PT-2017-6633 · Openstack+1 · Openstack Dbaas+1

Michael Scherer · Published 2016-03-14 · Updated 2022-05-17 · CVE-2015-3156

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Openstack DBaaS (aka Trove) versions prior to 2015.1.0 (aka Kilo)

Description The issue allows local users to write to configuration files via a symlink attack on a temporary file. This is due to vulnerabilities in several functions, including write config, reset configuration, write config, write mycnf, InnoBackupEx:: run prepare, InnoBackupEx::cmd, MySQLDump::cmd, InnoBackupExIncremental::cmd, get actual db status, and multiple class CbBackup methods.

Recommendations For versions prior to 2015.1.0 (aka Kilo), update to version 2015.1.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable functions and classes until a patch is available. Avoid using the affected functions and classes in the trove/guestagent/datastore/experimental and trove/guestagent/strategies/backup modules to minimize the risk of exploitation.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2015-3156

GHSA-98C8-36P9-GW66

SUSE-SU-2016:0739-1

Affected Products

Debian

Openstack Dbaas

References · 29

• https://nvd.nist.gov/vuln/detail/CVE-2015-3156 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-3156 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-3156 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-3156 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/openstack-trove · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-3156 · Security Note
• https://osv.dev/vulnerability/CVE-2015-3156 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3156 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2016:0739-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-98c8-36p9-gw66 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-3156 · Vendor Advisory
• https://github.com/openstack/trove/blob/master/trove/guestagent/datastore/experimental/redis/service.py#L236 · Note
• https://github.com/openstack/trove/blob/master/trove/guestagent/strategies/restore/mysql_impl.py#L194 · Note
• https://github.com/openstack/trove · Note
• https://github.com/openstack/trove/blob/master/trove/guestagent/strategies/backup/mysql_impl.py#L55 · Note