OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to obtain sensitive information (flavor properties), boot arbitrary flavors, and possibly have other unspecified impacts by guessing the flavor id.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-
    flavor-access:is_public property, which allows remote authenticated users to obtain sensitive information
    (flavor properties), boot arbitrary flavors, and possibly have other unspecified impacts by guessing the
    flavor id. (CVE-2013-2256)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:1199 advisory.

    The openstack-nova packages provide OpenStack Compute (Nova), which     provides services for provisioning, managing, and using virtual machine     instances.

    It was found that the fixes for CVE-2013-1664 and CVE-2013-1665, released     via RHSA-2013:0657, did not fully correct the issues in the Extensible     Markup Language (XML) parser used by Nova. A remote attacker could use     this flaw to send a specially-crafted request to a Nova API, causing     Nova to consume an excessive amount of CPU and memory, or possibly crash.
    (CVE-2013-4179)

    A denial of service flaw was found in the way Nova handled network source     security group policy updates. An authenticated user could send a large     number of server creation operations, causing nova-network to become     unresponsive. (CVE-2013-4185)

    An information disclosure flaw and a resource limit bypass were found in     the way Nova handled virtual hardware templates (flavors). These allowed     tenants to show and boot other tenants' flavors and bypass resource limits     enforced via the os-flavor-access:is_public property. (CVE-2013-2256)

    It was discovered that, in some configurations, certain messages in     console-log could cause nova-compute to become unresponsive, resulting in a     denial of service. (CVE-2013-4261)

    Red Hat would like to thank the OpenStack project for reporting     CVE-2013-2256 and CVE-2013-4185. Upstream acknowledges hzrandd from NetEase     as the original reporter of CVE-2013-2256, and Vishvananda Ishaya     from Nebula as the original reporter of CVE-2013-4185. Upstream also     acknowledges Ken'ichi Ohmichi from NEC for providing a corrected fix for     CVE-2013-2256.

    The CVE-2013-4179 issue was discovered by Grant Murphy of the Red Hat     Product Security Team, and CVE-2013-4261 was discovered by Jaroslav Henner     of Red Hat.

    This update also fixes a number of bugs in openstack-nova.

    Additionally, openstack-nova has been rebased to the latest stable release     2013.1.3. (BZ#993100)

    All users of openstack-nova are advised to upgrade to these updated     packages, which correct these issues. After installing the updated     packages, the running Nova services will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that Nova did not properly enforce the is_public property when determining flavor access. An authenticated attacker could exploit this to obtain sensitive information in private flavors.
This issue only affected Ubuntu 12.10 and 13.10. (CVE-2013-2256, CVE-2013-4278)

Grant Murphy discovered that Nova would allow XML entity processing. A remote unauthenticated attacker could exploit this using the Nova API to cause a denial of service via resource exhaustion. This issue only affected Ubuntu 13.10. (CVE-2013-4179)

Vishvananda Ishaya discovered that Nova inefficiently handled network security group updates when Nova was configured to use nova-network.
An authenticated attacker could exploit this to cause a denial of service. (CVE-2013-4185)

Jaroslav Henner discovered that Nova did not properly handle certain inputs to the instance console when Nova was configured to use Apache Qpid. An authenticated attacker could exploit this to cause a denial of service on the compute node running the instance. By default, Ubuntu uses RabbitMQ instead of Qpid. (CVE-2013-4261).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fixes 2 CVEs that were missed with the 2013.1.3 stable update Update to latest stable/grizzly 2013.1.3

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
410924	SCA: security update for nova (GHSA-5mj6-643f-2g85)	Tenable Cloud Security	SCA Checks	Local	medium
410924	SCA: security update for nova (GHSA-5mj6-643f-2g85)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
210148	RHEL 6 : openstack-nova (RHSA-2013:1199)	Nessus	Red Hat Local Security Checks	Local	high
70579	Ubuntu 12.04 LTS / 12.10 / 13.04 : nova vulnerabilities (USN-2000-1)	Nessus	Ubuntu Local Security Checks	Local	medium
69785	Fedora 19 : openstack-nova-2013.1.3-2.fc19 (2013-15373)	Nessus	Fedora Local Security Checks	Local	medium

Detections

Analytics

CVE-2013-2256

medium

Tenable Plugins

medium

medium

high

medium

medium