The puppet manifests in the Red Hat openstack-puppet-modules package before 2014.2.13-2 uses a default password of CHANGEME for the pcsd daemon, which allows remote attackers to execute arbitrary shell commands via unspecified vectors.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:0791 advisory.

    Red Hat Enterprise OpenStack Platform Installer is a deployment management     tool. It provides a web user interface for managing the installation and     configuration of remote systems. Deployment of changes is performed using     Puppet. Additionally, Dynamic Host Configuration Protocol (DHCP), Domain     Name System (DNS), Preboot Execution Environment (PXE), and Trivial File     Transfer Protocol (TFTP) services can be provided. Controlling these     services also enables provisioning of physical systems that do not yet have     an operating system installed.

    It was discovered that the puppet manifests, as provided with the     openstack-puppet-modules package, would configure the pcsd daemon with a     known default password. If this password was not changed and an attacker     was able to gain access to pcsd, they could potentially run shell commands     as root. (CVE-2015-1842)

    Note: This flaw only affects Red Hat Enterprise Linux OpenStack Platform     installations deployed using the HA feature set.

    For additional information on addressing this flaw see:
    https://access.redhat.com/articles/1396123

    This issue was discovered by Alessandro Vozza of Red Hat.

    In addition to the above issue, this update also addresses multiple bugs     which are documented in the Red Hat Enterprise Linux OpenStack Platform     Technical Notes, linked to in the References section.

    All Red Hat Enterprise Linux OpenStack Platform Installer users are advised     to upgrade to these updated packages, which correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:0832 advisory.

    PackStack is a command-line utility for deploying OpenStack on existing     servers over an SSH connection. Deployment options are provided either     interactively, using the command line, or non-interactively by means of a     text file containing a set of preconfigured values for OpenStack     parameters. PackStack is suitable for deploying proof-of-concept     installations.

    It was discovered that the puppet manifests, as provided with the     openstack-puppet-modules package, would configure the pcsd daemon with a     known default password. If this password was not changed and an attacker     was able to gain access to pcsd, they could potentially run shell commands     as root. (CVE-2015-1842)

    This issue was discovered by Alessandro Vozza of Red Hat.

    This update also adds the following enhancement:

    * If OpenStack Networking (neutron) is enabled, Packstack now displays a     warning if the Network Manager service is active on hosts. (BZ#1117115)

    All openstack-packstack and openstack-puppet-modules users are advised to     upgrade to these updated packages, which correct these issues and add     this enhancement.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:0789 advisory.

    PackStack is a command-line utility for deploying OpenStack on existing     servers over an SSH connection. Deployment options are provided either     interactively, using the command line, or non-interactively by means of a     text file containing a set of preconfigured values for OpenStack     parameters. PackStack is suitable for proof-of-concept installations.
    PackStack is suitable for deploying proof-of-concept installations.

    It was discovered that the puppet manifests, as provided with the     openstack-puppet-modules package, would configure the pcsd daemon with a     known default password. If this password was not changed and an attacker     was able to gain access to pcsd, they could potentially run shell commands     as root. (CVE-2015-1842)

    This issue was discovered by Alessandro Vozza of Red Hat.

    This update also fixes the following bugs:

    * If OpenStack Networking is enabled, Packstack would display a warning if     the Network Manager service is active on hosts. (BZ#1117277)

    * A quiet dependency on a newer version of selinux-policy causes     openstack-selinux 0.6.23 to fail to install modules when paired with     selinux-policy packages from Red Hat Enterprise Linux 7.0 or 7.0.z.
    This causes Identity and other OpenStack services to receive 'AVC' denials     and malfunction under some circumstances. The following workarounds allow     the OpenStack services to function correctly:

    1) Leave openstack-selinux at 0.6.18-2.el7ost until you are ready to update     to Red Hat Enterprise Linux 7.1. At that time, a 'yum update' will resolve     the issue.

    2) Install the updated selinux-policy and selinux-policy-targeted packages     from Red Hat Enterprise Linux 7.1 (version selinux-policy-3.13.1-23.el7 or     later), then update openstack-selinux to version 0.6.23-1.el7ost.
    (BZ#1195252)

    * A typo in the code caused a Sahara option that uses OpenStack Networking     to be always false. Sahara now uses OpenStack Networking if the parameter     'CONFIG_NEUTRON_INSTALL is set to 'y'. (BZ#1199047)

    * Prior to this update, users had to install the OpenStack Unified Client     separately after an installation of Packstack. Packstack now installs it by     default. (BZ#1199114)

    * This enhancement updates Packstack to retain temporary directories when     running an installation in debug mode. This assists with troubleshooting     activities. As a result, temporary directories are not deleted when running     Packstack with the --debug command line option. (BZ#1199565)

    * Prior to this update, some validators did not use 'validate_not_empty' to     ensure that certain parameters contained values. As a result, a number of     internal validations could not be properly handled, leading to the     possibility of unexpected errors. This update fixes validators to use     validate_not_empty when required, resulting in correct validation behavior     from validators. (BZ#11995889)

    In addition to the above issues, this update also addresses bugs and     enhancements which can be found in the Red Hat Enterprise Linux OpenStack     Platform Technical Notes, linked to in the References section.

    All openstack-packstack and openstack-puppet-modules users are advised to     upgrade to these updated packages, which correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote ClusterLabs Pacemaker PCS daemon uses a known default set of credentials. This allows a remote attacker to run arbitrary commands on cluster members.

Note that some package deployment systems, such as Puppet, may be responsible for setting these default credentials.

ID	Name	Product	Family	Severity
210222	RHEL 7 : Red Hat Enterprise Linux OpenStack Platform Installer update (Important) (RHSA-2015:0791)	Nessus	Red Hat Local Security Checks	critical
210200	RHEL 6 : openstack-packstack and openstack-puppet-modules update (Important) (RHSA-2015:0832)	Nessus	Red Hat Local Security Checks	critical
210185	RHEL 7 : openstack-packstack and openstack-puppet-modules (RHSA-2015:0789)	Nessus	Red Hat Local Security Checks	critical
83266	ClusterLabs Pacemaker PCS Daemon Default Password	Nessus	Misc.	critical

Detections

Analytics

CVE-2015-1842

critical

Tenable Plugins

critical

critical

critical

critical