PT-2016-7127 · Openstack · Openstack+1

Marcus Meissner · Publicado 2016-12-08 · Atualizado 2020-09-09 · CVE-2016-6829

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Openstack deployment (aka crowbar-openstack) (affected versions not specified) Trove Barclamp (aka barclamp-trove and crowbar-barclamp-trove) (affected versions not specified)

Description The issue concerns a default password for the trove service user in Openstack deployment and Trove Barclamp, making it easier for remote attackers to gain access.

Recommendations For Openstack deployment, change the default password of the trove service user to a strong and unique password. For Trove Barclamp, update the configuration to use a secure password for the trove service user instead of the default one.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2016-6829

SUSE-SU-2016:3056-1

Produtos afetados

Openstack

Trove Barclamp

Referências · 12

• https://github.com/crowbar/crowbar-openstack/commit/208230bdfbcb19d062149d083b1a66b429516a69 · Correção
• https://github.com/crowbar/barclamp-trove/commit/932298f250365fed6963700870e52db3a7a32daa · Correção
• https://suse.com/security/cve//CVE-2016-6829.html · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2016/08/16/1 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2016:3056-1 · Aviso do Fabricante
• https://suse.com/support/update/announcement/2016/suse-su-20163056-1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-6829 · Nota de Segurança
• http://openwall.com/lists/oss-security/2016/08/18/9 · Nota
• http://securityfocus.com/bid/92476 · Nota
• https://bugzilla.suse.com/991729 · Nota
• https://osv.dev/vulnerability/CVE-2016-6829 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-6829 · Nota