Ubuntu 13.10 / 14.04 LTS : neutron vulnerabilities (USN-2255-1)

High Nessus Plugin ID 76250


The remote Ubuntu host is missing a security-related patch.


Darragh O'Reilly discovered that the Ubuntu packaging for OpenStack Neutron did not properly set up its sudo configuration. If a different flaw was found in OpenStack Neutron, this vulnerability could be used to escalate privileges. (CVE-2013-6433)

Stephen Ma and Christoph Thiel discovered that the openvswitch-agent in OpenStack Neutron did not properly perform input validation when creating security group rules when specifying --remote-ip-prefix. A remote authenticated attacker could exploit this to prevent application of additional rules. (CVE-2014-0187)

Thiago Martins discovered that OpenStack Neutron would inappropriately apply SNAT rules to IPv6 subnets when using the L3-agent. A remote authenticated attacker could exploit this to prevent floating IPv4 addresses from being attached throughout the cloud. (CVE-2014-4167).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.


Update the affected python-neutron package.

Plugin Details

Severity: High

ID: 76250

File Name: ubuntu_USN-2255-1.nasl

Version: $Revision: 1.4 $

Type: local

Agent: unix

Published: 2014/06/26

Modified: 2016/05/24

Dependencies: 12634

Risk Information

Risk Factor: High


Base Score: 9

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

Temporal Vector: CVSS2#E:ND/RL:OF/RC:ND

Vulnerability Information

CPE: p-cpe:/a:canonical:ubuntu_linux:python-neutron, cpe:/o:canonical:ubuntu_linux:13.10, cpe:/o:canonical:ubuntu_linux:14.04

Required KB Items: Host/cpu, Host/Ubuntu, Host/Ubuntu/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2014/06/25

Reference Information

CVE: CVE-2013-6433, CVE-2014-0187, CVE-2014-4167

BID: 67012, 67804, 68064

USN: 2255-1