PT-2015-6118 · Openstack+1 · Openstack Compute+1

George Shuklin · Published 2015-09-08 · Updated 2023-02-13 · CVE-2015-3241

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions OpenStack Compute (nova) versions 2015.1 through 2015.1.1 OpenStack Compute (nova) version 2014.2.3 and earlier

Description The issue allows remote authenticated users to cause a denial of service by consuming disk, network, and other resources. This is achieved by resizing and then deleting an instance, which does not stop the migration process. An authenticated user could bypass user quota and deplete all available disk space by repeatedly re-sizing and deleting an instance.

Recommendations For OpenStack Compute (nova) versions 2015.1 through 2015.1.1, update to a version that stops the migration process when an instance is deleted to prevent denial of service. For OpenStack Compute (nova) version 2014.2.3 and earlier, update to a version that stops the migration process when an instance is deleted to prevent denial of service. As a temporary workaround, consider restricting the ability to resize and delete instances to minimize the risk of exploitation.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2015-3241

GHSA-3VX7-XFF6-H2VX

RHSA-2015:1723

RHSA-2015:1898

SUSE-SU-2015:2219-1

SUSE-SU-2015:2220-1

USN-3449-1

Affected Products

Openstack Compute

Ubuntu

References · 52

• https://nvd.nist.gov/vuln/detail/CVE-2015-3241 · Security Note
• https://cve.org/CVERecord?id=CVE-2015-3241 · Security Note
• https://ubuntu.com/security/CVE-2015-7713 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8749 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3vx7-xff6-h2vx · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-3241 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-3241 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3449-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-3280 · Vendor Advisory
• https://security.openstack.org/ossa/OSSA-2015-015.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:2219-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-5162 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-3241 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:2220-1 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1723.html · Vendor Advisory