PT-2012-6315 · Openstack · Openstack Compute

Publicado 2012-07-22 · Atualizado 2012-07-22

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions OpenStack Compute (Nova) versions 2011.3 through 2012.2

Description The issue allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image. This is due to a problem in the virt/disk/api.py file.

Recommendations For versions 2011.3 through 2012.2, consider restricting access to the vulnerable virt/disk/api.py file until a patch is available. As a temporary workaround, avoid using the image functionality in OpenStack Compute (Nova) to minimize the risk of exploitation.

Identificadores relacionados

PYSEC-2012-39

Produtos afetados

Openstack Compute

Referências · 12

• https://github.com/openstack/nova/commit/2427d4a99bed35baefd8f17ba422cb7aae8dcca7 · Nota
• https://github.com/openstack/nova/commit/b0feaffdb2b1c51182b8dce41b367f3449af5dd9 · Nota
• http://secunia.com/advisories/49802 · Nota
• https://review.openstack.org/#/c/9268 · Nota
• https://osv.dev/vulnerability/PYSEC-2012-39 · Aviso do Fabricante
• http://secunia.com/advisories/49763 · Nota
• https://lists.launchpad.net/openstack/msg14089.html · Nota
• http://securityfocus.com/bid/54278 · Nota
• https://bugs.launchpad.net/nova/+bug/1015531 · Nota
• http://ubuntu.com/usn/USN-1497-1 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2012-July/083984.html · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2012-July/083969.html · Nota