OpenStack Image Registry and Delivery Service (Glance) before 2013.2.4, 2014.x before 2014.1.3, and Juno before Juno-3, when using the V2 API, does not properly enforce the image_size_cap configuration option, which allows remote authenticated users to cause a denial of service (disk consumption) by uploading a large image.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2014:1685 advisory.

    OpenStack Image service (glance) provides discovery, registration, and     delivery services for disk and server images. It provides the ability to     copy or snapshot a server image, and immediately store it away. Stored     images can be used as a template to get new servers up and running quickly     and more consistently than installing a server operating system and     individually configuring additional services.

    It was discovered that the image_size_cap configuration option in glance     was not honored. An authenticated user could use this flaw to upload an     image to glance and consume all available storage space, resulting in a     denial of service. (CVE-2014-5356)

    The openstack-glance packages have been upgraded to upstream version     2013.2.4, which provides a number of bug fixes over the previous version.
    (BZ#1146089)

    All openstack-glance users are advised to upgrade to these updated     packages, which correct these issues. After installing the updated     packages, the running glance services will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Solaris system is missing necessary patches to address security updates :

  - OpenStack Image Registry and Delivery Service (Glance)     before 2013.2.4, 2014.x before 2014.1.3, and Juno before     Juno-3, when using the V2 API, does not properly enforce     the image_size_cap configuration option, which allows     remote authenticated users to cause a denial of service     (disk consumption) by uploading a large image.
    (CVE-2014-5356)

Update to upstream 2013.2.4 Merge spec from el6-icehouse Security fix for CVE-2014-5356

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2322-1 advisory.

    Thomas Leaman and Stuart McLaren discovered that OpenStack Glance did not properly honor the     image_size_cap configuration option. A remote authenticated attacker could exploit this to cause a denial     of service via disk consumption.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
210201	RHEL 6 : openstack-glance (RHSA-2014:1685)	Nessus	Red Hat Local Security Checks	medium
80624	Oracle Solaris Third-Party Patch Update : glance (cve_2014_5356_permissions_privileges)	Nessus	Solaris Local Security Checks	medium
78564	Fedora 20 : openstack-glance-2013.2.4-1.fc20 (2014-11697)	Nessus	Fedora Local Security Checks	medium
77322	Ubuntu 14.04 LTS : OpenStack Glance vulnerability (USN-2322-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2014-5356

medium

Tenable Plugins

medium

medium

medium

medium