A flaw was found in Red Hat Ceph before 0.94.9-8. The way Ceph Object Gateway handles POST object requests permits an authenticated attacker to launch a denial of service attack by sending null or specially crafted POST object requests.

An update is now available for Red Hat Ceph Storage 1.3. This erratum is applicable for Red Hat Ceph Storage that runs on Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support services.

Security Fix(es) :

* A flaw was found in the way Ceph Object Gateway handles POST object requests. An authenticated attacker could launch a denial of service attack by sending null or specially crafted POST object requests.
(CVE-2016-8626)

Bug Fix(es) :

* Dynamic Large Objects (DLOs) containing zero-length segments could cause the GET requests to enter an infinite loop or to fail depending on the position of the zero-length segment in an object, causing Ceph Object Gateway nodes to consume 100% of CPU. This bug has been fixed, and the GET requests succeed as expected in described situation.
(BZ#1380196)

* After backporting certain upstream changes, an attempt to delete objects that contain underscore characters failed. The change causing this bug has been removed, and objects can now be deleted as expected.
(BZ#1388647)

Enhancement(s) :

* This update adds the 'apply-layout-settings' command to the ceph-objectstore-tool utility. The new command enables users to perform collection splitting offline on OSD nodes in cases when doing it online would cause too large an impact. (BZ#1367441)

* With this update, it is possible to change the maximum number shards per bucket. This is especially useful when bucket sharding was not configured correctly. (BZ#1378995)

All users of Red Hat Ceph Storage are advised to upgrade to these updated packages.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:2815 advisory.

    Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable     version of the Ceph storage system with a Ceph management platform, deployment utilities, and support     services.

    The following packages have been upgraded to a newer upstream version: ceph (10.2.3), ceph-deploy     (1.5.36), calamari-server (1.4.9), nfs-ganesha (2.4.0), ceph-iscsi-config (1.5), libntirpc (1.4.1), ceph-     iscsi-tools (1.1). (BZ#1340004, BZ#1349999)

    Security Fix(es):

    * A flaw was found in the way Ceph Object Gateway handles POST object requests. An authenticated attacker     could launch a denial of service attack by sending null or specially crafted POST object requests.
    (CVE-2016-8626)

    Bug Fix(es) and Enhancement(s):

    For detailed information on changes in this release, see the Red Hat Ceph     Storage 2.1 Release Notes available at:

    https://access.redhat.com/documentation/en/red-hat-ceph-storage/2.1/single/release-notes/

    All users of Red Hat Ceph Storage are advised to upgrade to these updated     packages.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3452-1 advisory.

    It was discovered that Ceph incorrectly handled the handle_command function. A remote authenticated user     could use this issue to cause Ceph to crash, resulting in a denial of service. (CVE-2016-5009)

    Rahul Aggarwal discovered that Ceph incorrectly handled the authenticated-read ACL. A remote attacker     could possibly use this issue to list bucket contents via a URL. (CVE-2016-7031)

    Diluga Salome discovered that Ceph incorrectly handled certain POST objects with null conditions. A remote     attacker could possibly use this issue to cuase Ceph to crash, resulting in a denial of service.
    (CVE-2016-8626)

    Yang Liu discovered that Ceph incorrectly handled invalid HTTP Origin headers. A remote attacker could     possibly use this issue to cuase Ceph to crash, resulting in a denial of service. (CVE-2016-9579)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
110331	RHEL 7 : Red Hat Ceph Storage 1.3 (RHSA-2016:2847)	Nessus	Red Hat Local Security Checks	Local	medium
110330	RHEL 7 : Red Hat Ceph Storage (RHSA-2016:2815)	Nessus	Red Hat Local Security Checks	Local	medium
103815	Ubuntu 14.04 LTS : Ceph vulnerabilities (USN-3452-1)	Nessus	Ubuntu Local Security Checks	Local	high

Detections

Analytics

CVE-2016-8626

medium

Tenable Plugins

medium

medium

high