PT-2017-6883 · Openstack · Openstack Designate

Florian Weimer · Publicado 2017-08-31 · Atualizado 2022-05-17 · CVE-2015-5695

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack Kilo Designate versions 2015.1.0 through 1.0.0.0b1

Description The issue does not properly enforce RecordSets per domain and Records per RecordSet quotas when processing an internal zone file transfer. This could allow remote attackers to cause a denial of service, potentially resulting in an infinite loop, via a crafted resource record set.

Recommendations For Designate versions 2015.1.0 through 1.0.0.0b1, as a temporary workaround, consider restricting the processing of internal zone file transfers to prevent potential denial of service attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2015-5695

GHSA-M6H2-634H-JCPJ

PYSEC-2017-114

Produtos afetados

Openstack Designate

Referências · 20

• 🔥 https://bugs.launchpad.net/designate/+bug/1471161 · Exploit
• https://github.com/pypa/advisory-database/tree/main/vulns/designate/PYSEC-2017-114.yaml · Nota
• https://openwall.com/lists/oss-security/2015/07/29/6 · Nota
• https://launchpadlibrarian.net/211525251/bug-1471161-quotas-master.patch · Correção
• https://marc.info/?l=oss-security&m=143811778831673&w=2 · Nota
• https://osv.dev/vulnerability/PYSEC-2017-114 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2015-5695 · Aviso do Fabricante
• http://lists.openstack.org/pipermail/openstack/2015-July/013548.html · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-5695 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-m6h2-634h-jcpj · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2015/07/28/11 · Nota
• https://security-tracker.debian.org/tracker/CVE-2015-5695 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-5695 · Nota de Segurança
• https://ubuntu.com/security/CVE-2015-5695 · Aviso do Fabricante
• https://openwall.com/lists/oss-security/2015/07/28/11 · Nota