Vulnerabilities > CVE-2013-0282 - Improper Authentication vulnerability in Openstack Keystone

047910
CVSS 5.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
NONE
Availability impact
NONE
network
low complexity
openstack
CWE-287
nessus

Summary

OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the (1) user, (2) tenant, or (3) domain is enabled when using EC2-style authentication, which allows context-dependent attackers to bypass access restrictions.

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Authentication Abuse
    An attacker obtains unauthorized access to an application, service or device either through knowledge of the inherent weaknesses of an authentication mechanism, or by exploiting a flaw in the authentication scheme's implementation. In such an attack an authentication mechanism is functioning but a carefully controlled sequence of events causes the mechanism to grant access to the attacker. This attack may exploit assumptions made by the target's authentication procedures, such as assumptions regarding trust relationships or assumptions regarding the generation of secret values. This attack differs from Authentication Bypass attacks in that Authentication Abuse allows the attacker to be certified as a valid user through illegitimate means, while Authentication Bypass allows the user to access protected material without ever being certified as an authenticated user. This attack does not rely on prior sessions established by successfully authenticating users, as relied upon for the "Exploitation of Session Variables, Resource IDs and other Trusted Credentials" attack patterns.
  • Exploiting Trust in Client (aka Make the Client Invisible)
    An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
  • Utilizing REST's Trust in the System Resource to Register Man in the Middle
    This attack utilizes a REST(REpresentational State Transfer)-style applications' trust in the system resources and environment to place man in the middle once SSL is terminated. Rest applications premise is that they leverage existing infrastructure to deliver web services functionality. An example of this is a Rest application that uses HTTP Get methods and receives a HTTP response with an XML document. These Rest style web services are deployed on existing infrastructure such as Apache and IIS web servers with no SOAP stack required. Unfortunately from a security standpoint, there frequently is no interoperable identity security mechanism deployed, so Rest developers often fall back to SSL to deliver security. In large data centers, SSL is typically terminated at the edge of the network - at the firewall, load balancer, or router. Once the SSL is terminated the HTTP request is in the clear (unless developers have hashed or encrypted the values, but this is rare). The attacker can utilize a sniffer such as Wireshark to snapshot the credentials, such as username and password that are passed in the clear once SSL is terminated. Once the attacker gathers these credentials, they can submit requests to the web service provider just as authorized user do. There is not typically an authentication on the client side, beyond what is passed in the request itself so once this is compromised, then this is generally sufficient to compromise the service's authentication scheme.
  • Man in the Middle Attack
    This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed on to the other component as if it was never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identify between two components.

Nessus

  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2013-237.NASL
    descriptionThe Openstack Stack components were updated to Folsom level as of March 5th. Changes in openstack-cinder : - Update 12.3 packages to Folsom as of March 5th. This comes with security fixes and bug fixes that we need to have OpenStack work nicely. Fix bnc#802278. - Update cinder-config-update.diff: update etc/cinder/api-paste.ini to have a signing_dir key under [filter:authtoken]. Otherwise, cinder-api won
    last seen2020-06-05
    modified2014-06-13
    plugin id74936
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/74936
    titleopenSUSE Security Update : openstack (openSUSE-2013-237)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2013-237.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(74936);
      script_version("1.2");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2013-0208", "CVE-2013-0212", "CVE-2013-0247", "CVE-2013-0282", "CVE-2013-0335", "CVE-2013-1664", "CVE-2013-1665", "CVE-2013-1838", "CVE-2013-1840");
    
      script_name(english:"openSUSE Security Update : openstack (openSUSE-2013-237)");
      script_summary(english:"Check for the openSUSE-2013-237 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The Openstack Stack components were updated to Folsom level as of
    March 5th.
    
    Changes in openstack-cinder :
    
      - Update 12.3 packages to Folsom as of March 5th. This
        comes with security fixes and bug fixes that we need to
        have OpenStack work nicely. Fix bnc#802278.
    
      - Update cinder-config-update.diff: update
        etc/cinder/api-paste.ini to have a signing_dir key under
        [filter:authtoken]. Otherwise, cinder-api won't start.
        This was done with commit de289a6 in Grizzly.
    
