openEuler 22.03 LTS update for pcp

1) Exposure of Resource to Wrong Sphere

EUVDB-ID: #VU92228

Risk: Medium

CVSSv4.0: 6.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-3019

CWE-ID: CWE-668 - Exposure of resource to wrong sphere

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to missing access restrictions in the default pmproxy configuration, which exposes the Redis server backend to the local network. A remote attacker on the local network can execute arbitrary OS commands.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS

pcp-pmda-mssql: before 5.3.5-9

pcp-pmda-bcc: before 5.3.5-9

pcp-help: before 5.3.5-9

pcp-pmda-bpftrace: before 5.3.5-9

pcp-export-pcp2spark: before 5.3.5-9

pcp-pmda-zswap: before 5.3.5-9

pcp-pmda-bash: before 5.3.5-9

pcp-conf: before 5.3.5-9

pcp-pmda-unbound: before 5.3.5-9

pcp-pmda-mysql: before 5.3.5-9

pcp-pmda-docker: before 5.3.5-9

pcp-pmda-nginx: before 5.3.5-9

pcp-pmda-activemq: before 5.3.5-9

pcp-pmda-sockets: before 5.3.5-9

pcp-pmda-pdns: before 5.3.5-9

pcp-pmda-summary: before 5.3.5-9

pcp-pmda-podman: before 5.3.5-9

pcp-devel: before 5.3.5-9

pcp-pmda-infiniband: before 5.3.5-9

pcp-pmda-cifs: before 5.3.5-9

pcp-import-mrtg2pcp: before 5.3.5-9

pcp-pmda-news: before 5.3.5-9

pcp-pmda-cisco: before 5.3.5-9

pcp-pmda-openmetrics: before 5.3.5-9

perl-PCP-MMV: before 5.3.5-9

pcp-import-sar2pcp: before 5.3.5-9

pcp-pmda-ds389: before 5.3.5-9

pcp-pmda-bonding: before 5.3.5-9

pcp-pmda-shping: before 5.3.5-9

pcp-gui: before 5.3.5-9

pcp-pmda-gfs2: before 5.3.5-9

pcp-import-collectl2pcp: before 5.3.5-9

pcp-pmda-systemd: before 5.3.5-9

pcp-pmda-nutcracker: before 5.3.5-9

pcp-pmda-libvirt: before 5.3.5-9

pcp-pmda-rsyslog: before 5.3.5-9

pcp-pmda-slurm: before 5.3.5-9

pcp-pmda-trace: before 5.3.5-9

pcp-pmda-bind2: before 5.3.5-9

pcp-export-zabbix-agent: before 5.3.5-9

pcp-pmda-haproxy: before 5.3.5-9

pcp-pmda-perfevent: before 5.3.5-9

pcp-pmda-mic: before 5.3.5-9

pcp-export-pcp2influxdb: before 5.3.5-9

pcp-pmda-snmp: before 5.3.5-9

pcp-pmda-dm: before 5.3.5-9

pcp-pmda-denki: before 5.3.5-9

pcp-pmda-redis: before 5.3.5-9

pcp-pmda-nvidia-gpu: before 5.3.5-9

pcp-pmda-mounts: before 5.3.5-9

pcp-pmda-netfilter: before 5.3.5-9

pcp-pmda-postfix: before 5.3.5-9

perl-PCP-LogSummary: before 5.3.5-9

pcp-pmda-apache: before 5.3.5-9

pcp-import-iostat2pcp: before 5.3.5-9

pcp-pmda-bpf: before 5.3.5-9

pcp-pmda-nfsclient: before 5.3.5-9

pcp-export-pcp2xml: before 5.3.5-9

pcp-pmda-openvswitch: before 5.3.5-9

pcp-pmda-mailq: before 5.3.5-9

pcp-pmda-lustre: before 5.3.5-9

pcp-pmda-memcache: before 5.3.5-9

pcp-pmda-gpsd: before 5.3.5-9

pcp-pmda-elasticsearch: before 5.3.5-9

perl-PCP-PMDA: before 5.3.5-9

pcp-pmda-mongodb: before 5.3.5-9

pcp-import-ganglia2pcp: before 5.3.5-9

pcp-pmda-weblog: before 5.3.5-9

pcp-pmda-hacluster: before 5.3.5-9

pcp-pmda-smart: before 5.3.5-9

pcp-pmda-gpfs: before 5.3.5-9

pcp-pmda-lustrecomm: before 5.3.5-9

pcp-export-pcp2json: before 5.3.5-9

pcp-pmda-netcheck: before 5.3.5-9

pcp-export-pcp2zabbix: before 5.3.5-9

pcp-pmda-logger: before 5.3.5-9

pcp-system-tools: before 5.3.5-9

pcp-pmda-lmsensors: before 5.3.5-9

pcp-pmda-postgresql: before 5.3.5-9

pcp-pmda-roomtemp: before 5.3.5-9

pcp-pmda-gluster: before 5.3.5-9

pcp-pmda-lio: before 5.3.5-9

pcp-export-pcp2elasticsearch: before 5.3.5-9

perl-PCP-LogImport: before 5.3.5-9

pcp-selinux: before 5.3.5-9

pcp-debuginfo: before 5.3.5-9

pcp-pmda-dbping: before 5.3.5-9

python3-pcp: before 5.3.5-9

pcp-pmda-named: before 5.3.5-9

pcp-zeroconf: before 5.3.5-9

pcp-pmda-zimbra: before 5.3.5-9

pcp-export-pcp2graphite: before 5.3.5-9

pcp-pmda-json: before 5.3.5-9

pcp-pmda-samba: before 5.3.5-9

pcp-debugsource: before 5.3.5-9

pcp-pmda-oracle: before 5.3.5-9

pcp-pmda-sendmail: before 5.3.5-9

pcp-pmda-rabbitmq: before 5.3.5-9

pcp-pmda-ds389log: before 5.3.5-9

pcp: before 5.3.5-9

CPE2.3

• cpe:2.3:o:openeuler:openeuler:22.03:LTS:*:*:*:*:*:*
• cpe:2.3:o:openeuler:pcp-pmda-mssql:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-bcc:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-help:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-bpftrace:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-export-pcp2spark:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-zswap:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-bash:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-conf:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-unbound:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-mysql:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-docker:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-nginx:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-activemq:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-sockets:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-pdns:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-summary:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-podman:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-devel:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-infiniband:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-cifs:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