api/metadata/handler.py in OpenStack Compute (Nova) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2, when proxying metadata requests through Neutron, makes it easier for remote attackers to guess instance ID signatures via a brute-force attack that relies on timing differences in responses to instance metadata requests.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - api/metadata/handler.py in OpenStack Compute (Nova) before 2013.2.4, 2014.x before 2014.1.2, and Juno
    before Juno-2, when proxying metadata requests through Neutron, makes it easier for remote attackers to
    guess instance ID signatures via a brute-force attack that relies on timing differences in responses to
    instance metadata requests. (CVE-2014-3517)

The remote Solaris system is missing necessary patches to address security updates :

  - api/metadata/handler.py in OpenStack Compute (Nova)     before 2013.2.4, 2014.x before 2014.1.2, and Juno before     Juno-2, when proxying metadata requests through Neutron,     makes it easier for remote attackers to guess instance     ID signatures via a brute-force attack that relies on     timing differences in responses to instance metadata     requests. (CVE-2014-3517)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2325-1 advisory.

    Alex Gaynor discovered that OpenStack Nova would sometimes respond with variable times when comparing     authentication tokens. If nova were configured to proxy metadata requests via Neutron, a remote     authenticated attacker could exploit this to conduct timing attacks and ascertain configuration details of     another instance.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
420551	SCA: security update for nova (GHSA-xjmj-p278-4jp5)	Tenable Cloud Security	SCA Checks	Local	high
420551	SCA: security update for nova (GHSA-xjmj-p278-4jp5)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
80711	Oracle Solaris Third-Party Patch Update : nova (cve_2014_3517_information_disclosure)	Nessus	Solaris Local Security Checks	Local	medium
77325	Ubuntu 14.04 LTS : OpenStack Nova vulnerability (USN-2325-1)	Nessus	Ubuntu Local Security Checks	Local	high

Detections

Analytics

CVE-2014-3517

high

Tenable Plugins

high

high

medium

high