      - Update to version 2012.2.4+git.1362502414.95a620b :
    
      + Check for non-default volume name template.
    
      + Fix error for extra specs update with empty body.
    
      - Update to version 2012.2.4+git.1361527687.68de70d :
    
      + Add a safe_minidom_parse_string function.
        (CVE-2013-1664)
    
      - Set auth_strategy to keystone for a good out-of-the-box
        experience
    
      - Add cinder-config-update.diff: move configuration
        changes to a patch, instead of using sed.
    
      - Update to version 2012.2.4+git.1360133755.a8caa79 :
    
      + Final versioning for 2012.2.3
    
      + Bump version to 2012.2.4
    
      + Fix typo in cinder/db/api.py
    
      - Update to version 2012.2.3+git.1358429029.cdf6c13 :
    
      + Add commands used by NFS volume driver to rootwrap
    
    Changes in openstack-dashboard :
    
      - Update 12.3 packages to Folsom as of March 5th. This
        comes with security fixes and bug fixes that we need to
        have OpenStack work nicely. Fix bnc#802278.
    
      - Backport packaging changes we did for Grizzly to fix
        theming :
    
      + define a production %bcond_with that will determine
        whether offline compression is used or not.
    
      + if not using the production feature, have a nodejs
        Requires.
    
      + move compression steps to %prep.
    
      + by default, use the non-production mode for greater
        flexibility.
    
      - Do not use 'SUSE Cloud' as site branding: this is not
        SUSE Cloud.
    
      - Update to version 2012.2.4+git.1362503968.8ece3c7 :
    
      + pin django to 1.4.x stream
    
      - Update to version 2012.2.4+git.1361527741.0a42fa0 :
    
      + Prevent the user from creating a single IP address sized
        network
    
      + Add UTC offset information to the timezone
    
      - Update to version 2012.2.4+git.1360133827.f421145 :
    
      + Final versioning for 2012.2.3
    
      + Bump version to 2012.2.4
    
      - Update to version 2012.2.2+git.1359111868.20fa0fc :
    
      + Pin docutils to 0.9.1, fix pep8 errors
    
      + Fix bug 1055929 - Can not display usage data for Quota
        Summary.
    
      + Revert 'Temp fix for api/keystone.py'
    
      + Specify floating ips table action column's width
    
      + Allow setting nova quotas to unlimited
    
      + Add a check for unlimited quotas
    
      + Avoid cinder calls, when cinder is unavailable
    
      + Don't inherit from base.html in 500 error page
    
      + Don't show the EC2 Credentials panel if there is no EC2
        service
    
      - Drop horizon-ssl.patch: merged upstream.
    
    Changes in openstack-glance :
    
      - Do not return location in headers (CVE-2013-1840)
    
      - This fixes bnc#808626.
    
      - Update 12.3 packages to Folsom as of March 5th. This
        comes with· security fixes and bug fixes that we
        need to have OpenStack work nicely. Fix bnc#802278.
    
      - Update to version 2012.2.4+git.1362583521.1fb759d :
    
      + Swallow UserWarning from glance-cache-manage
    
      + Avoid dangling partial image on size/checksum mismatch
    
      - Update to version 2012.2.4+git.1362503824.afe6166 :
    
      + Fix broken JSON schemas in v2 tests
    
      + Prints list-cached dates in isoformat
    
      - Update to version 2012.2.4+git.1360133885.98d9928 :
    
      + Bump version to 2012.2.4
    
      - Update to version 2012.2.3+git.1359529730.a5b0f4e :
    
      + Change useexisting to extend_existing to fix deprecation
        warnings.
    
      + Remove Swift location/password from messages.
        (CVE-2013-0212)
    
    Changes in openstack-keystone :
    
      - Update 12.3 packages to Folsom as of March 5th. This
        comes with· security fixes and bug fixes that we
        need to have OpenStack work nicely. Fix bnc#802278.
    
      - fix logging.conf to be about keystone and have absolute
        path
    
      - Update to version 2012.2.4+git.1362502288.8690166 :
    
      + Sync timeutils to pick up normalize fix.
    
      + Backport of fix for 24-hour failure of pki.
    
