PT-2017-6633 · Openstack+1 · Openstack Dbaas+1

Michael Scherer

·

Publicado

2016-03-14

·

Atualizado

2022-05-17

·

CVE-2015-3156

CVSS v3.1

5.5

Média

VetorAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions Openstack DBaaS (aka Trove) versions prior to 2015.1.0 (aka Kilo)
Description The issue allows local users to write to configuration files via a symlink attack on a temporary file. This is due to vulnerabilities in several functions, including write config, reset configuration, write config, write mycnf, InnoBackupEx:: run prepare, InnoBackupEx::cmd, MySQLDump::cmd, InnoBackupExIncremental::cmd, get actual db status, and multiple class CbBackup methods.
Recommendations For versions prior to 2015.1.0 (aka Kilo), update to version 2015.1.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable functions and classes until a patch is available. Avoid using the affected functions and classes in the trove/guestagent/datastore/experimental and trove/guestagent/strategies/backup modules to minimize the risk of exploitation.

Correção

Link Following

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2015-3156
GHSA-98C8-36P9-GW66
SUSE-SU-2016:0739-1

Produtos afetados

Debian
Openstack Dbaas