Vulnerabilities > CVE-2013-1664 - Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Openstack products
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
PARTIAL Summary
The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.
Vulnerable Configurations
Part | Description | Count |
---|---|---|
Application | 6 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Buffer Overflow via Environment Variables This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
- Overflow Buffers Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
- Client-side Injection-induced Buffer Overflow This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
- Filter Failure through Buffer Overflow In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
- MIME Conversion An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.
Nessus
NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-1731-1.NASL description Stuart Stent discovered that Cinder would allow XML entity processing. A remote unauthenticated attacker could exploit this using the Cinder API to cause a denial of service via resource exhaustion. (CVE-2013-1664). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 64783 published 2013-02-21 reporter Ubuntu Security Notice (C) 2013-2019 Canonical, Inc. / NASL script (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/64783 title Ubuntu 12.10 : cinder vulnerability (USN-1731-1) code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Ubuntu Security Notice USN-1731-1. The text # itself is copyright (C) Canonical, Inc. See # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered # trademark of Canonical, Inc. # include("compat.inc"); if (description) { script_id(64783); script_version("1.7"); script_cvs_date("Date: 2019/09/19 12:54:28"); script_cve_id("CVE-2013-1664"); script_xref(name:"USN", value:"1731-1"); script_name(english:"Ubuntu 12.10 : cinder vulnerability (USN-1731-1)"); script_summary(english:"Checks dpkg output for updated package."); script_set_attribute( attribute:"synopsis", value:"The remote Ubuntu host is missing a security-related patch." ); script_set_attribute( attribute:"description", value: "Stuart Stent discovered that Cinder would allow XML entity processing. A remote unauthenticated attacker could exploit this using the Cinder API to cause a denial of service via resource exhaustion. (CVE-2013-1664). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://usn.ubuntu.com/1731-1/" ); script_set_attribute( attribute:"solution", value:"Update the affected python-cinder package." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:python-cinder"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:12.10"); script_set_attribute(attribute:"vuln_publication_date", value:"2013/04/02"); script_set_attribute(attribute:"patch_publication_date", value:"2013/02/20"); script_set_attribute(attribute:"plugin_publication_date", value:"2013/02/21"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"Ubuntu Security Notice (C) 2013-2019 Canonical, Inc. / NASL script (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Ubuntu Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("ubuntu.inc"); include("misc_func.inc"); if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/Ubuntu/release"); if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu"); release = chomp(release); if (! preg(pattern:"^(12\.10)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 12.10", "Ubuntu " + release); if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu); flag = 0; if (ubuntu_check(osver:"12.10", pkgname:"python-cinder", pkgver:"2012.2.1-0ubuntu1.1")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : ubuntu_report_get() ); exit(0); } else { tested = ubuntu_pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python-cinder"); }
NASL family SuSE Local Security Checks NASL id OPENSUSE-2013-237.NASL description The Openstack Stack components were updated to Folsom level as of March 5th. Changes in openstack-cinder : - Update 12.3 packages to Folsom as of March 5th. This comes with security fixes and bug fixes that we need to have OpenStack work nicely. Fix bnc#802278. - Update cinder-config-update.diff: update etc/cinder/api-paste.ini to have a signing_dir key under [filter:authtoken]. Otherwise, cinder-api won last seen 2020-06-05 modified 2014-06-13 plugin id 74936 published 2014-06-13 reporter This script is Copyright (C) 2014-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/74936 title openSUSE Security Update : openstack (openSUSE-2013-237) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update openSUSE-2013-237. