PT-2014-3251 · Openstack · Openstack Compute

Daniel Berrange · Published 2014-01-23 · Updated 2022-05-14 · CVE-2013-7048

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Compute (Nova) versions prior to Grizzly 2013.1.4 and Havana 2013.2.1

Description The issue allows local users to read and modify live snapshots due to world-writable and world-readable permissions for the temporary directory used to store them.

Recommendations For versions prior to Grizzly 2013.1.4 and Havana 2013.2.1, update to a version that includes the fix for this issue to prevent local users from reading and modifying live snapshots.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-7048

GHSA-GRP5-H379-J75X

RHSA-2014:0231

RHSA-2014:0366

Affected Products

Openstack Compute

References · 12

• 🔥 https://bugs.launchpad.net/nova/+bug/1227027 · Exploit
• https://osv.dev/vulnerability/CVE-2013-7048 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-7048 · Security Note
• http://rhn.redhat.com/errata/RHSA-2014-0231.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-grp5-h379-j75x · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-7048 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-7048 · Vendor Advisory
• https://github.com/openstack/nova · Note
• https://github.com/openstack/nova/commit/75be5abd6b3fa0f7f27fe9c805f832cd41d44a5d · Note
• https://github.com/openstack/nova/commit/9bd7fff8c0160057643cfc37c5e2b1cd3337d6aa · Note
• https://github.com/openstack/nova/commit/8a34fc3d48c467aa196f65eed444ccdc7c02f19f · Note
• http://openwall.com/lists/oss-security/2014/01/13/2 · Note