PT-2014-5460 · Libvirt+2 · Libvirt+3

Publicado 2014-12-02 · Atualizado 2014-12-05 · CVE-2014-3703

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions OpenStack PackStack version 2012.2.1

Description The issue arises when the Open vSwitch (OVS) monolithic plug-in is not used, leading to improper setting of the libvirt vif driver configuration option in the nova.conf configuration. This results in the firewall being disabled, allowing remote attackers to bypass intended access restrictions.

Recommendations For OpenStack PackStack version 2012.2.1, ensure the libvirt vif driver configuration option is properly set in the nova.conf configuration to enable the firewall and prevent access restriction bypass.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-3703

RHSA-2014:1691

Produtos afetados

Openvswitch

Openstack Packstack

Libvirt

Nova

Referências · 2

• http://rhn.redhat.com/errata/RHSA-2014-1691.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-3703 · Nota de Segurança