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(74936); script_version("1.2"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04"); script_cve_id("CVE-2013-0208", "CVE-2013-0212", "CVE-2013-0247", "CVE-2013-0282", "CVE-2013-0335", "CVE-2013-1664", "CVE-2013-1665", "CVE-2013-1838", "CVE-2013-1840"); script_name(english:"openSUSE Security Update : openstack (openSUSE-2013-237)"); script_summary(english:"Check for the openSUSE-2013-237 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "The Openstack Stack components were updated to Folsom level as of March 5th. Changes in openstack-cinder : - Update 12.3 packages to Folsom as of March 5th. This comes with security fixes and bug fixes that we need to have OpenStack work nicely. Fix bnc#802278. - Update cinder-config-update.diff: update etc/cinder/api-paste.ini to have a signing_dir key under [filter:authtoken]. Otherwise, cinder-api won't start. This was done with commit de289a6 in Grizzly. - Update to version 2012.2.4+git.1362502414.95a620b : + Check for non-default volume name template. + Fix error for extra specs update with empty body. - Update to version 2012.2.4+git.1361527687.68de70d : + Add a safe_minidom_parse_string function. (CVE-2013-1664) - Set auth_strategy to keystone for a good out-of-the-box experience - Add cinder-config-update.diff: move configuration changes to a patch, instead of using sed. - Update to version 2012.2.4+git.1360133755.a8caa79 : + Final versioning for 2012.2.3 + Bump version to 2012.2.4 + Fix typo in cinder/db/api.py - Update to version 2012.2.3+git.1358429029.cdf6c13 : + Add commands used by NFS volume driver to rootwrap Changes in openstack-dashboard : - Update 12.3 packages to Folsom as of March 5th. This comes with security fixes and bug fixes that we need to have OpenStack work nicely. Fix bnc#802278. - Backport packaging changes we did for Grizzly to fix theming : + define a production %bcond_with that will determine whether offline compression is used or not. + if not using the production feature, have a nodejs Requires. + move compression steps to %prep. + by default, use the non-production mode for greater flexibility. - Do not use 'SUSE Cloud' as site branding: this is not SUSE Cloud. - Update to version 2012.2.4+git.1362503968.8ece3c7 : + pin django to 1.4.x stream - Update to version 2012.2.4+git.1361527741.0a42fa0 : + Prevent the user from creating a single IP address sized network + Add UTC offset information to the timezone - Update to version 2012.2.4+git.1360133827.f421145 : + Final versioning for 2012.2.3 + Bump version to 2012.2.4 - Update to version 2012.2.2+git.1359111868.20fa0fc : + Pin docutils to 0.9.1, fix pep8 errors + Fix bug 1055929 - Can not display usage data for Quota Summary. + Revert 'Temp fix for api/keystone.py' + Specify floating ips table action column's width + Allow setting nova quotas to unlimited + Add a check for unlimited quotas + Avoid cinder calls, when cinder is unavailable + Don't inherit from base.html in 500 error page + Don't show the EC2 Credentials panel if there is no EC2 service - Drop horizon-ssl.patch: merged upstream. Changes in openstack-glance : - Do not return location in headers (CVE-2013-1840) - This fixes bnc#808626. - Update 12.3 packages to Folsom as of March 5th. This comes with· security fixes and bug fixes that we need to have OpenStack work nicely. Fix bnc#802278. - Update to version 2012.2.4+git.1362583521.1fb759d : + Swallow UserWarning from glance-cache-manage + Avoid dangling partial image on size/checksum mismatch - Update to version 2012.2.4+git.1362503824.afe6166 : + Fix broken JSON schemas in v2 tests + Prints list-cached dates in isoformat - Update to version 2012.2.4+git.1360133885.98d9928 : + Bump version to 2012.2.4 - Update to version 2012.2.3+git.1359529730.a5b0f4e : + Change useexisting to extend_existing to fix deprecation warnings. + Remove Swift location/password from messages. (CVE-2013-0212) Changes in openstack-keystone : - Update 12.3 packages to Folsom as of March 5th. This comes with· security fixes and bug fixes that we need to have OpenStack work nicely. Fix bnc#802278. - fix logging.conf to be about keystone and have absolute path - Update to version 2012.2.4+git.1362502288.8690166 : + Sync timeutils to pick up normalize fix. + Backport of fix for 24-hour failure of pki. - Update to version 2012.2.4+git.1361527873.37b3532 : + Disable XML entity parsing (CVE-2013-1664, CVE-2013-1665) + Ensure user and tenant enabled in EC2 (CVE-2013-0282) - Update to version 2012.2.4+git.1360133921.82c87e5 : + Bump version to 2012.2.4 + Add size validations for /tokens. (CVE-2013-0247) - Update to version 2012.2.3+git.1359550485.ec7b94d : + Test 0.2.0 keystoneclient to avoid new deps + Unparseable endpoint URL's should raise friendly error + Fix catalog when services have no URL + Render content-type appropriate 404 (bug 1089987) - fix last commit's hash tag in Version Changes in openstack-nova : - Add quotas for fixed ips. (CVE-2013-1838) - Update to version 2012.2.3+git.1358515929.3545a7d : + Add NFS to the libvirt volume driver list + Call plug_vifs() for all instances in init_host + Fix addition of CPU features when running against