OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show_multiple_locations is enabled, allow remote authenticated users to change image status and upload new image data by removing the last location of an image.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:0309 advisory.

    OpenStack Image Service (glance) provides discovery, registration, and     delivery services for disk and server images. The service provides the     ability to copy or snapshot a server image, and immediately store it away.
    Stored images can be used as a template to get new servers up and running     quickly and more consistently than installing a server operating system     and individually configuring additional services.

    An authorization vulnerability in OpenStack Image service was discovered,     which allowed image-status manipulation using locations. By removing the     last location of an image, an authenticated user could change the status     from 'active' to 'queue'. A malicious tenant could exploit this flaw to     silently replace owned image data, regardless of its original creator or     visibility settings. Only environments with show_multiple_locations set     to true (not default) were affected. (CVE-2016-0757)

    Red Hat would like to thank the Openstack project for reporting this issue.
    Upstream acknowledges Erno Kuvaja of HPE as the original reporter.

    All openstack-glance users are advised to upgrade to these updated     packages, which address this vulnerability.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when
    show_multiple_locations is enabled, allow remote authenticated users to change image status and upload new
    image data by removing the last location of an image. (CVE-2016-0757)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3446-1 advisory.

    Hemanth Makkapati discovered that OpenStack Glance incorrectly handled access restrictions. A remote     authenticated user could use this issue to change the status of images, contrary to access restrictions.
    (CVE-2015-5251)

    Mike Fedosin and Alexei Galkin discovered that OpenStack Glance incorrectly handled the storage quota. A     remote authenticated user could use this issue to consume disk resources, leading to a denial of service.
    (CVE-2015-5286)

    Erno Kuvaja discovered that OpenStack Glance incorrectly handled the show_multiple_locations option. When     show_multiple_locations is enabled, a remote authenticated user could change an image status and upload     new image data. (CVE-2016-0757)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
234427	RHEL 7 : openstack-glance (RHSA-2016:0309)	Nessus	Red Hat Local Security Checks	medium
411092	SCA: security update for glance (GHSA-5xrj-ghhp-hx7p)	Tenable Cloud Security	SCA Checks	medium
411092	SCA: security update for glance (GHSA-5xrj-ghhp-hx7p)	Tenable Self-Hosted Container Security	SCA Checks	medium
103809	Ubuntu 14.04 LTS : OpenStack Glance vulnerabilities (USN-3446-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2016-0757

medium

Tenable Plugins

medium

medium

medium

medium