PT-2013-6042 · Openstack · Openstack Orchestration Api

Shardy + 1 · Published 2013-12-11 · Updated 2017-08-29 · CVE-2013-6426

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Orchestration API (Heat) versions prior to Havana 2013.2.1 OpenStack Orchestration API (Heat) versions prior to icehouse-2

Description The issue allows local in-instance users to bypass intended access restrictions. This can be achieved by creating a stack via the CreateStack method or updating a stack via the UpdateStack method.

Recommendations For versions prior to Havana 2013.2.1, update to Havana 2013.2.1 or later to resolve the issue. For versions prior to icehouse-2, update to icehouse-2 or later to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-6426

RHSA-2014:0090

Affected Products

Openstack Orchestration Api

References · 14

• 🔥 https://bugs.launchpad.net/heat/+bug/1256049 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2013-6426 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-6426 · Security Note
• https://osv.dev/vulnerability/CVE-2013-6426 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-6426 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-6426 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-6426 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0090.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-6426 · Vendor Advisory
• http://securityfocus.com/bid/64243 · Note
• http://lists.openstack.org/pipermail/openstack-announce/2013-December/000170.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/89658 · Note
• http://openwall.com/lists/oss-security/2013/12/11/9 · Note
• http://openwall.com/lists/oss-security/2013/12/11/10 · Note