Session fixation vulnerability in pcsd in pcs before 0.9.157.

The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2016-896:01 advisory.

    pcs is a corosync and pacemaker configuration tool.  It permits users to     easily view, modify and created pacemaker based clusters.
    Security issues fixed with this release:
    CVE-2016-0720
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-0721
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    The following packages have been upgraded to a newer upstream version: pcs (0.9.152).
    Additional Changes:

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Session fixation vulnerability in pcsd in pcs before 0.9.157. (CVE-2016-0721)

Note that Nessus relies on the presence of the package as reported by the vendor.

The following packages have been upgraded to a newer upstream version:
pcs (0.9.152).

Security Fix(es) :

  - A Cross-Site Request Forgery (CSRF) flaw was found in     the pcsd web UI. A remote attacker could provide a     specially crafted web page that, when visited by a user     with a valid pcsd session, would allow the attacker to     trigger requests on behalf of the user, for example     removing resources or restarting/removing nodes.
    (CVE-2016-0720)

  - It was found that pcsd did not invalidate cookies on the     server side when a user logged out. This could     potentially allow an attacker to perform session     fixation attacks on pcsd. (CVE-2016-0721)

These issues were discovered by Martin Prpic (Red Hat Product Security).

Additional Changes :

An update for pcs is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

The following packages have been upgraded to a newer upstream version:
pcs (0.9.152). (BZ#1299847)

Security Fix(es) :

* A Cross-Site Request Forgery (CSRF) flaw was found in the pcsd web UI. A remote attacker could provide a specially crafted web page that, when visited by a user with a valid pcsd session, would allow the attacker to trigger requests on behalf of the user, for example removing resources or restarting/removing nodes. (CVE-2016-0720)

* It was found that pcsd did not invalidate cookies on the server side when a user logged out. This could potentially allow an attacker to perform session fixation attacks on pcsd. (CVE-2016-0721)

These issues were discovered by Martin Prpic (Red Hat Product Security).

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2016:2596 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    The following packages have been upgraded to a newer upstream version: pcs (0.9.152). (BZ#1299847)

    Security Fix(es):

    * A Cross-Site Request Forgery (CSRF) flaw was found in the pcsd web UI. A remote attacker could provide a     specially crafted web page that, when visited by a user with a valid pcsd session, would allow the     attacker to trigger requests on behalf of the user, for example removing resources or restarting/removing     nodes. (CVE-2016-0720)

    * It was found that pcsd did not invalidate cookies on the server side when a user logged out. This could     potentially allow an attacker to perform session fixation attacks on pcsd. (CVE-2016-0721)

    These issues were discovered by Martin Prpic (Red Hat Product Security).

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- Re-synced to upstream sources * Security fix for     CVE-2016-0720, CVE-2016-0721

    - Rubygems built with RELRO * Spec file cleanup * Fixed       multilib .pyc/.pyo issue ---- * Re-synced to upstream       sources * Security fix for CVE-2016-0720,       CVE-2016-0721 * Rubygems built with RELRO * Spec file       cleanup * Fixed multilib .pyc/.pyo issue

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Added missing python-lxml dependency ---- * Re-synced to upstream sources * Security fix for CVE-2016-0720, CVE-2016-0721 * Rubygems built with RELRO * Spec file cleanup * Fixed multilib .pyc/.pyo issue

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
290112	MiracleLinux 7 : pcs-0.9.152-10.el7 (AXSA:2016-896:01)	Nessus	Miracle Linux Local Security Checks	high
219188	Linux Distros Unpatched Vulnerability : CVE-2016-0721	Nessus	Misc.	high
95853	Scientific Linux Security Update : pcs on SL7.x x86_64 (20161103)	Nessus	Scientific Linux Local Security Checks	high
95342	CentOS 7 : pcs (CESA-2016:2596)	Nessus	CentOS Local Security Checks	high
94559	RHEL 7 : pcs (RHSA-2016:2596)	Nessus	Red Hat Local Security Checks	high
89617	Fedora 23 : pcs-0.9.149-2.fc23 (2016-cdd4228cc7)	Nessus	Fedora Local Security Checks	high
89516	Fedora 22 : pcs-0.9.149-2.fc22 (2016-3b20c4ec9d)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2016-0721

high

Tenable Plugins

high

high

high

high

high

high

high