Bug 1211370 (CVE-2015-1867) - CVE-2015-1867 pacemaker: acl read-only access allow role assignment
Summary: CVE-2015-1867 pacemaker: acl read-only access allow role assignment
Status: CLOSED ERRATA
Alias: CVE-2015-1867
Product: Security Response
Classification: Other
Component: vulnerability   
(Show other bugs)
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20150331,repor...
Keywords: Security
Depends On: 1207621 1238846 1238849
Blocks: 1193283 1207764 1210268
TreeView+ depends on / blocked
 
Reported: 2015-04-13 19:11 UTC by Kurt Seifried
Modified: 2015-11-23 13:27 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A flaw was found in the way pacemaker, a cluster resource manager, evaluated added nodes in certain situations. A user with read-only access could potentially assign any other existing roles to themselves and then add privileges to other users as well.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-11-20 04:59:57 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:1424 normal SHIPPED_LIVE Moderate: pacemaker security and bug fix update 2015-07-20 18:06:24 UTC
Red Hat Product Errata RHSA-2015:2383 normal SHIPPED_LIVE Moderate: pacemaker security, bug fix, and enhancement update 2015-11-19 10:49:49 UTC

Description Kurt Seifried 2015-04-13 19:11:06 UTC
Franck Grosjean of Red Hat reports:

Description of problem:
acl definitions are not enforced and could be bypassed by a user without write access to the cib

Version-Release number of selected component (if applicable):
RedHat Enterprise Linux 6.6
pcs --version = 0.9.123
pacemakerd --version = Pacemaker 1.1.11

How reproducible:
a user with a read-only role can assign any other existing roles to himself and then gain any kind of access from any role (rw access to the cib if this kind of role exist).

Steps to Reproduce:
1. create a role read-only
   pcs acl role create read-only description="Read only access" read xpath /cib
2. create a role admin
   pcs acl role create admin description="Admin access" write xpath /cib
3. create an account (local + pcs)
4. open a session with this roaccount account
5. add admin role to your account
   pcs acl role assign admin to rocluster
6. check new acl pushed as a read-only user
   pcs acl
    User: rocluster
      Roles: read-only admin
    Role: read-only
      Description: Read only access
      Permission: read xpath /cib (read-only-read)
    Role: admin
      Description: Admin access
      Permission: write xpath /cib (admin-write)
7. add/delete/modify anything

Actual results:
obtain rw access to the cib

Expected results:
must not be possible with read-only access to the cib to assign a role

Additional info:

Introduced in: https://github.com/ClusterLabs/pacemaker/commit/f242c1ef
Fixed in:      https://github.com/ClusterLabs/pacemaker/commit/84ac07c

Comment 1 Kurt Seifried 2015-07-02 19:28:38 UTC
Created pacemaker tracking bugs for this issue:

Affects: fedora-all [bug 1238846]

Comment 3 errata-xmlrpc 2015-07-22 07:44:15 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2015:1424 https://rhn.redhat.com/errata/RHSA-2015-1424.html

Comment 5 Kurt Seifried 2015-07-30 05:23:30 UTC
Why is the fix for this, comment private?

Comment 7 Fedora Update System 2015-10-23 17:18:43 UTC
pacemaker-1.1.13-3.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2015-10-31 16:08:29 UTC
pacemaker-1.1.13-3.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2015-11-01 22:18:40 UTC
pacemaker-1.1.13-3.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.

Comment 10 errata-xmlrpc 2015-11-19 12:11:39 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:2383 https://rhn.redhat.com/errata/RHSA-2015-2383.html


Note You need to log in before you can comment on or make changes to this bug.