PT-2014-3696 · Crowbar · Barclamp

Publicado 2014-04-04 · Atualizado 2014-04-04 · CVE-2014-0592

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Barclamp (aka barclamp-network) version 1.7

Description The issue allows remote attackers to bypass security group restrictions via unspecified vectors, related to floating IPs, because netfilter is not enabled on bridges when creating new instances.

Recommendations For Barclamp (aka barclamp-network) version 1.7, enable netfilter on bridges when creating new instances to prevent bypassing security group restrictions.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-0592

Produtos afetados

Barclamp

Referências · 6

• https://github.com/crowbar/barclamp-network/pull/269 · Nota
• https://bugzilla.novell.com/show_bug.cgi?id=864183 · Nota
• http://secunia.com/advisories/57509 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00025.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-0592 · Nota de Segurança
• http://securityfocus.com/bid/66519 · Nota