PT-2016-3808 · Red Hat+2 · Libvirt+2

Matthew Booth · Publicado 2016-01-12 · Atualizado 2018-11-16 · CVE-2015-7548

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Baixa

Vetor base

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Compute (Nova) versions prior to 2015.1.3 (kilo) OpenStack Compute (Nova) versions 12.0.x prior to 12.0.1 (liberty)

Description The issue allows remote authenticated users to read arbitrary files by overwriting an instance disk with a crafted image and requesting a snapshot, when using libvirt to spawn instances and use cow images is set to false.

Recommendations For OpenStack Compute (Nova) versions prior to 2015.1.3 (kilo), update to version 2015.1.3 or later. For OpenStack Compute (Nova) versions 12.0.x prior to 12.0.1 (liberty), update to version 12.0.1 or later. As a temporary workaround, consider setting use cow images to true to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2015-7548

RHSA-2016:0017

RHSA-2016:0018

SUSE-SU-2016:2325-1

USN-3449-1

Produtos afetados

Openstack Compute

Ubuntu

Libvirt

Referências · 35

• https://suse.com/security/cve/CVE-2015-7548 · Nota
• https://suse.com/security/cve/CVE-2015-3646 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2140 · Nota de Segurança
• https://ubuntu.com/security/CVE-2015-7713 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7713 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-7548 · Aviso do Fabricante
• https://bugzilla.suse.com/960601 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8749 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3241 · Nota de Segurança
• https://osv.dev/vulnerability/SUSE-SU-2016:2325-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2015-8749 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2016-0018.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2015-7548 · Aviso do Fabricante
• https://suse.com/support/update/announcement/2016/suse-su-20162325-1 · Nota
• https://ubuntu.com/security/CVE-2016-2140 · Aviso do Fabricante