      - Update to version 2012.2.4+git.1361527873.37b3532 :
    
      + Disable XML entity parsing (CVE-2013-1664,
        CVE-2013-1665)
    
      + Ensure user and tenant enabled in EC2 (CVE-2013-0282)
    
      - Update to version 2012.2.4+git.1360133921.82c87e5 :
    
      + Bump version to 2012.2.4
    
      + Add size validations for /tokens. (CVE-2013-0247)
    
      - Update to version 2012.2.3+git.1359550485.ec7b94d :
    
      + Test 0.2.0 keystoneclient to avoid new deps
    
      + Unparseable endpoint URL's should raise friendly error
    
      + Fix catalog when services have no URL
    
      + Render content-type appropriate 404 (bug 1089987)
    
      - fix last commit's hash tag in Version
    
    Changes in openstack-nova :
    
      - Add quotas for fixed ips. (CVE-2013-1838)
    
      - Update to version 2012.2.3+git.1358515929.3545a7d :
    
      + Add NFS to the libvirt volume driver list
    
      + Call plug_vifs() for all instances in init_host
    
      + Fix addition of CPU features when running against legacy
        libvirt
    
      + Fix typo in resource tracker audit message
    
      - Move back to 'git_tarballs' source service.
    
      - Start using obs-service-github_tarballs
    
      - Update to version 2012.2.3+git.1358434328.a41b913 :
    
      + Provide better error message for aggregate-create
    
      + Fix errors in used_limits extension
    
      + Add an iptables mangle rule per-bridge for DHCP.
    
      + Limit formatting routes when adding resources
    
      - Update 12.3 packages to Folsom as of March 5th. This
        comes with· security fixes and bug fixes that we
        need to have OpenStack work nicely. Fix bnc#802278.
    
      - Install polkit rules file in
        /usr/share/polkit-1/rules.d/ since it's not a
        configuration file, and use 10 instead of 50 as priority
        to make sure it is taken into account.
    
      - Update to version 2012.2.4+git.1362583574.da38af5 :
    
      + VNC Token Validation (CVE-2013-0335)
    
      - Update to version 2012.2.4+git.1362502642.8c4df00 :
    
      + Ensure we add a new line when appending to rc.local
    
      + Handle compute node not available for live migration
    
      + remove intermediate libvirt downloaded images
    
      - Add openstack-nova-polkit.rules: polkit rules for the
        new polkit that uses JavaScript. On openSUSE 12.3 and
        later, we install this file in /etc/polkit-1/rules.d/
        instead of installing the pkla file which is of no use
        with the new polkit.
    
      - Update to version 2012.2.4+git.1361527907.d5e7f55 :
    
      + Avoid stuck task_state on snapshot image failure
    
      + Add a safe_minidom_parse_string function.
        (CVE-2013-1664)
    
      + Enable libvirt to work with NoopFirewallDriver
    
      + Fix state sync logic related to the PAUSED VM state
    
      + libvirt: Fix nova-compute start when missing ip.
    
      - Update to version 2012.2.4+git.1360133953.e5d0f4b :
    
      + Final versioning for 2012.2.3
    
      + Bump version to 2012.2.4
    
      - Update to version 2012.2.3+git.1359529791.317cc0a :
    
      + remove session parameter from fixed_ip_get
    
      + Eliminate race conditions in floating association
    
      + Fix to include error message in instance faults
    
      + disallow boot from volume from specifying arbitrary
        volumes (CVE-2013-0208)
    
      - Update to version 2012.2.3+git.1359111576.03c3e9b :
    
      + Ensure that Quantum uses configured fixed IP
    
      + Makes sure compute doesn't crash on failed resume.
    
      - Update to version 2012.2.3+git.1358515929.3545a7d :
    
      + Add NFS to the libvirt volume driver list
    
      + Call plug_vifs() for all instances in init_host
    
      + Fix addition of CPU features when running against legacy
        libvirt
    
      + Fix typo in resource tracker audit message
    
      - Move back to 'git_tarballs' source service.
    
      - Start using obs-service-github_tarballs
    
      - Update to version 2012.2.3+git.1358434328.a41b913 :
    
      + Provide better error message for aggregate-create
    
      + Fix errors in used_limits extension
    
      + Add an iptables mangle rule per-bridge for DHCP.
    
