CVE-2013-6480

Advisory

Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

-----------------------------------

Compute
~~~~~~~

- Send "scrub_data" query parameter when destroying a DigitalOcean node.
This will cause disk to be scrubbed (overwritten with 0's) when destroying
a node. (LIBCLOUD-487)

Note: This fixes a security issue with a potential leak of data contained
on the destroyed node which only affects users of the DigitalOcean driver.
(CVE-2013-6480)
[Tomaz Muraus]

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6480
• https://digitalocean.com/blog_posts/transparency-regarding-data-security
• http://libcloud.apache.org/security.html
• https://github.com/fog/fog/issues/2525
• http://www.securityfocus.com/bid/64617
• http://lists.opensuse.org/opensuse-updates/2014-02/msg00015.html
• http://www.securityfocus.com/archive/1/530624/100/0/threaded