A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attacker could use this flaw, and combine it with other IPC weaknesses, to achieve local privilege escalation.

A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attacker could use this flaw, and combine it with other IPC weaknesses, to achieve local privilege escalation.

pacemaker: Insufficient local IPC client-server authentication on the client's side can lead to local privesc pacemaker: Insufficient verification inflicted preference of uncontrolled processes can lead to DoS pacemaker: Information disclosure through use-after-free

pacemaker: Insufficient local IPC client-server authentication on the client's side can lead to local privesc pacemaker: Insufficient verification inflicted preference of uncontrolled processes can lead to DoS pacemaker: Information disclosure through use-after-free

Security update for pacemaker

Affected: Ubuntu:16.04:LTS: pacemaker, Ubuntu:18.04:LTS: pacemaker

A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attacker could use this flaw, and combine it with other IPC weaknesses, to achieve local privilege escalation.

Ein lokaler Angreifer kann mehrere Schwachstellen in Red Hat Pacemaker ausnutzen, um seine Privilegien zu erhöhen, einen Denial of Service zu verursachen oder Informationen offenzulegen.