OpenStack Compute (nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) does not properly delete instances from compute nodes, which allows remote authenticated users to cause a denial of service (disk consumption) by deleting instances while in the resize state.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenStack Compute (nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) does not properly
    delete instances from compute nodes, which allows remote authenticated users to cause a denial of service
    (disk consumption) by deleting instances while in the resize state. (CVE-2015-3280)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1898 advisory.

    OpenStack Compute (nova) launches and schedules large networks of virtual     machines, creating a redundant and scalable cloud computing platform.
    Compute provides the software, control panels, and APIs required to     orchestrate a cloud, including running virtual machine instances and     controlling access through users and projects.

    A denial of service flaw was found in the OpenStack Compute instance     migration process. Because the migration process does not terminate     when an instance is deleted, an authenticated user could bypass     user quota and deplete all available disk space by repeatedly re-sizing     and deleting an instance. (CVE-2015-3241)

    A flaw was found in the way OpenStack Compute handled the resize     state. If an authenticated user deleted an instance while it was in the     resize state, it could cause the original instance to not be deleted from     the compute node it was running on, allowing the user to cause a denial     of service. (CVE-2015-3280)

    Note: CVE-2015-3241 was already addressed in Red Hat Enterprise Linux     OpenStack Platform 7.0 in a previous release.

    Red Hat would like to thank the OpenStack project for reporting these     issues. Upstream acknowledges George Shuklin of Webzilla LTD as the     original reporter of CVE-2015-3241, and George Shuklin from Webzilla LTD     and Tushar Patil from NTT DATA, Inc. as the original reporters of     CVE-2015-3280.

    All openstack-nova users are advised to upgrade to these updated packages,     which correct these issues and add these enhancements.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3449-1 advisory.

    George Shuklin discovered that OpenStack Nova incorrectly handled the migration process. A remote     authenticated user could use this issue to consume resources, resulting in a denial of service.
    (CVE-2015-3241)

    George Shuklin and Tushar Patil discovered that OpenStack Nova incorrectly handled deleting instances. A     remote authenticated user could use this issue to consume disk resources, resulting in a denial of     service. (CVE-2015-3280)

    It was discovered that OpenStack Nova incorrectly limited qemu-img calls. A remote authenticated user     could use this issue to consume resources, resulting in a denial of service. (CVE-2015-5162)

    Matthew Booth discovered that OpenStack Nova incorrectly handled snapshots. A remote authenticated user     could use this issue to read arbitrary files. (CVE-2015-7548)

    Sreekumar S. and Suntao discovered that OpenStack Nova incorrectly applied security group changes. A     remote attacker could possibly use this issue to bypass intended restriction changes by leveraging an     instance that was running when the change was made. (CVE-2015-7713)

    Matt Riedemann discovered that OpenStack Nova incorrectly handled logging. A local attacker could possibly     use this issue to obtain sensitive information from log files. (CVE-2015-8749)

    Matthew Booth discovered that OpenStack Nova incorrectly handled certain qcow2 headers. A remote     authenticated user could possibly use this issue to read arbitrary files. (CVE-2016-2140)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
416928	SCA: security update for nova (GHSA-mfmj-gwg3-vhw7)	Tenable Cloud Security	SCA Checks	medium
416928	SCA: security update for nova (GHSA-mfmj-gwg3-vhw7)	Tenable Self-Hosted Container Security	SCA Checks	medium
210203	RHEL 6 / 7 : openstack-nova (RHSA-2015:1898)	Nessus	Red Hat Local Security Checks	medium
103812	Ubuntu 14.04 LTS : OpenStack Nova vulnerabilities (USN-3449-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2015-3280

medium

Tenable Plugins

medium

medium

medium

medium