PT-2013-2214 · Clusterlabs+3 · Pacemaker+3

David Vossel + 1 · Published 2013-11-20 · Updated 2019-04-22 · CVE-2013-0281

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Pacemaker version 1.1.10

Description The issue allows remote attackers to cause a denial of service, specifically connection blocking, when remote Cluster Information Base (CIB) configuration or resource management is enabled. This occurs because the duration of connections to the blocking sockets is not limited.

Recommendations For Pacemaker version 1.1.10, consider disabling remote CIB configuration or resource management as a temporary workaround to minimize the risk of exploitation. Restrict access to the blocking sockets to prevent connection blocking.

Exploit

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

ALT-PU-2015-1923

CESA-2013_1635

CVE-2013-0281

MGASA-2014-0069

RHSA-2013:1635

RHSA-2013_1635

Affected Products

Alt Linux

Centos

Pacemaker

Red Hat

References · 18

• 🔥 https://github.com/ClusterLabs/pacemaker/commit/564f7cc2a51dcd2f28ab12a13394f31be5aa3c93 · Exploit
• http://rhn.redhat.com/errata/RHSA-2013-1635.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-0281 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-0281 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-0281 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0069.html · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0069 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-0281 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-0281 · Security Note
• https://linux.oracle.com/errata/ELSA-2013-1635.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-0281 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-0281 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0281 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=891922 · Note
• http://openwall.com/lists/oss-security/2013/02/14/6 · Note