PT-2015-5470 · Pcs+2 · Pcs+2

Tomas Jelinek · Published 2015-05-12 · Updated 2023-02-12 · CVE-2015-1848

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PCS versions 0.9.137 and earlier

Description The issue concerns the pcs daemon (pcsd) in PCS, where it fails to set the secure flag for a cookie in an https session. This oversight makes it easier for remote attackers to capture the cookie by intercepting its transmission within an http session.

Recommendations For versions 0.9.137 and earlier, consider updating to a version that sets the secure flag for cookies in https sessions to prevent interception. As a temporary workaround, restrict access to sensitive operations that rely on the secure transmission of cookies until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CESA-2015_0980

CESA-2015_0990

CVE-2015-1848

RHSA-2015:0980

RHSA-2015:0990

RHSA-2015_0980

RHSA-2015_0990

Affected Products

Centos

Pcs

Red Hat

References · 24

• 🔥 https://bugzilla.redhat.com/attachment.cgi?id=1009855 · Exploit
• http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159401.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159374.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0980.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3983 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1848 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-1848 · Security Note
• http://rhn.redhat.com/errata/RHSA-2015-0990.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159412.html · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2015:0980 · Note
• https://lists.centos.org/pipermail/centos-announce/2015-May/070578.html · Note
• https://access.redhat.com/security/cve/CVE-2015-1848 · Note
• https://lists.centos.org/pipermail/centos-announce/2015-May/083265.html · Note
• https://lists.centos.org/pipermail/centos-announce/2015-May/058022.html · Note
• https://lists.centos.org/pipermail/centos-announce/2015-May/083288.html · Note