PT-2014-3696 · Crowbar · Barclamp

Published 2014-04-04 · Updated 2014-04-04 · CVE-2014-0592

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Barclamp (aka barclamp-network) version 1.7

Description The issue allows remote attackers to bypass security group restrictions via unspecified vectors, related to floating IPs, because netfilter is not enabled on bridges when creating new instances.

Recommendations For Barclamp (aka barclamp-network) version 1.7, enable netfilter on bridges when creating new instances to prevent bypassing security group restrictions.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-0592

Affected Products

Barclamp

References · 6

• http://secunia.com/advisories/57509 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00025.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0592 · Security Note
• https://github.com/crowbar/barclamp-network/pull/269 · Note
• https://bugzilla.novell.com/show_bug.cgi?id=864183 · Note
• http://securityfocus.com/bid/66519 · Note