Vulnerabilities > CVE-2015-3280 - Resource Management Errors vulnerability in Openstack Nova

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN

Summary

OpenStack Compute (nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) does not properly delete instances from compute nodes, which allows remote authenticated users to cause a denial of service (disk consumption) by deleting instances while in the resize state.

Common Weakness Enumeration (CWE)

Nessus

NASL familyUbuntu Local Security Checks
NASL idUBUNTU_USN-3449-1.NASL
descriptionGeorge Shuklin discovered that OpenStack Nova incorrectly handled the migration process. A remote authenticated user could use this issue to consume resources, resulting in a denial of service. (CVE-2015-3241) George Shuklin and Tushar Patil discovered that OpenStack Nova incorrectly handled deleting instances. A remote authenticated user could use this issue to consume disk resources, resulting in a denial of service. (CVE-2015-3280) It was discovered that OpenStack Nova incorrectly limited qemu-img calls. A remote authenticated user could use this issue to consume resources, resulting in a denial of service. (CVE-2015-5162) Matthew Booth discovered that OpenStack Nova incorrectly handled snapshots. A remote authenticated user could use this issue to read arbitrary files. (CVE-2015-7548) Sreekumar S. and Suntao discovered that OpenStack Nova incorrectly applied security group changes. A remote attacker could possibly use this issue to bypass intended restriction changes by leveraging an instance that was running when the change was made. (CVE-2015-7713) Matt Riedemann discovered that OpenStack Nova incorrectly handled logging. A local attacker could possibly use this issue to obtain sensitive information from log files. (CVE-2015-8749) Matthew Booth discovered that OpenStack Nova incorrectly handled certain qcow2 headers. A remote authenticated user could possibly use this issue to read arbitrary files. (CVE-2016-2140). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen2020-06-01
modified2020-06-02
plugin id103812
published2017-10-12
reporterUbuntu Security Notice (C) 2017-2019 Canonical, Inc. / NASL script (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/103812
titleUbuntu 14.04 LTS : nova vulnerabilities (USN-3449-1)
code
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Ubuntu Security Notice USN-3449-1. The text 
# itself is copyright (C) Canonical, Inc. See 
# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
# trademark of Canonical, Inc.
#

include("compat.inc");

if (description)
{
  script_id(103812);
  script_version("3.6");
  script_cvs_date("Date: 2019/09/18 12:31:47");

  script_cve_id("CVE-2015-3241", "CVE-2015-3280", "CVE-2015-5162", "CVE-2015-7548", "CVE-2015-7713", "CVE-2015-8749", "CVE-2016-2140");
  script_xref(name:"USN", value:"3449-1");

  script_name(english:"Ubuntu 14.04 LTS : nova vulnerabilities (USN-3449-1)");
  script_summary(english:"Checks dpkg output for updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Ubuntu host is missing a security-related patch."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"George Shuklin discovered that OpenStack Nova incorrectly handled the
migration process. A remote authenticated user could use this issue to
consume resources, resulting in a denial of service. (CVE-2015-3241)

George Shuklin and Tushar Patil discovered that OpenStack Nova
incorrectly handled deleting instances. A remote authenticated user
could use this issue to consume disk resources, resulting in a denial
of service. (CVE-2015-3280)

It was discovered that OpenStack Nova incorrectly limited qemu-img
calls. A remote authenticated user could use this issue to consume
resources, resulting in a denial of service. (CVE-2015-5162)

Matthew Booth discovered that OpenStack Nova incorrectly handled
snapshots. A remote authenticated user could use this issue to read
arbitrary files. (CVE-2015-7548)

Sreekumar S. and Suntao discovered that OpenStack Nova incorrectly
applied security group changes. A remote attacker could possibly use
this issue to bypass intended restriction changes by leveraging an
instance that was running when the change was made. (CVE-2015-7713)

Matt Riedemann discovered that OpenStack Nova incorrectly handled
logging. A local attacker could possibly use this issue to obtain
sensitive information from log files. (CVE-2015-8749)

Matthew Booth discovered that OpenStack Nova incorrectly handled
certain qcow2 headers. A remote authenticated user could possibly use
this issue to read arbitrary files. (CVE-2016-2140).

Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://usn.ubuntu.com/3449-1/"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected python-nova package."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:python-nova");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:14.04");

  script_set_attribute(attribute:"vuln_publication_date", value:"2015/09/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/10/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/10/12");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"Ubuntu Security Notice (C) 2017-2019 Canonical, Inc. / NASL script (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Ubuntu Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("ubuntu.inc");
include("misc_func.inc");

if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/Ubuntu/release");
if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
release = chomp(release);
if (! preg(pattern:"^(14\.04)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 14.04", "Ubuntu " + release);
if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);

flag = 0;

if (ubuntu_check(osver:"14.04", pkgname:"python-nova", pkgver:"1:2014.1.5-0ubuntu1.7")) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : ubuntu_report_get()
  );
  exit(0);
}
else
{
  tested = ubuntu_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python-nova");
}

Redhat

advisories
rhsa
idRHSA-2015:1898
rpms
  • openstack-nova-0:2014.1.5-3.el6ost
  • openstack-nova-0:2014.1.5-5.el7ost
  • openstack-nova-0:2014.2.3-31.el7ost
  • openstack-nova-0:2015.1.1-3.el7ost
  • openstack-nova-api-0:2014.1.5-3.el6ost
  • openstack-nova-api-0:2014.1.5-5.el7ost
  • openstack-nova-api-0:2014.2.3-31.el7ost
  • openstack-nova-api-0:2015.1.1-3.el7ost
  • openstack-nova-cells-0:2014.1.5-3.el6ost
  • openstack-nova-cells-0:2014.1.5-5.el7ost
  • openstack-nova-cells-0:2014.2.3-31.el7ost
  • openstack-nova-cells-0:2015.1.1-3.el7ost
  • openstack-nova-cert-0:2014.1.5-3.el6ost
  • openstack-nova-cert-0:2014.1.5-5.el7ost
  • openstack-nova-cert-0:2014.2.3-31.el7ost
  • openstack-nova-cert-0:2015.1.1-3.el7ost
  • openstack-nova-common-0:2014.1.5-3.el6ost
  • openstack-nova-common-0:2014.1.5-5.el7ost
  • openstack-nova-common-0:2014.2.3-31.el7ost
  • openstack-nova-common-0:2015.1.1-3.el7ost
  • openstack-nova-compute-0:2014.1.5-3.el6ost
  • openstack-nova-compute-0:2014.1.5-5.el7ost
  • openstack-nova-compute-0:2014.2.3-31.el7ost
  • openstack-nova-compute-0:2015.1.1-3.el7ost
  • openstack-nova-conductor-0:2014.1.5-3.el6ost
  • openstack-nova-conductor-0:2014.1.5-5.el7ost
  • openstack-nova-conductor-0:2014.2.3-31.el7ost
  • openstack-nova-conductor-0:2015.1.1-3.el7ost
  • openstack-nova-console-0:2014.1.5-3.el6ost
  • openstack-nova-console-0:2014.1.5-5.el7ost
  • openstack-nova-console-0:2014.2.3-31.el7ost
  • openstack-nova-console-0:2015.1.1-3.el7ost
  • openstack-nova-doc-0:2014.1.5-3.el6ost
  • openstack-nova-doc-0:2014.1.5-5.el7ost
  • openstack-nova-doc-0:2014.2.3-31.el7ost
  • openstack-nova-doc-0:2015.1.1-3.el7ost
  • openstack-nova-network-0:2014.1.5-3.el6ost
  • openstack-nova-network-0:2014.1.5-5.el7ost
  • openstack-nova-network-0:2014.2.3-31.el7ost
  • openstack-nova-network-0:2015.1.1-3.el7ost
  • openstack-nova-novncproxy-0:2014.1.5-3.el6ost
  • openstack-nova-novncproxy-0:2014.1.5-5.el7ost
  • openstack-nova-novncproxy-0:2014.2.3-31.el7ost
  • openstack-nova-novncproxy-0:2015.1.1-3.el7ost
  • openstack-nova-objectstore-0:2014.1.5-3.el6ost
  • openstack-nova-objectstore-0:2014.1.5-5.el7ost
  • openstack-nova-objectstore-0:2014.2.3-31.el7ost
  • openstack-nova-objectstore-0:2015.1.1-3.el7ost
  • openstack-nova-scheduler-0:2014.1.5-3.el6ost
  • openstack-nova-scheduler-0:2014.1.5-5.el7ost
  • openstack-nova-scheduler-0:2014.2.3-31.el7ost
  • openstack-nova-scheduler-0:2015.1.1-3.el7ost
  • openstack-nova-serialproxy-0:2014.1.5-3.el6ost
  • openstack-nova-serialproxy-0:2014.1.5-5.el7ost
  • openstack-nova-serialproxy-0:2014.2.3-31.el7ost
  • openstack-nova-serialproxy-0:2015.1.1-3.el7ost
  • openstack-nova-spicehtml5proxy-0:2015.1.1-3.el7ost
  • python-nova-0:2014.1.5-3.el6ost
  • python-nova-0:2014.1.5-5.el7ost
  • python-nova-0:2014.2.3-31.el7ost
  • python-nova-0:2015.1.1-3.el7ost