The (1) backup (api/contrib/backups.py) and (2) volume transfer (contrib/volume_transfer.py) APIs in OpenStack Cinder Grizzly 2013.1.3 and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The (1) backup (api/contrib/backups.py) and (2) volume transfer (contrib/volume_transfer.py) APIs in
    OpenStack Cinder Grizzly 2013.1.3 and earlier allows remote attackers to cause a denial of service
    (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an
    incomplete fix for CVE-2013-1664. (CVE-2013-4202)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:1198 advisory.

    The openstack-cinder packages provide OpenStack Volume (Cinder), which     provides services to manage and access block storage volumes for use by     virtual machine instances.

    It was found that the fixes for CVE-2013-1664 and CVE-2013-1665, released     via RHSA-2013:0658, did not fully correct the issues in the Extensible     Markup Language (XML) parser used by Cinder. A remote attacker could use     this flaw to send a specially-crafted request to a Cinder API, causing     Cinder to consume an excessive amount of CPU and memory, or possibly crash.
    (CVE-2013-4202)

    A bug in the Cinder LVM driver prevented LVM snapshots from being securely     deleted in some cases, potentially leading to information disclosure to     other tenants. (CVE-2013-4183)

    The CVE-2013-4202 issue was discovered by Grant Murphy of the Red Hat     Product Security Team.

    Additionally, openstack-cinder has been rebased to the latest Grizzly     stable release 2013.1.3. (BZ#993094)

    All users of openstack-cinder are advised to upgrade to these updated     packages, which correct these issues. After installing the updated     packages, the Cinder running services will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Rongze Zhu discovered that the Cinder LVM driver did not zero out data when deleting snapshots. This could expose sensitive information to authenticated users when subsequent servers use the volume.
(CVE-2013-4183)

Grant Murphy discovered that Cinder would allow XML entity processing.
A remote unauthenticated attacker could exploit this using the Cinder API to cause a denial of service via resource exhaustion.
(CVE-2013-4179, CVE-2013-4202).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
433482	SCA: security update for cinder (GHSA-mfg4-9xf4-f45q)	Tenable Cloud Security	SCA Checks	high
433482	SCA: security update for cinder (GHSA-mfg4-9xf4-f45q)	Tenable Self-Hosted Container Security	SCA Checks	high
193680	RHEL 6 : openstack-cinder (RHSA-2013:1198)	Nessus	Red Hat Local Security Checks	high
70584	Ubuntu 13.04 : cinder vulnerabilities (USN-2005-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2013-4202

high

Tenable Plugins

high

high

high

medium