Ubuntu 13.10 / 14.04 LTS : neutron vulnerabilities (USN-2255-1)
High Nessus Plugin ID 76250
SynopsisThe remote Ubuntu host is missing a security-related patch.
DescriptionDarragh O'Reilly discovered that the Ubuntu packaging for OpenStack Neutron did not properly set up its sudo configuration. If a different flaw was found in OpenStack Neutron, this vulnerability could be used to escalate privileges. (CVE-2013-6433)
Stephen Ma and Christoph Thiel discovered that the openvswitch-agent in OpenStack Neutron did not properly perform input validation when creating security group rules when specifying --remote-ip-prefix. A remote authenticated attacker could exploit this to prevent application of additional rules. (CVE-2014-0187)
Thiago Martins discovered that OpenStack Neutron would inappropriately apply SNAT rules to IPv6 subnets when using the L3-agent. A remote authenticated attacker could exploit this to prevent floating IPv4 addresses from being attached throughout the cloud. (CVE-2014-4167).
Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
SolutionUpdate the affected python-neutron package.