-import-mrtg2pcp:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-news:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-cisco:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-openmetrics:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:perl-pcp-mmv:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-import-sar2pcp:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-ds389:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-bonding:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-shping:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-gui:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-gfs2:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-import-collectl2pcp:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-systemd:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-nutcracker:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-libvirt:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-rsyslog:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-slurm:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-trace:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-bind2:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-export-zabbix-agent:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-haproxy:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-perfevent:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-mic:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-export-pcp2influxdb:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-snmp:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-dm:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-denki:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-redis:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-nvidia-gpu:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-mounts:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-netfilter:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-postfix:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:perl-pcp-logsummary:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-apache:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-import-iostat2pcp:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-bpf:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-nfsclient:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-export-pcp2xml:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-openvswitch:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-mailq:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-lustre:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-memcache:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-gpsd:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-elasticsearch:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:perl-pcp-pmda:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-mongodb:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-import-ganglia2pcp:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-weblog:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-hacluster:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-smart:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-gpfs:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-lustrecomm:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-export-pcp2json:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-netcheck:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-export-pcp2zabbix:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-logger:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-system-tools:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-lmsensors:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-postgresql:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-roomtemp:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-gluster:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-lio:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-export-pcp2elasticsearch:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:perl-pcp-logimport:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-selinux:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-debuginfo:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-dbping:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:python3-pcp:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-named:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-zeroconf:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-zimbra:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-export-pcp2graphite:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-json:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-samba:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-debugsource:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-oracle:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-sendmail:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-rabbitmq:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp-pmda-ds389log:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:pcp:*:*:*:*:*:openeuler:*:*

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1436

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.