PT-2016-3669 · Openstack+2 · Openstack Nova+4

Richard W.M. Jones · Publicado 2016-10-07 · Atualizado 2023-02-13 · CVE-2015-5162

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions OpenStack Cinder versions 7.0.0 through 7.0.1 and 8.0.0 through 8.1.1 and prior to 9.0.0 OpenStack Glance versions prior to 11.0.1 and 12.0.0 and prior to 14.0.0 OpenStack Nova versions prior to 12.0.4 and 13.0.0

Description The image parser in OpenStack does not properly limit qemu-img calls, which might allow attackers to cause a denial of service via a crafted disk image, leading to memory and disk consumption.

Recommendations For OpenStack Cinder versions 7.0.0 through 7.0.1, update to version 7.0.2 or 9.0.0. For OpenStack Cinder versions 8.0.0 through 8.1.1, update to version 9.0.0. For OpenStack Glance versions prior to 11.0.1, update to version 11.0.1 or 14.0.0. For OpenStack Glance versions 12.0.0 but prior to 14.0.0, update to version 14.0.0. For OpenStack Nova versions prior to 12.0.4, update to version 12.0.4. For OpenStack Nova versions 13.0.0, no specific fix is mentioned, consider updating to a newer version if available.

Exploit

Correção

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-399

CWE-400

Identificadores relacionados

CVE-2015-5162

GHSA-G2J5-7VGX-6XRX

RHSA-2016:2923

RHSA-2016:2991

RHSA-2017:0153

RHSA-2017:0156

RHSA-2017:0165

RHSA-2017:0282

USN-3449-1

Produtos afetados

Openstack Cinder

Openstack Glance

Openstack Nova

Ubuntu

Qemu-Img

Referências · 37

• 🔥 https://launchpad.net/bugs/1449062 · Exploit
• https://github.com/openstack/nova/commit/6bc37dcceca823998068167b49aec6def3112397 · Nota
• https://github.com/openstack/cinder/commit/455b318ced717fb38dfe40014817d78fbc47dea5 · Nota
• https://github.com/openstack/glance/commit/69a9b659fd48aa3c1f84fc7bc9ae236b6803d31f · Nota
• http://rhn.redhat.com/errata/RHSA-2017-0156.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2140 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2015-5162 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-5162 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7713 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8749 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3241 · Nota de Segurança
• https://ubuntu.com/security/CVE-2015-8749 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-2140 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2015-5162 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-5162 · Aviso do Fabricante