PT-2014-3251 · Openstack · Openstack Compute

Daniel Berrange · Publicado 2014-01-23 · Atualizado 2022-05-14 · CVE-2013-7048

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Baixa

Vetor base

AV:L/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Compute (Nova) versions prior to Grizzly 2013.1.4 and Havana 2013.2.1

Description The issue allows local users to read and modify live snapshots due to world-writable and world-readable permissions for the temporary directory used to store them.

Recommendations For versions prior to Grizzly 2013.1.4 and Havana 2013.2.1, update to a version that includes the fix for this issue to prevent local users from reading and modifying live snapshots.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2013-7048

GHSA-GRP5-H379-J75X

RHSA-2014:0231

RHSA-2014:0366

Produtos afetados

Openstack Compute

Referências · 12

• 🔥 https://bugs.launchpad.net/nova/+bug/1227027 · Exploit
• https://github.com/openstack/nova · Nota
• https://github.com/openstack/nova/commit/75be5abd6b3fa0f7f27fe9c805f832cd41d44a5d · Nota
• https://github.com/openstack/nova/commit/9bd7fff8c0160057643cfc37c5e2b1cd3337d6aa · Nota
• https://github.com/openstack/nova/commit/8a34fc3d48c467aa196f65eed444ccdc7c02f19f · Nota
• https://osv.dev/vulnerability/CVE-2013-7048 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-7048 · Nota de Segurança
• http://rhn.redhat.com/errata/RHSA-2014-0231.html · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-grp5-h379-j75x · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2013-7048 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/01/13/2 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-7048 · Aviso do Fabricante