PT-2013-1813 · Apache+1 · Log4J+2

Ahmad Emneina · Published 2013-01-22 · Updated 2013-04-02 · CVE-2012-5616

Positive Technologies (AI Summary)

CVSS v2.0

1.5

Low

Base vector

AV:L/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache CloudStack version 4.0.0-incubating Citrix CloudPlatform (formerly Citrix CloudStack) versions prior to 3.0.6

Description The issue allows local users to obtain sensitive information, including the SSH private key, and passwords of added hosts or VMs, as this information is stored in the log4j.conf log file. This sensitive data is recorded by various APIs, such as createSSHKeyPair, AddHost, DeployVM, or ResetPasswordForVM.

Recommendations For Apache CloudStack version 4.0.0-incubating, consider restricting access to the log4j.conf log file to minimize the risk of sensitive information disclosure. For Citrix CloudPlatform (formerly Citrix CloudStack) versions prior to 3.0.6, update to version 3.0.6 or later to resolve the issue. As a temporary workaround, consider disabling the createSSHKeyPair, AddHost, DeployVM, and ResetPasswordForVM APIs until a patch is available or the log file access is restricted.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2012-5616

Affected Products

Apache Cloudstack

Citrix Cloudplatform

Log4J

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2012-5616 · Security Note
• http://support.citrix.com/article/CTX136163 · Vendor Advisory
• http://secunia.com/advisories/51827 · Note
• http://osvdb.org/89147 · Note
• http://securitytracker.com/id?1027978 · Note
• http://mail-archives.apache.org/mod_mbox/incubator-cloudstack-users/201301.mbox/%3C1BD2169F-BBFE-4E27-B50F-F17D7D08B565%40stratosec.co%3E · Note
• http://secunia.com/advisories/51821 · Note
• http://osvdb.org/89146 · Note
• http://securityfocus.com/bid/57259 · Note
• http://osvdb.org/89070 · Note
• http://securityfocus.com/bid/57225 · Note
• http://secunia.com/advisories/51366 · Note
• http://seclists.org/fulldisclosure/2013/Jan/65 · Note