PT-2012-5181 · Eucalyptus Systems · Eucalyptus

Publicado 2012-10-01 · Atualizado 2012-10-02 · CVE-2012-4064

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Eucalyptus versions prior to 3.1.1

Description The issue allows remote authenticated users to gain privileges by sending a message to certain components with a modified user id. This is due to the improper restriction of the binding of external SOAP web-services messages. The components affected include Cloud Controller and Walrus, where messages can be sent with the internal message format and a modified user id.

Recommendations For versions prior to 3.1.1, update to version 3.1.1 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2012-4064

Produtos afetados

Eucalyptus

Referências · 2

• http://eucalyptus.com/eucalyptus-cloud/security/esa-06 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-4064 · Nota de Segurança