Scientific Linux Security Update : pcs on SL6.x, SL7.x i386/x86_64
High Nessus Plugin ID 85760
SynopsisThe remote Scientific Linux host is missing one or more security updates.
DescriptionA command injection flaw was found in the pcsd web UI. An attacker able to trick a victim that was logged in to the pcsd web UI into visiting a specially crafted URL could use this flaw to execute arbitrary code with root privileges on the server hosting the web UI.
A race condition was found in the way the pcsd web UI backend performed authorization of user requests. An attacker could use this flaw to send a request that would be evaluated as originating from a different user, potentially allowing the attacker to perform actions with permissions of a more privileged user. (CVE-2015-5189)
SolutionUpdate the affected pcs, pcs-debuginfo and / or python-clufter packages.