Privilege escalation in pcs - CVE-2018-1079
Published: April 13, 2018 / Updated: April 13, 2018
Vulnerability identifier: #VU11820
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2018-1079
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: ClusterLabs
Affected software:
pcs
pcs
Detailed vulnerability description
The vulnerability allows a remote authenticated attacker to gain elevated privileges on the target system.
The weakness exists in the REST interface of the pcsd service due improper sanitization of the file name from the /remote/put_file query. A remote attacker can create or overwrite arbitrary files with arbitrary data outside of the /etc/booth directory, in the context of the pcsd process and gain root privileges.
The weakness exists in the REST interface of the pcsd service due improper sanitization of the file name from the /remote/put_file query. A remote attacker can create or overwrite arbitrary files with arbitrary data outside of the /etc/booth directory, in the context of the pcsd process and gain root privileges.
How to mitigate CVE-2018-1079
Update to versions 0.9.164 or 0.10.