Security update for pacemaker SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:2869-1 Final 1 1 2016-11-22T11:05:30Z current 2016-11-22T11:05:30Z 2016-11-22T11:05:30Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for pacemaker This update for pacemaker fixes the following issues: Security issues fixed: - CVE-2016-7797: Notify other clients of a new connection only if the handshake has completed (bsc#967388, bsc#1002767). - CVE-2016-7035: Fixed improper IPC guarding in pacemaker (bsc#1007433). Bug fixes: - bsc#1003565: crmd: Record pending operations in the CIB before they are performed - bsc#1000743: pengine: Do not fence a maintenance node if it shuts down cleanly - bsc#987348: ping: Avoid temporary files for fping check - bsc#986644: libcrmcommon: report errors consistently when waiting for data on connection - bsc#986644: remote: Correctly calculate the remaining timeouts when receiving messages The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-HA-12-SP2-2016-1679,SUSE-SLE-SDK-12-SP2-2016-1679 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20162869-1/ Link for SUSE-SU-2016:2869-1 https://lists.suse.com/pipermail/sle-security-updates/2016-November/002408.html E-Mail link for SUSE-SU-2016:2869-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1000743 SUSE Bug 1000743 https://bugzilla.suse.com/1002767 SUSE Bug 1002767 https://bugzilla.suse.com/1003565 SUSE Bug 1003565 https://bugzilla.suse.com/1007433 SUSE Bug 1007433 https://bugzilla.suse.com/967388 SUSE Bug 967388 https://bugzilla.suse.com/986644 SUSE Bug 986644 https://bugzilla.suse.com/987348 SUSE Bug 987348 https://www.suse.com/security/cve/CVE-2016-7035/ SUSE CVE CVE-2016-7035 page https://www.suse.com/security/cve/CVE-2016-7797/ SUSE CVE CVE-2016-7797 page SUSE Linux Enterprise High Availability Extension 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP2 libpacemaker3-1.1.15-21.1 pacemaker-1.1.15-21.1 pacemaker-cli-1.1.15-21.1 pacemaker-cts-1.1.15-21.1 pacemaker-remote-1.1.15-21.1 libpacemaker-devel-1.1.15-21.1 libpacemaker3-1.1.15-21.1 as a component of SUSE Linux Enterprise High Availability Extension 12 SP2 pacemaker-1.1.15-21.1 as a component of SUSE Linux Enterprise High Availability Extension 12 SP2 pacemaker-cli-1.1.15-21.1 as a component of SUSE Linux Enterprise High Availability Extension 12 SP2 pacemaker-cts-1.1.15-21.1 as a component of SUSE Linux Enterprise High Availability Extension 12 SP2 pacemaker-remote-1.1.15-21.1 as a component of SUSE Linux Enterprise High Availability Extension 12 SP2 libpacemaker-devel-1.1.15-21.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 pacemaker-cts-1.1.15-21.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface. An attacker with an unprivileged account on a Pacemaker node could use this flaw to, for example, force the Local Resource Manager daemon to execute a script as root and thereby gain root access on the machine. CVE-2016-7035 SUSE Linux Enterprise High Availability Extension 12 SP2:libpacemaker3-1.1.15-21.1 SUSE Linux Enterprise High Availability Extension 12 SP2:pacemaker-1.1.15-21.1 SUSE Linux Enterprise High Availability Extension 12 SP2:pacemaker-cli-1.1.15-21.1 SUSE Linux Enterprise High Availability Extension 12 SP2:pacemaker-cts-1.1.15-21.1 SUSE Linux Enterprise High Availability Extension 12 SP2:pacemaker-remote-1.1.15-21.1 SUSE Linux Enterprise Software Development Kit 12 SP2:libpacemaker-devel-1.1.15-21.1 SUSE Linux Enterprise Software Development Kit 12 SP2:pacemaker-cts-1.1.15-21.1 important 6.8 AV:L/AC:L/Au:S/C:C/I:C/A:C 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162869-1/ https://www.suse.com/security/cve/CVE-2016-7035.html CVE-2016-7035 https://bugzilla.suse.com/1007433 SUSE Bug 1007433 Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection. CVE-2016-7797 SUSE Linux Enterprise High Availability Extension 12 SP2:libpacemaker3-1.1.15-21.1 SUSE Linux Enterprise High Availability Extension 12 SP2:pacemaker-1.1.15-21.1 SUSE Linux Enterprise High Availability Extension 12 SP2:pacemaker-cli-1.1.15-21.1 SUSE Linux Enterprise High Availability Extension 12 SP2:pacemaker-cts-1.1.15-21.1 SUSE Linux Enterprise High Availability Extension 12 SP2:pacemaker-remote-1.1.15-21.1 SUSE Linux Enterprise Software Development Kit 12 SP2:libpacemaker-devel-1.1.15-21.1 SUSE Linux Enterprise Software Development Kit 12 SP2:pacemaker-cts-1.1.15-21.1 important 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162869-1/ https://www.suse.com/security/cve/CVE-2016-7797.html CVE-2016-7797 https://bugzilla.suse.com/1002767 SUSE Bug 1002767