pcs daemon CVE-2016-0721 Session Fixation Vulnerability

Bugtraq ID:	97977
Class:	Unknown
CVE:	CVE-2016-0721
Remote:	Yes
Local:	No
Published:	Apr 21 2017 12:00AM
Updated:	May 02 2017 02:09AM
Credit:	The vendor reported this issue.
Vulnerable:	Redhat Enterprise Linux Resilient Storage 7 Redhat Enterprise Linux High Availability 7 Redhat Enterprise Linux 6 + Trustix Secure Enterprise Linux 2.0 + Trustix Secure Linux 2.2 + Trustix Secure Linux 2.1 + Trustix Secure Linux 2.0 Fedora Pacemaker Configuration System 0.9.156 Fedora Pacemaker Configuration System 0.9.137
Not Vulnerable:	Fedora Pacemaker Configuration System 0.9.157

pcs daemon CVE-2016-0721 Session Fixation Vulnerability

pcs daemon is prone to a session-fixation vulnerability.

An attacker can exploit this issue to hijack an arbitrary session and gain unauthorized access to the affected application.

Versions prior to pcs daemon 0.9.157 are vulnerable.

pcs daemon CVE-2016-0721 Session Fixation Vulnerability

To exploit these issues an attacker entices an unsuspecting user into following a malicious URI.

pcs daemon CVE-2016-0721 Session Fixation Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

pcs daemon CVE-2016-0721 Session Fixation Vulnerability

References:

• pcs Homepage (pcs)
  
• pcs: cookies are not invalidated upon logout (Redhat)
  
• RHSA-2016:2596-1: pcs security, bug fix, and enhancement update (Red Hat)