CVE-2014-0167

Advisory

[This advisory has been limited. Please create a free account to view the full advisory.]

Affected package

Affected versions

[This affected versions has been limited. Please create a free account to view the full affected versions.]

Fixed versions

[This fixed versions has been limited. Please create a free account to view the full fixed versions.]

Vulnerability changelog

The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not enforce RBAC policies for (1) add_rules, (2) remove_rules, (3) destroy, and other unspecified methods in compute/api.py when using non-default policies, which allows remote authenticated users to gain privileges via these API requests.


MLIST:[oss-security] 20140409 [OSSA 2014-011] RBAC policy not properly enforced in Nova EC2 API (CVE-2014-0167): http://www.openwall.com/lists/oss-security/2014/04/09/26
CONFIRM:https://launchpad.net/bugs/1290537: https://launchpad.net/bugs/1290537
UBUNTU:USN-2247-1: http://www.ubuntu.com/usn/USN-2247-1

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0167
• http://www.openwall.com/lists/oss-security/2014/04/09/26
• https://launchpad.net/bugs/1290537
• http://www.ubuntu.com/usn/USN-2247-1