PT-2014-3108 · Openstack · Openstack Neutron+1

Published 2014-01-07 · Updated 2022-05-17 · CVE-2013-6419

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Nova versions prior to Havana 2013.2.1 OpenStack Neutron versions prior to Havana 2013.2.1 and icehouse-1

Description The issue allows remote tenants to obtain sensitive metadata by spoofing the device ID bound to a port. This is due to a failure to validate the instance ID of the tenant making a request. The api/metadata/handler.py in Nova and the neutron-metadata-agent (agent/metadata/agent.py) in Neutron do not properly handle this situation.

Recommendations For OpenStack Nova versions prior to Havana 2013.2.1, update to Havana 2013.2.1 or later to resolve the issue. For OpenStack Neutron versions prior to Havana 2013.2.1 and icehouse-1, update to Havana 2013.2.1 or icehouse-1 or later to resolve the issue. As a temporary workaround, consider restricting access to the api/metadata/handler.py and neutron-metadata-agent (agent/metadata/agent.py) to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2013-6419

GHSA-22W9-J288-8P9W

RHSA-2014:0091

RHSA-2014:0231

Affected Products

Openstack Neutron

Openstack Nova

References · 16

• http://openwall.com/lists/oss-security/2013/12/11/8 · Patch
• https://security-tracker.debian.org/tracker/CVE-2013-6419 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-6419 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0231.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-6419 · Security Note
• http://rhn.redhat.com/errata/RHSA-2014-0091.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-6419 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-22w9-j288-8p9w · Vendor Advisory
• https://github.com/openstack/nova · Note
• https://github.com/openstack/nova/commit/af2f823107010933ecd94a9c938f8b739baaecb7 · Note
• https://github.com/openstack/nova/commit/07006be9165d1008ca0382b6f0ad25b13a676a55 · Note
• https://github.com/openstack/nova/commit/bce36e9bdb1fcb9658f7b684d160e656e88d816c · Note
• http://securityfocus.com/bid/64250 · Note
• https://review.openstack.org/#/c/61428/2/nova/api/metadata/handler.py · Note
• https://review.openstack.org/#/c/61439/1/neutron/agent/metadata/agent.py · Note