PT-2013-3500 · Openstack · Openstack Devstack

Kseifried + 3 · Published 2013-05-21 · Updated 2013-05-22 · CVE-2013-1977

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenStack devstack (affected versions not specified)

Description The issue allows local users to obtain sensitive information, including the LDAP password and admin token secret, by reading the keystone.conf file due to its world-readable permissions.

Recommendations For devstack, consider changing the permissions of the keystone.conf file to restrict read access to authorized users only, until a more permanent fix is available.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-1977

Affected Products

Openstack Devstack

References · 4

• 🔥 http://openwall.com/lists/oss-security/2013/04/19/2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-1977 · Security Note
• http://openwall.com/lists/oss-security/2013/04/23/7 · Note
• https://bugs.launchpad.net/devstack/+bug/1168252 · Note