The VMWare driver in OpenStack Compute (Nova) before 2014.1.3 allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by putting the VM into the rescue state, suspending it, which puts into an ERROR state, and then deleting the image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2573.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The VMWare driver in OpenStack Compute (Nova) before 2014.1.3 allows remote authenticated users to bypass
    the quota limit and cause a denial of service (resource consumption) by putting the VM into the rescue
    state, suspending it, which puts into an ERROR state, and then deleting the image. NOTE: this
    vulnerability exists because of an incomplete fix for CVE-2014-2573. (CVE-2014-3608)

The remote Solaris system is missing necessary patches to address security updates :

  - The VMWare driver in OpenStack Compute (Nova) 2013.2     through 2013.2.2 does not properly put VMs into RESCUE     status, which allows remote authenticated users to     bypass the quota limit and cause a denial of service     (resource consumption) by requesting the VM be put into     rescue and then deleting the image. (CVE-2014-2573)

  - The VMWare driver in OpenStack Compute (Nova) before     2014.1.3 allows remote authenticated users to bypass the     quota limit and cause a denial of service (resource     consumption) by putting the VM into the rescue state,     suspending it, which puts into an ERROR state, and then     deleting the image. NOTE: this vulnerability exists     because of an incomplete fix for CVE-2014-2573.
    (CVE-2014-3608)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2407-1 advisory.

    Garth Mollett discovered that OpenStack Nova did not properly clean up an instance when using rescue mode     with the VMWare driver. A remove authenticated user could exploit this to bypass intended quota limits. By     default, Ubuntu does not use the VMWare driver. (CVE-2014-3608)

    Amrith Kumar discovered that OpenStack Nova did not properly sanitize log message contents. Under certain     circumstances, a local attacker with read access to Nova log files could obtain access to sensitive     information. (CVE-2014-7230)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
412957	SCA: security update for nova (GHSA-92hc-c226-32q7)	Tenable Cloud Security	SCA Checks	Local	high
412957	SCA: security update for nova (GHSA-92hc-c226-32q7)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
80712	Oracle Solaris Third-Party Patch Update : nova (multiple_vulnerabilities_in_nova)	Nessus	Solaris Local Security Checks	Local	low
79213	Ubuntu 14.04 LTS : OpenStack Nova vulnerabilities (USN-2407-1)	Nessus	Ubuntu Local Security Checks	Local	medium

Detections

Analytics

CVE-2014-3608

high

Tenable Plugins

high

high

low

medium