corosync before version 2.4.4 is vulnerable to an integer overflow in exec/totemcrypto.c.

The remote host is affected by the vulnerability described in GLSA-202107-01 (corosync: Denial of service)

    It was discovered that corosync allowed an unauthenticated user to cause       a Denial of Service by application crash.
  Impact :

    A remote attacker could send a malicious crafted packet, possibly       resulting in a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has corosync packages installed that are affected by a vulnerability:

  - An integer overflow leading to an out-of-bound read was     found in authenticate_nss_2_3() in Corosync. An attacker     could craft a malicious packet that would lead to a     denial of service. (CVE-2018-1084)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that Corosync incorrectly handled certain requests.
An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New upstream release with security fix for CVE-2018-1084

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for corosync is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The corosync packages provide the Corosync Cluster Engine and C APIs for Red Hat Enterprise Linux cluster software.

Security Fix(es) :

* corosync: Integer overflow in exec/totemcrypto.c:authenticate_nss_2_3() function (CVE-2018-1084)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Citrix Security Response Team for reporting this issue.

Integer overflow in exec/totemcrypto.c:authenticate_nss_2_3() function

An integer overflow leading to an out-of-bound read was found in authenticate_nss_2_3() in Corosync. An attacker could craft a malicious packet that would lead to a denial of service.(CVE-2018-1084)

This update for corosync fixes the following issues :

  - CVE-2018-1084: Integer overflow in     totemcrypto:authenticate_nss_2_3() could lead to command     execution (bsc#1089346)

  - Providing an empty uid or gid results in coroparse     adding uid 0. (bsc#1066585)

  - Fix a problem with configuration file incompatibilities     that was causing corosync to not work after upgrading     from SLE-11-SP4-HA to SLE-12/15-HA. (bsc#1083561)

This update was imported from the SUSE:SLE-12-SP3:Update update project.

Security Fix(es) :

  - corosync: Integer overflow in     exec/totemcrypto.c:authenticate_nss_2_3() function     (CVE-2018-1084)

From Red Hat Security Advisory 2018:1169 :

An update for corosync is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The corosync packages provide the Corosync Cluster Engine and C APIs for Red Hat Enterprise Linux cluster software.

Security Fix(es) :

* corosync: Integer overflow in exec/totemcrypto.c:authenticate_nss_2_3() function (CVE-2018-1084)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Citrix Security Response Team for reporting this issue.

The Citrix Security Response Team discovered that corosync, a cluster engine implementation, allowed an unauthenticated user to cause a denial-of-service by application crash.

ID	Name	Product	Family	Severity
157012	GLSA-202107-01 : corosync: Denial of service	Nessus	Gentoo Local Security Checks	high
127226	NewStart CGSL CORE 5.04 / MAIN 5.04 : corosync Vulnerability (NS-SA-2019-0046)	Nessus	NewStart CGSL Local Security Checks	high
125623	Ubuntu 16.04 LTS / 18.04 LTS : Corosync vulnerability (USN-4000-1)	Nessus	Ubuntu Local Security Checks	high
120244	Fedora 28 : corosync (2018-12da088117)	Nessus	Fedora Local Security Checks	critical
110239	CentOS 7 : corosync (CESA-2018:1169)	Nessus	CentOS Local Security Checks	critical
109693	Amazon Linux 2 : corosync (ALAS-2018-1014)	Nessus	Amazon Linux Local Security Checks	high
109541	openSUSE Security Update : corosync (openSUSE-2018-417)	Nessus	SuSE Local Security Checks	critical
109460	Scientific Linux Security Update : corosync on SL7.x x86_64 (20180417)	Nessus	Scientific Linux Local Security Checks	high
109439	Oracle Linux 7 : corosync (ELSA-2018-1169)	Nessus	Oracle Linux Local Security Checks	critical
109189	Fedora 26 : corosync (2018-d87e29047d)	Nessus	Fedora Local Security Checks	critical
109151	Fedora 27 : corosync (2018-b0253649be)	Nessus	Fedora Local Security Checks	critical
109117	RHEL 7 : corosync (RHSA-2018:1169)	Nessus	Red Hat Local Security Checks	critical
109092	Debian DSA-4174-1 : corosync - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-1084

high

Tenable Plugins

high

high

high

critical

critical

high

critical

high

critical

critical

critical

critical

high