      + Limit formatting routes when adding resources
    
    Changes in openstack-quantum :
    
      - Update 12.3 packages to Folsom as of March 5th. This
        comes with· security fixes and bug fixes that we
        need to have OpenStack work nicely. Fix bnc#802278.
    
      - Update to version 2012.2.4+git.1362583635.f94b149 :
    
      + L3 port delete prevention: do not raise if no IP on port
    
      - Update to version 2012.2.4+git.1362504084.06e42f8 :
    
      + Close file descriptors when executing sub-processes
    
      + Persist updated expiration time
    
      - Update to version 2012.2.4+git.1361527969.4de49b4 :
    
      + only destroy single namespace if router_id is set
    
      + Enable OVS and NETNS utilities to perform logging
    
      + Disable dhcp_domain distribution when dhcp_domain is
        empty
    
      + Shorten the DHCP default resync_interval
    
      - Update to version 2012.2.4+git.1360134016.d2a85e6 :
    
      + Final versioning for 2012.2.3
    
      + Bump version to 2012.2.4
    
      - Update to version 2012.2.3+git.1359529852.a84ba7e :
    
      + Regression caused by commit b56c2c998
    
      + LinuxBridge: update status according to admin_state_up
    
      + Ensure that correct root helper is used
    
    Changes in openstack-quickstart :
    
      - Update 12.3 packages to Folsom as of March 5th. This
        comes with· security fixes and bug fixes that we
        need to have OpenStack work nicely. Fix bnc#802278.
    
      - Update to latest git (cb0fbe8) :
    
      + Enalbe Cinder and Swift Service endpoints
    
      + Setup Cinder properly
    
      - Update to latest git (95d7088) :
    
      + Fill in values in the cinder/api-paste.ini templatae
    
    Changes in openstack-swift :
    
      - Update to version 1.7.4.1+git.1359529903.0ce3e1d :
    
      + Use pypi for python-swiftclient dependency.
    
      - Update 12.3 packages to Folsom as of March 5th. This
        comes with· security fixes and bug fixes that we
        need to have OpenStack work nicely. Fix bnc#802278.
    
      - Update to version 1.7.4.1+git.1359529903.0ce3e1d :
    
      + Use pypi for python-swiftclient dependency.
    
    Changes in python-cinderclient :
    
      - Update 12.3 packages to Folsom as of March 5th. This
        comes with· security fixes and bug fixes that we
        need to have OpenStack work nicely. Fix bnc#802278.
    
      - Add compat-newer-requests.patch: take patches from
        upstream to allow working with newer versions of
        python-requests.
    
    Changes in python-django_openstack_auth :
    
      - Update 12.3 packages to Folsom as of March 5th. This
        comes with· security fixes and bug fixes that we
        need to have OpenStack work nicely. Fix bnc#802278.
    
      - Update to version 1.0.6 :
    
      + Fix compatibility with keystoneclient v0.2.
    
      - Changes from version 1.0.5 :
    
      + Improves error handling; fixes failing test.
    
    Changes in python-keystoneclient :
    
      - Update 12.3 packages to Folsom as of March 5th. This
        comes with· security fixes and bug fixes that we
        need to have OpenStack work nicely. Fix bnc#802278.
    