legacy libvirt + Fix typo in resource tracker audit message - Move back to 'git_tarballs' source service. - Start using obs-service-github_tarballs - Update to version 2012.2.3+git.1358434328.a41b913 : + Provide better error message for aggregate-create + Fix errors in used_limits extension + Add an iptables mangle rule per-bridge for DHCP. + Limit formatting routes when adding resources - Update 12.3 packages to Folsom as of March 5th. This comes with· security fixes and bug fixes that we need to have OpenStack work nicely. Fix bnc#802278. - Install polkit rules file in /usr/share/polkit-1/rules.d/ since it's not a configuration file, and use 10 instead of 50 as priority to make sure it is taken into account. - Update to version 2012.2.4+git.1362583574.da38af5 : + VNC Token Validation (CVE-2013-0335) - Update to version 2012.2.4+git.1362502642.8c4df00 : + Ensure we add a new line when appending to rc.local + Handle compute node not available for live migration + remove intermediate libvirt downloaded images - Add openstack-nova-polkit.rules: polkit rules for the new polkit that uses JavaScript. On openSUSE 12.3 and later, we install this file in /etc/polkit-1/rules.d/ instead of installing the pkla file which is of no use with the new polkit. - Update to version 2012.2.4+git.1361527907.d5e7f55 : + Avoid stuck task_state on snapshot image failure + Add a safe_minidom_parse_string function. (CVE-2013-1664) + Enable libvirt to work with NoopFirewallDriver + Fix state sync logic related to the PAUSED VM state + libvirt: Fix nova-compute start when missing ip. - Update to version 2012.2.4+git.1360133953.e5d0f4b : + Final versioning for 2012.2.3 + Bump version to 2012.2.4 - Update to version 2012.2.3+git.1359529791.317cc0a : + remove session parameter from fixed_ip_get + Eliminate race conditions in floating association + Fix to include error message in instance faults + disallow boot from volume from specifying arbitrary volumes (CVE-2013-0208) - Update to version 2012.2.3+git.1359111576.03c3e9b : + Ensure that Quantum uses configured fixed IP + Makes sure compute doesn't crash on failed resume. - Update to version 2012.2.3+git.1358515929.3545a7d : + Add NFS to the libvirt volume driver list + Call plug_vifs() for all instances in init_host + Fix addition of CPU features when running against legacy libvirt + Fix typo in resource tracker audit message - Move back to 'git_tarballs' source service. - Start using obs-service-github_tarballs - Update to version 2012.2.3+git.1358434328.a41b913 : + Provide better error message for aggregate-create + Fix errors in used_limits extension + Add an iptables mangle rule per-bridge for DHCP. + Limit formatting routes when adding resources Changes in openstack-quantum : - Update 12.3 packages to Folsom as of March 5th. This comes with· security fixes and bug fixes that we need to have OpenStack work nicely. Fix bnc#802278. - Update to version 2012.2.4+git.1362583635.f94b149 : + L3 port delete prevention: do not raise if no IP on port - Update to version 2012.2.4+git.1362504084.06e42f8 : + Close file descriptors when executing sub-processes + Persist updated expiration time - Update to version 2012.2.4+git.1361527969.4de49b4 : + only destroy single namespace if router_id is set + Enable OVS and NETNS utilities to perform logging + Disable dhcp_domain distribution when dhcp_domain is empty + Shorten the DHCP default resync_interval - Update to version 2012.2.4+git.1360134016.d2a85e6 : + Final versioning for 2012.2.3 + Bump version to 2012.2.4 - Update to version 2012.2.3+git.1359529852.a84ba7e : + Regression caused by commit b56c2c998 + LinuxBridge: update status according to admin_state_up + Ensure that correct root helper is used Changes in openstack-quickstart : - Update 12.3 packages to Folsom as of March 5th. This comes with· security fixes and bug fixes that we need to have OpenStack work nicely. Fix bnc#802278. - Update to latest git (cb0fbe8) : + Enalbe Cinder and Swift Service endpoints + Setup Cinder properly - Update to latest git (95d7088) : + Fill in values in the cinder/api-paste.ini templatae Changes in openstack-swift : - Update to version 1.7.4.1+git.1359529903.0ce3e1d : + Use pypi for python-swiftclient dependency. - Update 12.3 packages to Folsom as of March 5th. This comes with· security fixes and bug fixes that we need to have OpenStack work nicely. Fix bnc#802278. - Update to version 1.7.4.1+git.1359529903.0ce3e1d : + Use pypi for python-swiftclient dependency. Changes in python-cinderclient : - Update 12.3 packages to Folsom as of March 5th. This comes with· security fixes and bug fixes that we need to have OpenStack work nicely. Fix bnc#802278. - Add compat-newer-requests.patch: take patches from upstream to allow working with newer versions of python-requests. Changes in python-django_openstack_auth : - Update 12.3 packages to Folsom as of March 5th. This comes with· security fixes and bug fixes that we need to have OpenStack work nicely. Fix bnc#802278. - Update to version 1.0.6 : + Fix compatibility with keystoneclient v0.2. - Changes from version 1.0.5 : + Improves error handling; fixes failing test. Changes in python-keystoneclient : - Update 12.3 packages to Folsom as of March 5th. This comes with· security fixes and bug fixes that we need to have OpenStack work nicely. Fix bnc#802278. - Add compat-newer-requests.patch: take patches from upstream to allow working with newer versions of python-requests." