The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not properly check the protocol when security groups are created and the network protocol is not specified entirely in lowercase, which allows remote attackers to bypass intended access restrictions.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo
    (2011.3) do not properly check the protocol when security groups are created and the network protocol is
    not specified entirely in lowercase, which allows remote attackers to bypass intended access restrictions.
    (CVE-2012-2654)

bug fixes and performance improvements from stable essex

  - fix an exception caused by the fix for CVE-2012-2654

    - fix the encoding of the dns_domains table (requires a       db sync)

    - fix a crash due to a nova services startup race       (#825051)

    - Fix for protocol case handling CVE-2012-2654

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix issue with previous CVE fix

  - Fix for protocol case handling (CVE-2012-2654)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that, when defining security groups in Nova using the EC2 or OS APIs, specifying the network protocol (e.g. 'TCP') in the incorrect case would cause the security group to not be applied correctly. An attacker could use this to bypass Nova security group restrictions.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
434748	SCA: security update for nova (GHSA-46r8-9cj7-pw6g)	Tenable Cloud Security	SCA Checks	critical
434748	SCA: security update for nova (GHSA-46r8-9cj7-pw6g)	Tenable Self-Hosted Container Security	SCA Checks	critical
59699	Fedora 17 : openstack-nova-2012.1-10.fc17 (2012-9550)	Nessus	Fedora Local Security Checks	medium
59665	Fedora 16 : openstack-nova-2011.3.1-10.fc16 (2012-9425)	Nessus	Fedora Local Security Checks	medium
59399	Ubuntu 11.10 / 12.04 LTS : nova vulnerability (USN-1466-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2012-2654

critical

Tenable Plugins

critical

critical

medium

medium

medium