CVE-2014-0162

Advisory

The Sheepdog backend in OpenStack Image Registry and Delivery Service (Glance) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote authenticated users with permission to insert or modify an image to execute arbitrary commands via a crafted location.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

The Sheepdog backend in OpenStack Image Registry and Delivery Service (Glance) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote authenticated users with permission to insert or modify an image to execute arbitrary commands via a crafted location.


MLIST:[oss-security] 20140410 [OSSA 2014-012] Remote code execution in Glance Sheepdog backend (CVE-2014-0162): http://www.openwall.com/lists/oss-security/2014/04/10/13
CONFIRM:https://launchpad.net/bugs/1298698: https://launchpad.net/bugs/1298698
REDHAT:RHSA-2014:0455: http://rhn.redhat.com/errata/RHSA-2014-0455.html
UBUNTU:USN-2193-1: http://www.ubuntu.com/usn/USN-2193-1

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0162
• https://launchpad.net/bugs/1298698
• http://www.openwall.com/lists/oss-security/2014/04/10/13
• http://rhn.redhat.com/errata/RHSA-2014-0455.html
• http://www.ubuntu.com/usn/USN-2193-1