製品・ソフトウェアに関する情報

JVN脆弱性詳細

Pacemaker におけるサービス運用妨害 (DoS) の脆弱性

Title	Pacemaker におけるサービス運用妨害 (DoS) の脆弱性
Summary	Pacemaker には、ペースメーカーをリモートで使用する場合、サービス運用妨害 (ノードの切断) 状態にされる脆弱性が存在します。
Possible impacts	リモートの攻撃者により、認証されていない接続を介して、サービス運用妨害 (ノードの切断) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Feb. 23, 2016, midnight
Registration Date	April 25, 2017, 4:40 p.m.
Last Update	April 25, 2017, 4:40 p.m.

Affected System

レッドハット

Red Hat Enterprise Linux High Availability (v. 7)

Red Hat Enterprise Linux Resilient Storage (v. 7)

SUSE

SUSE Linux Enterprise High Availability 12-SP2

SUSE Linux Enterprise Software Development Kit 12-SP2

openSUSE project

openSUSE Leap 42.1

openSUSE Leap 42.2

Cluster Labs

Pacemaker 1.1.15 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2016-7797	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7797
National Vulnerability Database (NVD)
2	CVE-2016-7797	https://nvd.nist.gov/vuln/detail/CVE-2016-7797

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-254	https://cwe.mitre.org/data/definitions/254.html

ベンダー情報

No	Name	URL
Bugzilla
1	Bug 5269	http://bugs.clusterlabs.org/show_bug.cgi?id=5269
GitHub
2	Fix: remote: cl#5269 - Notify other clients of a new connection only if the handshake has completed (bsc#967388)	https://github.com/ClusterLabs/pacemaker/commit/5ec24a2642bd0854b884d1a9b51d12371373b410
opensuse-security-announce
3	openSUSE-SU-2016:2965	https://lists.opensuse.org/opensuse-security-announce/2016-12/msg00001.html
4	SUSE-SU-2016:2869	https://lists.opensuse.org/opensuse-security-announce/2016-11/msg00038.html
opensuse-updates
5	openSUSE-SU-2016:3101	https://lists.opensuse.org/opensuse-updates/2016-12/msg00077.html
Red Hat Security Advisory
6	RHSA-2016:2578	http://rhn.redhat.com/errata/RHSA-2016-2578.html

Change Log

No	Changed Details	Date of change
0	[2017年04月25日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2016-7797

Summary	Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection.
Publication Date	March 25, 2017, 12:59 a.m.
Registration Date	Jan. 26, 2021, 2:17 p.m.
Last Update	Nov. 21, 2024, 11:58 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:clusterlabs:pacemaker::::::::			1.1.14

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp2::::::
cpe:2.3:o:opensuse_project:leap:42.1:::::::*
cpe:2.3:o:suse:linux_enterprise_high_availability:12:sp2::::::
cpe:2.3:o:opensuse:leap:42.2:::::::*

Configuration3	or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux_resilient_storage:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_high_availability:7.0:::::::*

Related information, measures and tools

No	URL	タグ
1	http://bugs.clusterlabs.org/show_bug.cgi?id=5269	Issue Tracking Vendor Advisory
2	http://bugs.clusterlabs.org/show_bug.cgi?id=5269	Issue Tracking Vendor Advisory
3	http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00038.html	Third Party Advisory
4	http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00038.html	Third Party Advisory
5	http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00001.html	Third Party Advisory
6	http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00001.html	Third Party Advisory
7	http://lists.opensuse.org/opensuse-updates/2016-12/msg00077.html	Third Party Advisory
8	http://lists.opensuse.org/opensuse-updates/2016-12/msg00077.html	Third Party Advisory
9	http://rhn.redhat.com/errata/RHSA-2016-2578.html	Third Party Advisory
10	http://rhn.redhat.com/errata/RHSA-2016-2578.html	Third Party Advisory
11	http://www.openwall.com/lists/oss-security/2016/10/01/1	Mailing List Patch Third Party Advisory
12	http://www.openwall.com/lists/oss-security/2016/10/01/1	Mailing List Patch Third Party Advisory
13	http://www.securityfocus.com/bid/93261	Third Party Advisory VDB Entry
14	http://www.securityfocus.com/bid/93261	Third Party Advisory VDB Entry
15	https://github.com/ClusterLabs/pacemaker/commit/5ec24a2642bd0854b884d1a9b51d12371373b410	Patch Third Party Advisory
16	https://github.com/ClusterLabs/pacemaker/commit/5ec24a2642bd0854b884d1a9b51d12371373b410	Patch Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-254	セキュリティ機能	https://cwe.mitre.org/data/definitions/254.html