PT-2013-2214 · Clusterlabs+3 · Pacemaker+3

David Vossel + 1 · Publicado 2013-11-20 · Atualizado 2019-04-22 · CVE-2013-0281

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Pacemaker version 1.1.10

Description The issue allows remote attackers to cause a denial of service, specifically connection blocking, when remote Cluster Information Base (CIB) configuration or resource management is enabled. This occurs because the duration of connections to the blocking sockets is not limited.

Recommendations For Pacemaker version 1.1.10, consider disabling remote CIB configuration or resource management as a temporary workaround to minimize the risk of exploitation. Restrict access to the blocking sockets to prevent connection blocking.

Exploit

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

ALT-PU-2015-1923

CESA-2013_1635

CVE-2013-0281

MGASA-2014-0069

RHSA-2013:1635

RHSA-2013_1635

Produtos afetados

Alt Linux

Centos

Pacemaker

Red Hat

Referências · 18

• 🔥 https://github.com/ClusterLabs/pacemaker/commit/564f7cc2a51dcd2f28ab12a13394f31be5aa3c93 · Exploit
• http://rhn.redhat.com/errata/RHSA-2013-1635.html · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0281 · Nota
• https://osv.dev/vulnerability/CVE-2013-0281 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2013-0281 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-0281 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2014-0069.html · Nota de Segurança
• https://osv.dev/vulnerability/MGASA-2014-0069 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=891922 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-0281 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-0281 · Nota de Segurança
• https://linux.oracle.com/errata/ELSA-2013-1635.html · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2013/02/14/6 · Nota
• https://security-tracker.debian.org/tracker/CVE-2013-0281 · Aviso do Fabricante
• https://redhat.com/security/data/cve/CVE-2013-0281.html · Nota