The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the v1/drivers/$DRIVER_NAME/vendor_passthru resource.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows
    remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the
    MAC address of a network card belonging to that node and sending a crafted POST request to the
    v1/drivers/$DRIVER_NAME/vendor_passthru resource. (CVE-2016-4985)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:1377 advisory.

    OpenStack Bare Metal (ironic) is a tool used to provision bare metal (as     opposed to virtual) machines. It leverages common technologies such as PXE     boot and IPMI to cover a wide range of hardware. It also supports pluggable     drivers to allow added, vendor-specific functionality.

    Security Fix(es):

    * An authentication vulnerability was found in openstack-ironic. A client with network access to the     ironic-api service could bypass OpenStack Identity authentication, and retrieve all information about any     node registered with OpenStack Bare Metal. If an unprivileged attacker knew (or was able to guess) the MAC     address of a network card belonging to a node, the flaw could be exploited by sending a crafted POST     request to the node's /v1/drivers/$DRIVER_NAME/vendor_passthru resource. The response included the node's     full details, including management passwords, even if the /etc/ironic/policy.json file was configured to     hide passwords in API responses. (CVE-2016-4985)

    Red Hat would like to thank the OpenStack Ironic project for reporting     this issue. Upstream acknowledges Devananda van der Veen (IBM) as the     original reporter.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:1378 advisory.

    OpenStack Bare Metal (ironic) is a tool used to provision bare metal (as opposed to virtual) machines. It     leverages common technologies such as PXE boot and IPMI to cover a wide range of hardware. It also     supports pluggable drivers to allow added, vendor-specific functionality.

    Security Fix(es):

    * An authentication vulnerability was found in openstack-ironic. A client with network access to the     ironic-api service could bypass OpenStack Identity authentication, and retrieve all information about any     node registered with OpenStack Bare Metal. If an unprivileged attacker knew (or was able to guess) the MAC     address of a network card belonging to a node, the flaw could be exploited by sending a crafted POST     request to the node's /v1/drivers/$DRIVER_NAME/vendor_passthru resource. The response included the node's     full details, including management passwords, even if the /etc/ironic/policy.json file was configured to     hide passwords in API responses. (CVE-2016-4985)

    Red Hat would like to thank the OpenStack Ironic project for reporting this issue. Upstream acknowledges     Devananda van der Veen (IBM) as the original reporter.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
432702	SCA: security update for ironic (GHSA-f7cr-7c2c-fm8r)	Tenable Cloud Security	SCA Checks	high
432702	SCA: security update for ironic (GHSA-f7cr-7c2c-fm8r)	Tenable Self-Hosted Container Security	SCA Checks	high
210227	RHEL 7 : openstack-ironic (RHSA-2016:1377)	Nessus	Red Hat Local Security Checks	high
210214	RHEL 7 : openstack-ironic (RHSA-2016:1378)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2016-4985

high

Tenable Plugins

high

high

high

high