A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A resource-permission flaw was found in the openstack-tripleo-heat-templates package where     ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could     read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service,     thus potentially reading or modifying data in an OpenStack Block Storage volume. (CVE-2017-12155)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A resource-permission flaw was found in the openstack-tripleo-heat-templates package where
    ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could
    read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service,
    thus potentially reading or modifying data in an OpenStack Block Storage volume. (CVE-2017-12155)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1627 advisory.

    Red Hat OpenStack Platform director provides the facilities for deploying     and monitoring a private or public infrastructure-as-a-service (IaaS) cloud     based on Red Hat OpenStack Platform.

    Security Fix(es):

    * A resource-permission flaw was found in the python-tripleo and openstack-tripleo-heat-templates packages     where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key     could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack     service, thus potentially reading or modifying data in an OpenStack Block Storage volume.

    To exploit this flaw, the attacker must have local access to an overcloud node. However by default, access     to overcloud nodes is restricted and accessible only from the management undercloud server on an internal     network. (CVE-2017-12155)

    This issue was discovered by Katuya Kawakami (NEC).

    * It was discovered that the memcached connections using UDP transport protocol can be abused for     efficient traffic amplification distributed denial of service (DDoS) attacks. A remote attacker could send     a malicious UDP request using a spoofed source IP address of a target system to memcached, causing it to     send a significantly larger response to the target. (CVE-2018-1000115)

    This update also includes the following bug fixes and enhancements:

    * Prior to this update, when removing the ceph-osd RPM from overcloud nodes that do not require the     package, the corresponding Ceph OSD product key was not removed. Consequently, the subscription-manager     would incorrectly report that the Ceph OSD product was still installed.
    With this update, the script that handles removal of the ceph-osd RPM now also removes the Ceph OSD     product key. Note: The script that removes the RPM and product key executes only during the overcloud     update procedure; the product key is removed only when the overcloud node is updated.
    As a result, after removing the ceph-osd RPM, the subscription-manager no longer reports the Ceph OSD     product is installed. (BZ#1571436)

    * Previously, there were errors in the director Heat template that configures the VMAX Cinder backend     driver. Consequently, the VMAX driver would not function correctly. With this update, the errors have been     corrected, and the VMAX driver functions correctly. (BZ#1546799)

    * This enhancement adds director support for deploying the Dell EMC VMAX cinder backend. (BZ#1546793)

    * In this enhancement, if a minor update is blocked by an existing yum process that prevents the package     update, the process should exit with an appropriate error message. This was added because the minor update     may appear to freeze, due to yum waiting for the existing yum.pid to exit; when it eventually fails it is     not immediately clear why. As a result, if there is an existing yum process preventing the package update,     then the minor update fails with a clear message to indicate this: ERROR existing yum.pid detected -     can't continue! Please ensure there is no other package update process for the duration of the minor     update worfklow. Exiting. (BZ#1471721)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1593 advisory.

    Red Hat OpenStack Platform director provides the facilities for deploying and monitoring a private or     public infrastructure-as-a-service (IaaS) cloud based on Red Hat OpenStack Platform.

    Security Fix(es):

    * A resource-permission flaw was found in the python-tripleo and openstack-tripleo-heat-templates packages     where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key     could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack     service, thus potentially reading or modifying data in an OpenStack Block Storage volume.

    To exploit this flaw, the attacker must have local access to an overcloud node. However by default, access     to overcloud nodes is restricted and accessible only from the management undercloud server on an internal     network. (CVE-2017-12155)

    This issue was discovered by Katuya Kawakami (NEC).

    * It was discovered that the memcached connections using UDP transport protocol can be abused for     efficient traffic amplification distributed denial of service (DDoS) attacks. A remote attacker could send     a malicious UDP request using a spoofed source IP address of a target system to memcached, causing it to     send a significantly larger response to the target. (CVE-2018-1000115)

    This advisory also addresses the following issues:

    * This release adds support for deploying Dell EMC VMAX Block Storage backend using the Red Hat OpenStack     Platform director. (BZ#1503896)

    * Using composable roles for deploying Dell SC and PS Block Storage backend caused errors. The backends     could only be deploying using 'cinder::config::cinder_config' hiera data.
    With this update, the composable role support for deploying the Dell SC and PS Block Storage backends is     updated. As a result, they can be now deployed using composable roles. (BZ#1552980)

    * Previously, the iptables rules were managed by the Red Hat OpenStack Platform director and the OpenStack     Networking service, which resulted in the rules created by the OpenStack Networking service to persist on     to the disk. As a result, the rules that should not be loaded after an iptables restart or a system reboot     would be loaded causing traffic issues.
    With this update, the Red Hat OpenStack Platform director has been updated to exclude the OpenStack     Networking rules from '/etc/sysconfig/iptables' when the director saves the firewall rules. As a result,     iptables restart or a system reboot should work without causing traffic problems.
    Note: It might be necessary to perform a rolling restart of the controller nodes to ensure that any     orphaned managed neutron rules are no longer reloaded. (BZ#1541528)

    * OS::TripleO::SwiftStorage::Ports* resources have been renamed to OS::TripleO::ObjectStorage::Port* to     ensure standalone Object Storage nodes using the 'ObjectStorage' roles can be deployed correctly.
    Operators need to modify their custom templates that previously used OS::TripleO::SwiftStorage::Ports*     settings. (BZ#1544802)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
252830	Linux Distros Unpatched Vulnerability : CVE-2017-12155	Nessus	Misc.	Local	medium
434261	SCA: security update for tripleo-heat-templates (GHSA-w8gx-hhcx-px6w)	Tenable Cloud Security	SCA Checks	Local	medium
434261	SCA: security update for tripleo-heat-templates (GHSA-w8gx-hhcx-px6w)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
194093	RHEL 7 : Red Hat OpenStack Platform director (RHSA-2018:1627)	Nessus	Red Hat Local Security Checks	Local	medium
194086	RHEL 7 : Red Hat OpenStack Platform director (RHSA-2018:1593)	Nessus	Red Hat Local Security Checks	Local	medium

Detections

Analytics

CVE-2017-12155

medium

Tenable Plugins

medium

medium

medium

medium

medium