Back to Database
Status published
High
CVE-2016-7035
An authorization flaw was found in Pacemaker before 1.1.16, where...
Vulnerability Description
An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface. An attacker with an unprivileged account on a Pacemaker node could use this flaw to, for example, force the Local Resource Manager daemon to execute a script as root and thereby gain root access on the machine.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2016-7035
Credits & Attribution
No credits recorded in the NVD database.
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7035
- http://rhn.redhat.com/errata/RHSA-2016-2614.html
- https://security.gentoo.org/glsa/201710-08
- http://www.openwall.com/lists/oss-security/2016/11/03/5
- http://rhn.redhat.com/errata/RHSA-2016-2675.html
- https://lists.clusterlabs.org/pipermail/users/2016-November/004432.html
- https://github.com/ClusterLabs/pacemaker/commit/5d71e65049
- http://www.securityfocus.com/bid/94214
More from ClusterLabs
View All →CVE-2019-3885
A use-after-free flaw was found in pacemaker up to and...
Low
3.3
CVE-2019-10153
A flaw was discovered in fence-agents, prior to version 4.3.4,...
Medium
5
CVE-2018-16878
A flaw was found in pacemaker up to and including...
Medium
6.2
CVE-2018-16877
A flaw was found in the way pacemaker's client-server authentication...
High
8.8
CVE-2017-2661
ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site...
Medium
6.1
Affected Vendor
ClusterLabs
View all reports →Affected Software
pacemaker
Vulnerable Versions:
1.1.16
Timeline
Official Publish:
September 10th, 2018
Last Modified:
August 6th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H