allows an attacker with local access and membership in the haclient group to bypass ACLs and perform unauthorized actions through direct IPC communication with various daemons.
Vulnerability Detail
The ACL bypass flaw in pacemaker allows an attacker to circumvent access control restrictions by leveraging IPC communication with daemons. By directly interacting with these daemons, the attacker can perform tasks that would normally be prevented by ACLs if accessed through the configuration. This vulnerability requires the attacker to have a local account on the cluster and be a member of the haclient group. The impact of this vulnerability could range from unauthorized access to sensitive resources to potential disruption of cluster operations.
How To Fix
Minimum fixed version
1.1.16-1+deb9u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade pacemakerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that only trusted users have local accounts on the cluster and are members of the haclient group. Additionally, it is important to regularly monitor and review access control configurations to detect any unauthorized changes or potential vulnerabilities.
Conclusion
The ACL bypass flaw in pacemaker poses a security risk to systems running Debian 9 stretch. It is crucial to upgrade to the patched version of pacemaker to mitigate this vulnerability. Regular monitoring and review of access control configurations can also help ensure the security of the cluster environment. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pacemaker →
FAQ
Pacemaker is a cluster resource manager used for high availability and load balancing in Linux clusters. It provides tools and services to manage cluster resources and ensure their availability.
Users of pacemaker on Debian 9 stretch are affected by this vulnerability if they have local accounts on the cluster and are members of the haclient group.
An attacker with the necessary access can bypass ACLs and perform unauthorized tasks through direct IPC communication with pacemaker daemons. This could potentially lead to unauthorized access to sensitive resources or disruption of cluster operations.
To fix this vulnerability, it is recommended to upgrade the pacemaker packages to version 1.1.16-1+deb9u1 or later. This update includes the necessary patches to address the ACL bypass flaw.
While no specific workaround is mentioned, users can mitigate the risk by ensuring that only trusted users have local accounts on the cluster and are members of the haclient group. Regular monitoring and review of access control configurations is also important.
Related vulnerabilities
Recent vulnerabilities recorded for pacemaker.