      - Add compat-newer-requests.patch: take patches from
        upstream to allow working with newer versions of
        python-requests."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=802278"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=808622"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=808626"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected openstack packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-cinder");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-cinder-api");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-cinder-scheduler");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-cinder-test");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-cinder-volume");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-dashboard");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-dashboard-test");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-glance");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-glance-test");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-keystone");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-keystone-test");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova-api");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova-cert");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova-compute");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova-network");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova-novncproxy");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova-objectstore");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova-scheduler");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova-test");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova-vncproxy");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova-volume");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-quantum");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-quantum-test");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-quickstart");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-swift");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-swift-account");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-swift-container");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-swift-object");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-swift-proxy");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-swift-test");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-cinder");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-cinderclient");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-cinderclient-test");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-django_openstack_auth");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-glance");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-horizon");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-keystone");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-keystoneclient");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-keystoneclient-test");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-nova");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-quantum");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-swift");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:12.3");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2013/03/15");
      script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2014-2020 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE12\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "12.3", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE12.3", reference:"openstack-cinder-2012.2.4+git.1362502414.95a620b-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"openstack-cinder-api-2012.2.4+git.1362502414.95a620b-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"openstack-cinder-scheduler-2012.2.4+git.1362502414.95a620b-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"openstack-cinder-test-2012.2.4+git.1362502414.95a620b-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"openstack-cinder-volume-2012.2.4+git.1362502414.95a620b-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"openstack-dashboard-2012.2.4+git.1362503968.8ece3c7-2.5.2") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"openstack-dashboard-test-2012.2.4+git.1362503968.8ece3c7-2.5.2") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"openstack-glance-2012.2.4+git.1363297737.dd849a9-2.6.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"openstack-glance-test-2012.2.4+git.1363297737.dd849a9-2.6.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"openstack-keystone-2012.2.4+git.1362502288.8690166-3.4.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"openstack-keystone-test-2012.2.4+git.1362502288.8690166-3.4.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-api-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-cert-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-compute-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-network-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-novncproxy-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-objectstore-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-scheduler-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-test-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-vncproxy-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-volume-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"openstack-quantum-2012.2.4+git.1362583635.f94b149-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"openstack-quantum-test-2012.2.4+git.1362583635.f94b149-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"openstack-quickstart-2012.2+git.1360262230.cb0fbe8-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"openstack-swift-1.7.4.1+git.1359529903.0ce3e1d-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"openstack-swift-account-1.7.4.1+git.1359529903.0ce3e1d-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"openstack-swift-container-1.7.4.1+git.1359529903.0ce3e1d-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"openstack-swift-object-1.7.4.1+git.1359529903.0ce3e1d-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"openstack-swift-proxy-1.7.4.1+git.1359529903.0ce3e1d-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"openstack-swift-test-1.7.4.1+git.1359529903.0ce3e1d-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"python-cinder-2012.2.4+git.1362502414.95a620b-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"python-cinderclient-1.0.1.5.g82e47d0+git.1355912775.82e47d0-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"python-cinderclient-test-1.0.1.5.g82e47d0+git.1355912775.82e47d0-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"python-django_openstack_auth-1.0.6-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"python-glance-2012.2.4+git.1363297737.dd849a9-2.6.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"python-horizon-2012.2.4+git.1362503968.8ece3c7-2.5.2") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"python-keystone-2012.2.4+git.1362502288.8690166-3.4.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"python-keystoneclient-0.2.1.3.gd37a3fb+git.1357543650.d37a3fb-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"python-keystoneclient-test-0.2.1.3.gd37a3fb+git.1357543650.d37a3fb-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"python-nova-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"python-quantum-2012.2.4+git.1362583635.f94b149-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"python-swift-1.7.4.1+git.1359529903.0ce3e1d-2.4.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "openstack");
    }
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2013-2916.NASL
    descriptionsecurity updates: - ensure user and tenant are enabled CVE-2013-0282 - disable XML entity parsing CVE-2013-1664, CVE-2013-1665 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2013-03-05
    plugin id64997
    published2013-03-05
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/64997
    titleFedora 18 : openstack-keystone-2012.2.3-3.fc18 (2013-2916)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory 2013-2916.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(64997);
      script_version("1.12");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");
    
      script_cve_id("CVE-2013-0282", "CVE-2013-1664", "CVE-2013-1665");
      script_bugtraq_id(58022, 58033);
      script_xref(name:"FEDORA", value:"2013-2916");
    
      script_name(english:"Fedora 18 : openstack-keystone-2012.2.3-3.fc18 (2013-2916)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "security updates: - ensure user and tenant are enabled CVE-2013-0282 -
    disable XML entity parsing CVE-2013-1664, CVE-2013-1665
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=910221"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=910928"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2013-March/099648.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?9fe96274"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected openstack-keystone package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:openstack-keystone");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:18");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2013/02/24");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/03/05");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! ereg(pattern:"^18([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 18.x", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    flag = 0;
    if (rpm_check(release:"FC18", reference:"openstack-keystone-2012.2.3-3.fc18")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "openstack-keystone");
    }
    
