PT-2014-4786 · Vmware+1 · Vmware+1

Jaroslav Henner + 1 · Published 2014-03-25 · Updated 2022-05-17 · CVE-2014-2573

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack Compute (Nova) versions 2013.2 through 2013.2.2

Description The issue allows remote authenticated users to bypass the quota limit and cause a denial of service by requesting a VM be put into rescue and then deleting the image, due to the VMWare driver not properly putting VMs into RESCUE status.

Recommendations For OpenStack Compute (Nova) versions 2013.2 through 2013.2.2, consider restricting access to the VM rescue functionality to prevent unauthorized users from exploiting this issue. As a temporary workaround, consider implementing additional quota checks to limit resource consumption. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

CWE-264

Related Identifiers

CVE-2014-2573

GHSA-JV34-XVJQ-PPCH

PYSEC-2014-113

Affected Products

Openstack Compute

Vmware

References · 17

• https://osv.dev/vulnerability/PYSEC-2014-113 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-2573 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-2573 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-2573 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-2573 · Vendor Advisory
• http://secunia.com/advisories/57498 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-2573 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jv34-xvjq-ppch · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-2573 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-2573 · Security Note
• https://github.com/openstack/nova · Note
• https://github.com/openstack/nova/commit/b3cc3f62a60662e5bb82136c0cfa464592a6afe9 · Note
• https://github.com/openstack/nova/commit/efb66531bc37ee416778a70d46c657608ca767af · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/nova/PYSEC-2014-113.yaml · Note
• http://openwall.com/lists/oss-security/2014/03/21/1 · Note