The clear_volume function in LVMVolumeDriver driver in OpenStack Cinder 2013.1.1 through 2013.1.2 does not properly clear data when deleting a snapshot, which allows local users to obtain sensitive information via unspecified vectors.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The clear_volume function in LVMVolumeDriver driver in OpenStack Cinder 2013.1.1 through 2013.1.2 does not
    properly clear data when deleting a snapshot, which allows local users to obtain sensitive information via
    unspecified vectors. (CVE-2013-4183)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:1198 advisory.

    The openstack-cinder packages provide OpenStack Volume (Cinder), which     provides services to manage and access block storage volumes for use by     virtual machine instances.

    It was found that the fixes for CVE-2013-1664 and CVE-2013-1665, released     via RHSA-2013:0658, did not fully correct the issues in the Extensible     Markup Language (XML) parser used by Cinder. A remote attacker could use     this flaw to send a specially-crafted request to a Cinder API, causing     Cinder to consume an excessive amount of CPU and memory, or possibly crash.
    (CVE-2013-4202)

    A bug in the Cinder LVM driver prevented LVM snapshots from being securely     deleted in some cases, potentially leading to information disclosure to     other tenants. (CVE-2013-4183)

    The CVE-2013-4202 issue was discovered by Grant Murphy of the Red Hat     Product Security Team.

    Additionally, openstack-cinder has been rebased to the latest Grizzly     stable release 2013.1.3. (BZ#993094)

    All users of openstack-cinder are advised to upgrade to these updated     packages, which correct these issues. After installing the updated     packages, the Cinder running services will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Rongze Zhu discovered that the Cinder LVM driver did not zero out data when deleting snapshots. This could expose sensitive information to authenticated users when subsequent servers use the volume.
(CVE-2013-4183)

Grant Murphy discovered that Cinder would allow XML entity processing.
A remote unauthenticated attacker could exploit this using the Cinder API to cause a denial of service via resource exhaustion.
(CVE-2013-4179, CVE-2013-4202).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
434976	SCA: security update for cinder (GHSA-q3rw-wcj6-8cjf)	Tenable Cloud Security	SCA Checks	medium
434976	SCA: security update for cinder (GHSA-q3rw-wcj6-8cjf)	Tenable Self-Hosted Container Security	SCA Checks	medium
193680	RHEL 6 : openstack-cinder (RHSA-2013:1198)	Nessus	Red Hat Local Security Checks	high
70584	Ubuntu 13.04 : cinder vulnerabilities (USN-2005-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2013-4183

medium

Tenable Plugins

medium

medium

high

medium