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=802278" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=808622" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=808626" ); script_set_attribute( attribute:"solution", value:"Update the affected openstack packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-cinder"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-cinder-api"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-cinder-scheduler"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-cinder-test"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-cinder-volume"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-dashboard"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-dashboard-test"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-glance"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-glance-test"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-keystone"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-keystone-test"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova-api"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova-cert"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova-compute"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova-network"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova-novncproxy"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova-objectstore"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova-scheduler"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova-test"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova-vncproxy"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova-volume"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-quantum"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-quantum-test"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-quickstart"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-swift"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-swift-account"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-swift-container"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-swift-object"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-swift-proxy"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-swift-test"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-cinder"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-cinderclient"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-cinderclient-test"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-django_openstack_auth"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-glance"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-horizon"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-keystone"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-keystoneclient"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-keystoneclient-test"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-nova"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-quantum"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-swift"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:12.3"); script_set_attribute(attribute:"patch_publication_date", value:"2013/03/15"); script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2014-2020 Tenable Network Security, Inc."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE12\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "12.3", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if ( rpm_check(release:"SUSE12.3", reference:"openstack-cinder-2012.2.4+git.1362502414.95a620b-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"openstack-cinder-api-2012.2.4+git.1362502414.95a620b-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"openstack-cinder-scheduler-2012.2.4+git.1362502414.95a620b-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"openstack-cinder-test-2012.2.4+git.1362502414.95a620b-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"openstack-cinder-volume-2012.2.4+git.1362502414.95a620b-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"openstack-dashboard-2012.2.4+git.1362503968.8ece3c7-2.5.2") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"openstack-dashboard-test-2012.2.4+git.1362503968.8ece3c7-2.5.2") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"openstack-glance-2012.2.4+git.1363297737.dd849a9-2.6.