Privilege escalation in pcs - CVE-2018-1079
Published: April 13, 2018 / Updated: April 13, 2018
Vulnerability identifier: #VU11820
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-1079
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated attacker to gain elevated privileges on the target system.
The weakness exists in the REST interface of the pcsd service due improper sanitization of the file name from the /remote/put_file query. A remote attacker can create or overwrite arbitrary files with arbitrary data outside of the /etc/booth directory, in the context of the pcsd process and gain root privileges.
The weakness exists in the REST interface of the pcsd service due improper sanitization of the file name from the /remote/put_file query. A remote attacker can create or overwrite arbitrary files with arbitrary data outside of the /etc/booth directory, in the context of the pcsd process and gain root privileges.
Affected software
pcs
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power
Fedora
pcs
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power
Fedora
pcs
How to mitigate CVE-2018-1079
Update to versions 0.9.164 or 0.10.
pcs - addressed in versions 0.9.160-2.fc26, 0.9.164-1.fc27, 0.9.164-1.fc28