PT-2011-2591 · Eucalyptus · Eucalyptus Ee+1

Dave Walker + 1 · Published 2011-06-02 · Updated 2018-11-29 · CVE-2011-0730

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Eucalyptus versions prior to 2.0.3 Eucalyptus EE versions prior to 2.0.2

Description The issue is related to the improper interpretation of signed elements in SOAP requests, which can be exploited by man-in-the-middle attackers to execute arbitrary commands by modifying a request. This is related to an "XML Signature Element Wrapping" or a "SOAP signature replay" issue.

Recommendations For Eucalyptus versions prior to 2.0.3, update to version 2.0.3 or later. For Eucalyptus EE versions prior to 2.0.2, update to version 2.0.2 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-0730

Affected Products

Eucalyptus

Eucalyptus Ee

References · 9

• http://open.eucalyptus.com/wiki/esa-02 · Vendor Advisory
• https://launchpad.net/ubuntu/+source/eucalyptus/+changelog · Patch
• http://launchpadlibrarian.net/72472626/eucalyptus_2.0.1%2Bbzr1256-0ubuntu5_2.0.1%2Bbzr1256-0ubuntu6.diff.gz · Patch
• http://ubuntu.com/usn/USN-1137-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0730 · Security Note
• http://securityfocus.com/bid/48000 · Note
• http://secunia.com/advisories/44705 · Note
• https://bugs.launchpad.net/bugs/746101 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/67670 · Note