OpenStack Nova uses insecure keystone middleware tmpdir by default
keystone/middleware/auth_token.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing certificates, which allows local users to spoof servers by pre-creating this directory, which is reused by Nova, as demonstrated using /tmp/keystone-signing-nova on Fedora.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2013-2030US | low2.1OT elevated | — | ||
keystone/middleware/auth_token.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing certificates, which allows local users to s… | ||||
02
references
External citations — patches, advisories, analysis.
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105916.htmlWEB
- http://lists.openstack.org/pipermail/openstack-announce/2013-May/000098.htmlWEB
- http://www.openwall.com/lists/oss-security/2013/05/09/2WEB
- https://bugs.launchpad.net/nova/+bug/1174608WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=958285WEB
- https://github.com/openstack/novaPACKAGE
- https://github.com/openstack/nova/commit/58d6879b1caaa750c39c8e452a0634c24ffef2ceWEB
- https://github.com/openstack/nova/commit/74aa04e2ca7942cb1e1a86dcbaffeb72d260ccd7WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan