PT-2013-5030 · Openstack+1 · Openstack Compute+2

Bernhard M. Wiedemann + 1 · Published 2013-11-02 · Updated 2023-02-13 · CVE-2013-4469

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions OpenStack Compute (Nova) versions Folsom through Havana

Description The issue allows local users to cause a denial of service (host file system disk consumption) by transferring an image with a large virtual size that does not contain a large amount of data from Glance, when use cow images is set to False. This occurs because the virtual size of a QCOW2 image is not verified.

Recommendations For OpenStack Compute (Nova) versions Folsom through Havana, as a temporary workaround, consider setting use cow images to True to mitigate the risk of exploitation. Restrict access to transferring images from Glance to minimize the risk of host file system disk consumption.

Exploit

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2013-4469

GHSA-2W87-5QCJ-J6GX

USN-2247-1

Affected Products

Glance

Openstack Compute

Ubuntu

References · 23

• 🔥 https://bugs.launchpad.net/nova/+bug/1206081 · Exploit
• https://osv.dev/vulnerability/USN-2247-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-0167 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2w87-5qcj-j6gx · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-6491 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4469 · Security Note
• http://openwall.com/lists/oss-security/2013/10/31/3 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-4469 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-7130 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-4469 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-1068 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-4469 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-4469 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4469 · Vendor Advisory
• http://ubuntu.com/usn/USN-2247-1 · Vendor Advisory