OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a crafted pickle object.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2012:1379 advisory.

    OpenStack Swift (http://swift.openstack.org) is a highly available,     distributed, eventually consistent object/blob store.

    It was found that OpenStack Swift used the Python pickle module in an     insecure way to serialize and deserialize data from memcached. As     memcached does not have authentication, an attacker on the local network,     or possibly an unprivileged user in a virtual machine hosted on OpenStack,     could use this flaw to inject specially-crafted data that would lead to     arbitrary code execution. (CVE-2012-4406)

    Red Hat would like to thank Sebastian Krahmer of the SUSE Security Team for     reporting this issue.

    Note: The fix for CVE-2012-4406 is not enabled by default, and requires     manual action on the affected Proxy nodes. This update adds a     memcache_serialization_support option. It is configured in     /etc/swift/proxy-server.conf and is set to 0 by default. This default     setting is vulnerable to CVE-2012-4406.

    To enable the fix, this option must be changed; however, the required     changes can have a temporary, large performance impact. The following     instructions aim to minimize performance issues:

    1) Install the updated openstack-swift packages.

    2) In /etc/swift/proxy-server.conf, set the     memcache_serialization_support option in the memcache/[filter:cache]     section to 1. (The default value, 0, leaves you vulnerable to     CVE-2012-4406.) When set to 1, the JSON (JavaScript Object Notation)     format is used but pickle is still supported. This configuration is still     vulnerable, but new data will be stored in JSON format.

    3) After setting the option to 1, run service openstack-swift-proxy     restart.

    4) After 24 hours, set the memcache_serialization_support option in     /etc/swift/proxy-server.conf to 2. 2 is the secure option: only JSON     is used.

    5) After setting the option to 2, run service openstack-swift-proxy     restart.

    If memcache_serialization_support is set directly from 0 to 2, all     data in memcached will be flushed and re-created. This can lead to a     temporary, large performance impact.

    All users of openstack-swift are advised to upgrade to these updated     packages, which correct this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Sebastian Krahmer discovered that Swift used the loads function in the pickle Python module when it was configured to use memcached. A remote attacker on the same network as memcached could exploit this to execute arbitrary code. This update adds a new memcache_serialization_support option to support secure json serialization. For details on this new option, please see /usr/share/doc/swift-proxy/memcache.conf-sample. This issue only affected Ubuntu 12.04 LTS. (CVE-2012-4406)

Alex Gaynor discovered that Swift did not safely generate XML. An attacker could potentially craft an account name to generate arbitrary XML responses to trigger vulnerabilities in software parsing Swift's XML. (CVE-2013-2161).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Do not use pickle for serialization in memcache (CVE-2012-4406)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
210171	RHEL 6 : openstack-swift (RHSA-2012:1379)	Nessus	Red Hat Local Security Checks	critical
66960	Ubuntu 12.04 LTS / 12.10 / 13.04 : swift vulnerabilities (USN-1887-1)	Nessus	Ubuntu Local Security Checks	high
62601	Fedora 17 : openstack-swift-1.4.8-3.fc17 (2012-15642)	Nessus	Fedora Local Security Checks	high
62449	Fedora 16 : openstack-swift-1.4.8-3.fc16 (2012-15098)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2012-4406

critical

Tenable Plugins

critical

high

high

high