PT-2013-5030 · Openstack+1 · Openstack Compute+2

Bernhard M. Wiedemann + 1 · Publicado 2013-11-02 · Atualizado 2023-02-13 · CVE-2013-4469

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Baixa

Vetor base

AV:L/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions OpenStack Compute (Nova) versions Folsom through Havana

Description The issue allows local users to cause a denial of service (host file system disk consumption) by transferring an image with a large virtual size that does not contain a large amount of data from Glance, when use cow images is set to False. This occurs because the virtual size of a QCOW2 image is not verified.

Recommendations For OpenStack Compute (Nova) versions Folsom through Havana, as a temporary workaround, consider setting use cow images to True to mitigate the risk of exploitation. Restrict access to transferring images from Glance to minimize the risk of host file system disk consumption.

Exploit

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2013-4469

GHSA-2W87-5QCJ-J6GX

USN-2247-1

Produtos afetados

Glance

Openstack Compute

Ubuntu

Referências · 23

• 🔥 https://bugs.launchpad.net/nova/+bug/1206081 · Exploit
• https://github.com/openstack/nova · Nota
• https://github.com/openstack/nova/commit/3cdfe894ab58f7b91bf7fb690fc5bc724e44066f · Nota
• https://github.com/openstack/nova/commit/135faa7b5d9855312bedc19e5e1ecebae34d3d18 · Nota
• https://github.com/openstack/nova/commit/f6810be4ae1a6c93e7d8017ee67d5344dfdf4a30 · Nota
• https://osv.dev/vulnerability/USN-2247-1 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2013/10/31/3 · Correção
• https://ubuntu.com/security/CVE-2013-7130 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2013-4469 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-4469 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-4469 · Nota de Segurança
• http://ubuntu.com/usn/USN-2247-1 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2013-4469 · Nota de Segurança
• https://ubuntu.com/security/CVE-2014-0134 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-2247-1 · Aviso do Fabricante