Test ID:	1.3.6.1.4.1.25623.1.0.882265
Category:	CentOS Local Security Checks
Title:	CentOS Update for pcs CESA-2015:1700 centos6
Summary:	Check the version of pcs
Description:	Summary: Check the version of pcs Vulnerability Insight: The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. A command injection flaw was found in the pcsd web UI. An attacker able to trick a victim that was logged in to the pcsd web UI into visiting a specially crafted URL could use this flaw to execute arbitrary code with root privileges on the server hosting the web UI. (CVE-2015-5190) A race condition was found in the way the pcsd web UI backend performed authorization of user requests. An attacker could use this flaw to send a request that would be evaluated as originating from a different user, potentially allowing the attacker to perform actions with permissions of a more privileged user. (CVE-2015-5189) These issues were discovered by Tom Jelnek of Red Hat. All pcs users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. Affected Software/OS: pcs on CentOS 6 Solution: Please install the updated packages. CVSS Score: 8.5 CVSS Vector: AV:N/AC:M/Au:S/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2015-5189 RHSA-2015:1700 http://rhn.redhat.com/errata/RHSA-2015-1700.html https://bugzilla.redhat.com/show_bug.cgi?id=1252805 Common Vulnerability Exposure (CVE) ID: CVE-2015-5190 https://bugzilla.redhat.com/show_bug.cgi?id=1252813
Copyright	Copyright (C) 2015 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.