CVE-2015-5190

Related Files

Red Hat Security Advisory 2015-1700-01

Posted Sep 2, 2015

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2015-1700-01 - The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. A command injection flaw was found in the pcsd web UI. An attacker able to trick a victim that was logged in to the pcsd web UI into visiting a specially crafted URL could use this flaw to execute arbitrary code with root privileges on the server hosting the web UI. A race condition was found in the way the pcsd web UI backend performed authorization of user requests. An attacker could use this flaw to send a request that would be evaluated as originating from a different user, potentially allowing the attacker to perform actions with permissions of a more privileged user.

tags | advisory, web, arbitrary, root

systems | linux, redhat

advisories | CVE-2015-5189, CVE-2015-5190

SHA-256 | caa0579af87245b036a5b5b06d31782c44383e9a1a5c8713f7fbdcc5478fd98b

Download | Favorite | View