PT-2014-4786 · Vmware+1 · Vmware+1

Jaroslav Henner + 1 · Publicado 2014-03-25 · Atualizado 2022-05-17 · CVE-2014-2573

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack Compute (Nova) versions 2013.2 through 2013.2.2

Description The issue allows remote authenticated users to bypass the quota limit and cause a denial of service by requesting a VM be put into rescue and then deleting the image, due to the VMWare driver not properly putting VMs into RESCUE status.

Recommendations For OpenStack Compute (Nova) versions 2013.2 through 2013.2.2, consider restricting access to the VM rescue functionality to prevent unauthorized users from exploiting this issue. As a temporary workaround, consider implementing additional quota checks to limit resource consumption. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

CWE-264

Identificadores relacionados

CVE-2014-2573

GHSA-JV34-XVJQ-PPCH

PYSEC-2014-113

Produtos afetados

Openstack Compute

Vmware

Referências · 17

• https://github.com/openstack/nova · Nota
• https://github.com/openstack/nova/commit/b3cc3f62a60662e5bb82136c0cfa464592a6afe9 · Nota
• https://github.com/openstack/nova/commit/efb66531bc37ee416778a70d46c657608ca767af · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/nova/PYSEC-2014-113.yaml · Nota
• https://osv.dev/vulnerability/PYSEC-2014-113 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-2573 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-2573 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2014-2573 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2014-2573 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/03/21/1 · Nota
• http://secunia.com/advisories/57498 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-2573 · Aviso do Fabricante
• https://bugs.launchpad.net/nova/+bug/1269418 · Nota
• http://openwall.com/lists/oss-security/2014/03/21/2 · Nota
• https://osv.dev/vulnerability/GHSA-jv34-xvjq-ppch · Aviso do Fabricante