PT-2012-6315 · Openstack · Openstack Compute

Published 2012-07-22 · Updated 2012-07-22

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions OpenStack Compute (Nova) versions 2011.3 through 2012.2

Description The issue allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image. This is due to a problem in the virt/disk/api.py file.

Recommendations For versions 2011.3 through 2012.2, consider restricting access to the vulnerable virt/disk/api.py file until a patch is available. As a temporary workaround, avoid using the image functionality in OpenStack Compute (Nova) to minimize the risk of exploitation.

Related Identifiers

PYSEC-2012-39

Affected Products

Openstack Compute

References · 12

• https://osv.dev/vulnerability/PYSEC-2012-39 · Vendor Advisory
• https://github.com/openstack/nova/commit/2427d4a99bed35baefd8f17ba422cb7aae8dcca7 · Note
• https://github.com/openstack/nova/commit/b0feaffdb2b1c51182b8dce41b367f3449af5dd9 · Note
• http://secunia.com/advisories/49802 · Note
• https://review.openstack.org/#/c/9268 · Note
• http://secunia.com/advisories/49763 · Note
• https://lists.launchpad.net/openstack/msg14089.html · Note
• http://securityfocus.com/bid/54278 · Note
• https://bugs.launchpad.net/nova/+bug/1015531 · Note
• http://ubuntu.com/usn/USN-1497-1 · Note
• http://lists.fedoraproject.org/pipermail/package-announce/2012-July/083984.html · Note
• http://lists.fedoraproject.org/pipermail/package-announce/2012-July/083969.html · Note