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"openstack-glance-test-2012.2.4+git.1363297737.dd849a9-2.6.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"openstack-keystone-2012.2.4+git.1362502288.8690166-3.4.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"openstack-keystone-test-2012.2.4+git.1362502288.8690166-3.4.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-api-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-cert-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-compute-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-network-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-novncproxy-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-objectstore-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-scheduler-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-test-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-vncproxy-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-volume-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"openstack-quantum-2012.2.4+git.1362583635.f94b149-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"openstack-quantum-test-2012.2.4+git.1362583635.f94b149-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"openstack-quickstart-2012.2+git.1360262230.cb0fbe8-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"openstack-swift-1.7.4.1+git.1359529903.0ce3e1d-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"openstack-swift-account-1.7.4.1+git.1359529903.0ce3e1d-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"openstack-swift-container-1.7.4.1+git.1359529903.0ce3e1d-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"openstack-swift-object-1.7.4.1+git.1359529903.0ce3e1d-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"openstack-swift-proxy-1.7.4.1+git.1359529903.0ce3e1d-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"openstack-swift-test-1.7.4.1+git.1359529903.0ce3e1d-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"python-cinder-2012.2.4+git.1362502414.95a620b-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"python-cinderclient-1.0.1.5.g82e47d0+git.1355912775.82e47d0-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"python-cinderclient-test-1.0.1.5.g82e47d0+git.1355912775.82e47d0-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"python-django_openstack_auth-1.0.6-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"python-glance-2012.2.4+git.1363297737.dd849a9-2.6.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"python-horizon-2012.2.4+git.1362503968.8ece3c7-2.5.2") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"python-keystone-2012.2.4+git.1362502288.8690166-3.4.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"python-keystoneclient-0.2.1.3.gd37a3fb+git.1357543650.d37a3fb-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"python-keystoneclient-test-0.2.1.3.gd37a3fb+git.1357543650.d37a3fb-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"python-nova-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"python-quantum-2012.2.4+git.1362583635.f94b149-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"python-swift-1.7.4.1+git.1359529903.0ce3e1d-2.4.1") ) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "openstack"); }
NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-1734-1.NASL description Joshua Harlow discovered that Nova would allow XML entity processing. A remote unauthenticated attacker could exploit this using the Nova API to cause a denial of service via resource exhaustion. (CVE-2013-1664). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 64800 published 2013-02-22 reporter Ubuntu Security Notice (C) 2013-2019 Canonical, Inc. / NASL script (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/64800 title Ubuntu 11.10 / 12.04 LTS / 12.10 : nova vulnerability (USN-1734-1) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_21C59F5E7CC511E29C11080027A5EC9A.NASL description The Django Project reports : These security releases fix four issues: one potential phishing vector, one denial-of-service vector, an information leakage issue, and a range of XML vulnerabilities. - Host header poisoning an attacker could cause Django to generate and display URLs that link to arbitrary domains. This could be used as part of a phishing attack. These releases fix this problem by introducing a new setting, ALLOWED_HOSTS, which specifies a whitelist of domains your site is known to respond to. Important: by default Django 1.3.6 and 1.4.4 set ALLOWED_HOSTS to allow all hosts. This means that to actually fix the security vulnerability you should define this setting yourself immediately after upgrading. - Formset denial-of-service an attacker can abuse Django last seen 2020-06-01 modified 2020-06-02 plugin id 64873 published 2013-02-25 reporter This script is Copyright (C) 2013-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/64873 title FreeBSD : django -- multiple vulnerabilities (21c59f5e-7cc5-11e2-9c11-080027a5ec9a) NASL family Fedora Local Security Checks NASL id FEDORA_2013-2916.NASL description security updates: - ensure user and tenant are enabled CVE-2013-0282 - disable XML entity parsing CVE-2013-1664, CVE-2013-1665 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2013-03-05 plugin id 64997 published 2013-03-05 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/64997 title Fedora 18 : openstack-keystone-2012.2.3-3.fc18 (2013-2916) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201412-11.NASL description The remote host is affected by the vulnerability described in GLSA-201412-11 (AMD64 x86 emulation base libraries: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in AMD64 x86 emulation base libraries. Please review the CVE identifiers referenced below for details. Impact : A context-dependent attacker may be able to execute arbitrary code, cause a Denial of Service condition, or obtain sensitive information. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 79964 published 2014-12-15 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/79964 title GLSA-201412-11 : AMD64 x86 emulation base libraries: Multiple vulnerabilities (Heartbleed) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-1730-1.NASL description Nathanael Burton discovered that Keystone did not properly verify disabled users. An authenticated but disabled user would continue to have access rights that were removed. (CVE-2013-0282) Jonathan Murray discovered that Keystone would allow XML entity processing. A remote unauthenticated attacker could exploit this to cause a denial of service via resource exhaustion. Authenticated users could also use this to view arbitrary files on the Keystone server. (CVE-2013-1664, CVE-2013-1665). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 64782 published 2013-02-21 reporter Ubuntu Security Notice (C) 2013-2019 Canonical, Inc. / NASL script (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/64782 title Ubuntu 12.04 LTS / 12.10 : keystone vulnerabilities (USN-1730-1) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201311-06.NASL description The remote host is affected by the vulnerability described in GLSA-201311-06 (libxml2: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in libxml2. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to open a specially crafted document with an application linked against libxml2, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 70836 published 2013-11-11 reporter This script is Copyright (C) 2013-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/70836 title GLSA-201311-06 : libxml2: Multiple vulnerabilities NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-1757-1.NASL description James Kettle discovered that Django did not properly filter the Host HTTP header when processing certain requests. An attacker could exploit this to generate and display arbitrary URLs to users. Although this issue had been previously addressed in USN-1632-1, this update adds additional hardening measures to host header validation. This update also adds a new ALLOWED_HOSTS setting that can be set to a list of acceptable values for headers. (CVE-2012-4520) Orange Tsai discovered that Django incorrectly performed permission checks when displaying the history view in the admin interface. An administrator could use this flaw to view the history of any object, regardless of intended permissions. (CVE-2013-0305) It was discovered that Django incorrectly handled a large number of forms when generating formsets. An attacker could use this flaw to cause Django to consume memory, resulting in a denial of service. (CVE-2013-0306) It was discovered that Django incorrectly deserialized XML. An attacker could use this flaw to perform entity-expansion and external-entity/DTD attacks. This updated modified Django behaviour to no longer allow DTDs, perform entity expansion, or fetch external entities/DTDs. (CVE-2013-1664, CVE-2013-1665). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 65096 published 2013-03-08 reporter Ubuntu Security Notice (C) 2013-2019 Canonical, Inc. / NASL script (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/65096 title Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : python-django vulnerabilities (USN-1757-1)
Redhat
advisories |
| ||||||||||||
rpms |
|
References
- http://blog.python.org/2013/02/announcing-defusedxml-fixes-for-xml.html
- http://bugs.python.org/issue17239
- http://lists.openstack.org/pipermail/openstack-announce/2013-February/000078.html
- http://rhn.redhat.com/errata/RHSA-2013-0657.html
- http://rhn.redhat.com/errata/RHSA-2013-0658.html
- http://rhn.redhat.com/errata/RHSA-2013-0670.html
- http://ubuntu.com/usn/usn-1757-1
- http://www.openwall.com/lists/oss-security/2013/02/19/2
- http://www.openwall.com/lists/oss-security/2013/02/19/4
- https://bugs.launchpad.net/nova/+bug/1100282