Test Kennung:	1.3.6.1.4.1.25623.1.0.882267
Kategorie:	CentOS Local Security Checks
Titel:	CentOS Update for pcs CESA-2015:1700 centos7
Zusammenfassung:	Check the version of pcs
Beschreibung:	Summary: Check the version of pcs Vulnerability Insight: The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. A command injection flaw was found in the pcsd web UI. An attacker able to trick a victim that was logged in to the pcsd web UI into visiting a specially crafted URL could use this flaw to execute arbitrary code with root privileges on the server hosting the web UI. (CVE-2015-5190) A race condition was found in the way the pcsd web UI backend performed authorization of user requests. An attacker could use this flaw to send a request that would be evaluated as originating from a different user, potentially allowing the attacker to perform actions with permissions of a more privileged user. (CVE-2015-5189) These issues were discovered by Tom Jelnek of Red Hat. All pcs users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. Affected Software/OS: pcs on CentOS 7 Solution: Please install the updated packages. CVSS Score: 8.5 CVSS Vector: AV:N/AC:M/Au:S/C:C/I:C/A:C
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2015-5189 RHSA-2015:1700 http://rhn.redhat.com/errata/RHSA-2015-1700.html https://bugzilla.redhat.com/show_bug.cgi?id=1252805 Common Vulnerability Exposure (CVE) ID: CVE-2015-5190 https://bugzilla.redhat.com/show_bug.cgi?id=1252813
Copyright	Copyright (C) 2015 Greenbone AG

Dies ist nur einer von 146377 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.