A flaw was found in instack-undercloud 7.2.0 as packaged in Red Hat OpenStack Platform Pike, 6.1.0 as packaged in Red Hat OpenStack Platform Oacta, 5.3.0 as packaged in Red Hat OpenStack Newton, where pre-install and security policy scripts used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2017:2557 advisory.

    instack-undercloud provides a collection of scripts and elements that can be used to install an OpenStack     undercloud (using python-instack).

    Security Fix(es):

    * A flaw was found in instack-undercloud where pre-install and security policy scripts used insecure     temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to     overwrite the contents of arbitrary files. (CVE-2017-7549)

    This issue was discovered by Matthew Booth (Red Hat).

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2017:2693 advisory.

    instack-undercloud provides a collection of scripts and elements that can be used to install an OpenStack     undercloud (using python-instack).

    Security Fix(es):

    * A flaw was found in instack-undercloud where pre-install and security policy scripts used insecure     temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to     overwrite the contents of arbitrary files. (CVE-2017-7549)

    This issue was discovered by Matthew Booth (Red Hat).

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2017:2726 advisory.

    instack-undercloud provides a collection of scripts and elements that can be used to install an OpenStack     undercloud (using python-instack).

    The following packages have been upgraded to a later upstream version: instack-undercloud (6.1.0).
    (BZ#1481793)

    Security Fix(es):

    * A flaw was found in instack-undercloud where pre-install and security policy scripts used insecure     temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to     overwrite the contents of arbitrary files. (CVE-2017-7549)

    This issue was discovered by Matthew Booth (Red Hat).

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2017:2687 advisory.

    instack-undercloud provides a collection of scripts and elements that can be used to install an OpenStack     undercloud (using python-instack).

    Security Fix(es):

    * A flaw was found in instack-undercloud where pre-install and security policy scripts used insecure     temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to     overwrite the contents of arbitrary files. (CVE-2017-7549)

    This issue was discovered by Matthew Booth (Red Hat).

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2017:2649 advisory.

    instack-undercloud provides a collection of scripts and elements that can be used to install an OpenStack     undercloud (using python-instack).

    The following packages have been upgraded to a later upstream version:
    instack-undercloud (5.3.0). (BZ#1479841)

    Security Fix(es):

    * A flaw was found in instack-undercloud where pre-install and security     policy scripts used insecure temporary files. A local user could exploit     this flaw to conduct a symbolic-link attack, allowing them to overwrite the     contents of arbitrary files. (CVE-2017-7549)

    This issue was discovered by Matthew Booth (Red Hat).

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
210329	RHEL 7 : instack-undercloud (RHSA-2017:2557)	Nessus	Red Hat Local Security Checks	medium
210328	RHEL 7 : instack-undercloud (RHSA-2017:2693)	Nessus	Red Hat Local Security Checks	medium
210327	RHEL 7 : instack-undercloud (RHSA-2017:2726)	Nessus	Red Hat Local Security Checks	medium
210319	RHEL 7 : instack-undercloud (RHSA-2017:2687)	Nessus	Red Hat Local Security Checks	medium
193841	RHEL 7 : instack-undercloud (RHSA-2017:2649)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2017-7549

medium

Tenable Plugins

medium

medium

medium

medium

medium