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-1730-1.NASL
    descriptionNathanael Burton discovered that Keystone did not properly verify disabled users. An authenticated but disabled user would continue to have access rights that were removed. (CVE-2013-0282) Jonathan Murray discovered that Keystone would allow XML entity processing. A remote unauthenticated attacker could exploit this to cause a denial of service via resource exhaustion. Authenticated users could also use this to view arbitrary files on the Keystone server. (CVE-2013-1664, CVE-2013-1665). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id64782
    published2013-02-21
    reporterUbuntu Security Notice (C) 2013-2019 Canonical, Inc. / NASL script (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/64782
    titleUbuntu 12.04 LTS / 12.10 : keystone vulnerabilities (USN-1730-1)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Ubuntu Security Notice USN-1730-1. The text 
    # itself is copyright (C) Canonical, Inc. See 
    # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
    # trademark of Canonical, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(64782);
      script_version("1.11");
      script_cvs_date("Date: 2019/09/19 12:54:28");
    
      script_cve_id("CVE-2013-0282", "CVE-2013-1664", "CVE-2013-1665");
      script_xref(name:"USN", value:"1730-1");
    
      script_name(english:"Ubuntu 12.04 LTS / 12.10 : keystone vulnerabilities (USN-1730-1)");
      script_summary(english:"Checks dpkg output for updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Ubuntu host is missing a security-related patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Nathanael Burton discovered that Keystone did not properly verify
    disabled users. An authenticated but disabled user would continue to
    have access rights that were removed. (CVE-2013-0282)
    
    Jonathan Murray discovered that Keystone would allow XML entity
    processing. A remote unauthenticated attacker could exploit this to
    cause a denial of service via resource exhaustion. Authenticated users
    could also use this to view arbitrary files on the Keystone server.
    (CVE-2013-1664, CVE-2013-1665).
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Ubuntu security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://usn.ubuntu.com/1730-1/"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected python-keystone package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:python-keystone");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:12.04:-:lts");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:12.10");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2013/04/02");
      script_set_attribute(attribute:"patch_publication_date", value:"2013/02/20");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/02/21");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"Ubuntu Security Notice (C) 2013-2019 Canonical, Inc. / NASL script (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Ubuntu Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("ubuntu.inc");
    include("misc_func.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/Ubuntu/release");
    if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
    release = chomp(release);
    if (! preg(pattern:"^(12\.04|12\.10)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 12.04 / 12.10", "Ubuntu " + release);
    if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);
    
    flag = 0;
    
    if (ubuntu_check(osver:"12.04", pkgname:"python-keystone", pkgver:"2012.1+stable~20120824-a16a0ab9-0ubuntu2.5")) flag++;
    if (ubuntu_check(osver:"12.10", pkgname:"python-keystone", pkgver:"2012.2.1-0ubuntu1.2")) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : ubuntu_report_get()
      );
      exit(0);
    }
    else
    {
      tested = ubuntu_pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python-keystone");
    }
    

Redhat

rpms
  • openstack-keystone-0:2012.2.3-3.el6ost
  • openstack-keystone-doc-0:2012.2.3-3.el6ost
  • python-keystone-0:2012.2.3-3.el6ost

Seebug

bulletinFamilyexploit
descriptionCVE ID:CVE-2013-0282 OpenStack Keystone为OpenStack系列计划提供身份、令牌、目录和策略服务的项目。 在使用EC2-Style验证时OpenStack Keystone Grizzly,Folsom, Essex没有正确检查用户,租户或域是否启用,允许远程攻击者利用漏洞绕过访问限制。 仅设置了启用EC2-Style验证的系统受此漏洞影响。 0 OpenStack Keystone Grizzly 2013.1之前版本 OpenStack Keystone Folsom 2012.1.3之前版本 OpenStack Keystone Essex 厂商解决方案 用户可参考如下厂商提供的补丁以修复此漏洞: Grizzly (development branch) fix: https://review.openstack.org/#/c/22319/ Folsom fix: https://review.openstack.org/#/c/22320/ Essex fix: https://review.openstack.org/#/c/22321/
idSSV:60742
last seen2017-11-19
modified2013-04-16
published2013-04-16
reporterRoot
titleOpenStack Keystone 验证绕过漏洞(CVE-2013-0282)