Vulnerabilities > CVE-2015-5162 - Resource Management Errors vulnerability in Openstack Cinder, Glance and Nova

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
HIGH
network
low complexity
openstack
CWE-399
nessus

Summary

The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image.

Common Weakness Enumeration (CWE)

Nessus

NASL familyUbuntu Local Security Checks
NASL idUBUNTU_USN-3449-1.NASL
descriptionGeorge Shuklin discovered that OpenStack Nova incorrectly handled the migration process. A remote authenticated user could use this issue to consume resources, resulting in a denial of service. (CVE-2015-3241) George Shuklin and Tushar Patil discovered that OpenStack Nova incorrectly handled deleting instances. A remote authenticated user could use this issue to consume disk resources, resulting in a denial of service. (CVE-2015-3280) It was discovered that OpenStack Nova incorrectly limited qemu-img calls. A remote authenticated user could use this issue to consume resources, resulting in a denial of service. (CVE-2015-5162) Matthew Booth discovered that OpenStack Nova incorrectly handled snapshots. A remote authenticated user could use this issue to read arbitrary files. (CVE-2015-7548) Sreekumar S. and Suntao discovered that OpenStack Nova incorrectly applied security group changes. A remote attacker could possibly use this issue to bypass intended restriction changes by leveraging an instance that was running when the change was made. (CVE-2015-7713) Matt Riedemann discovered that OpenStack Nova incorrectly handled logging. A local attacker could possibly use this issue to obtain sensitive information from log files. (CVE-2015-8749) Matthew Booth discovered that OpenStack Nova incorrectly handled certain qcow2 headers. A remote authenticated user could possibly use this issue to read arbitrary files. (CVE-2016-2140). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen2020-06-01
modified2020-06-02
plugin id103812
published2017-10-12
reporterUbuntu Security Notice (C) 2017-2019 Canonical, Inc. / NASL script (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/103812
titleUbuntu 14.04 LTS : nova vulnerabilities (USN-3449-1)
code
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Ubuntu Security Notice USN-3449-1. The text 
# itself is copyright (C) Canonical, Inc. See 
# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
# trademark of Canonical, Inc.
#

include("compat.inc");

if (description)
{
  script_id(103812);
  script_version("3.6");
  script_cvs_date("Date: 2019/09/18 12:31:47");

  script_cve_id("CVE-2015-3241", "CVE-2015-3280", "CVE-2015-5162", "CVE-2015-7548", "CVE-2015-7713", "CVE-2015-8749", "CVE-2016-2140");
  script_xref(name:"USN", value:"3449-1");

  script_name(english:"Ubuntu 14.04 LTS : nova vulnerabilities (USN-3449-1)");
  script_summary(english:"Checks dpkg output for updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Ubuntu host is missing a security-related patch."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"George Shuklin discovered that OpenStack Nova incorrectly handled the
migration process. A remote authenticated user could use this issue to
consume resources, resulting in a denial of service. (CVE-2015-3241)

George Shuklin and Tushar Patil discovered that OpenStack Nova
incorrectly handled deleting instances. A remote authenticated user
could use this issue to consume disk resources, resulting in a denial
of service. (CVE-2015-3280)

It was discovered that OpenStack Nova incorrectly limited qemu-img
calls. A remote authenticated user could use this issue to consume
resources, resulting in a denial of service. (CVE-2015-5162)

Matthew Booth discovered that OpenStack Nova incorrectly handled
snapshots. A remote authenticated user could use this issue to read
arbitrary files. (CVE-2015-7548)

Sreekumar S. and Suntao discovered that OpenStack Nova incorrectly
applied security group changes. A remote attacker could possibly use
this issue to bypass intended restriction changes by leveraging an
instance that was running when the change was made. (CVE-2015-7713)

Matt Riedemann discovered that OpenStack Nova incorrectly handled
logging. A local attacker could possibly use this issue to obtain
sensitive information from log files. (CVE-2015-8749)

Matthew Booth discovered that OpenStack Nova incorrectly handled
certain qcow2 headers. A remote authenticated user could possibly use
this issue to read arbitrary files. (CVE-2016-2140).

Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://usn.ubuntu.com/3449-1/"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected python-nova package."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:python-nova");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:14.04");

  script_set_attribute(attribute:"vuln_publication_date", value:"2015/09/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/10/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/10/12");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"Ubuntu Security Notice (C) 2017-2019 Canonical, Inc. / NASL script (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Ubuntu Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("ubuntu.inc");
include("misc_func.inc");

if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/Ubuntu/release");
if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
release = chomp(release);
if (! preg(pattern:"^(14\.04)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 14.04", "Ubuntu " + release);
if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);

flag = 0;

if (ubuntu_check(osver:"14.04", pkgname:"python-nova", pkgver:"1:2014.1.5-0ubuntu1.7")) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : ubuntu_report_get()
  );
  exit(0);
}
else
{
  tested = ubuntu_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python-nova");
}

Redhat

advisories
  • rhsa
    idRHSA-2016:2923
  • rhsa
    idRHSA-2016:2991
  • rhsa
    idRHSA-2017:0153
  • rhsa
    idRHSA-2017:0156
  • rhsa
    idRHSA-2017:0165
  • rhsa
    idRHSA-2017:0282
rpms
  • openstack-cinder-1:8.1.1-4.el7ost
  • openstack-glance-1:12.0.0-2.el7ost
  • python-cinder-1:8.1.1-4.el7ost
  • python-cinder-tests-1:8.1.1-4.el7ost
  • python-glance-1:12.0.0-2.el7ost
  • python-glance-tests-1:12.0.0-2.el7ost
  • openstack-cinder-1:7.0.3-1.el7ost
  • openstack-glance-1:11.0.1-6.el7ost
  • openstack-nova-1:12.0.5-9.el7ost
  • openstack-nova-api-1:12.0.5-9.el7ost
  • openstack-nova-cells-1:12.0.5-9.el7ost
  • openstack-nova-cert-1:12.0.5-9.el7ost
  • openstack-nova-common-1:12.0.5-9.el7ost
  • openstack-nova-compute-1:12.0.5-9.el7ost
  • openstack-nova-conductor-1:12.0.5-9.el7ost
  • openstack-nova-console-1:12.0.5-9.el7ost
  • openstack-nova-network-1:12.0.5-9.el7ost
  • openstack-nova-novncproxy-1:12.0.5-9.el7ost
  • openstack-nova-objectstore-1:12.0.5-9.el7ost
  • openstack-nova-scheduler-1:12.0.5-9.el7ost
  • openstack-nova-serialproxy-1:12.0.5-9.el7ost
  • openstack-nova-spicehtml5proxy-1:12.0.5-9.el7ost
  • python-cinder-1:7.0.3-1.el7ost
  • python-glance-1:11.0.1-6.el7ost
  • python-nova-1:12.0.5-9.el7ost
  • openstack-cinder-0:2014.1.5-9.el7ost
  • openstack-cinder-doc-0:2014.1.5-9.el7ost
  • python-cinder-0:2014.1.5-9.el7ost
  • openstack-cinder-0:2014.2.4-11.el7ost
  • openstack-cinder-doc-0:2014.2.4-11.el7ost
  • python-cinder-0:2014.2.4-11.el7ost
  • openstack-cinder-0:2014.1.5-9.el6ost
  • openstack-cinder-doc-0:2014.1.5-9.el6ost
  • python-cinder-0:2014.1.5-9.el6ost
  • openstack-cinder-0:2015.1.3-12.el7ost
  • openstack-cinder-doc-0:2015.1.3-12.el7ost
  • openstack-glance-0:2015.1.2-3.el7ost
  • openstack-glance-doc-0:2015.1.2-3.el7ost
  • openstack-nova-0:2015.1.4-32.el7ost
  • openstack-nova-api-0:2015.1.4-32.el7ost
  • openstack-nova-cells-0:2015.1.4-32.el7ost
  • openstack-nova-cert-0:2015.1.4-32.el7ost
  • openstack-nova-common-0:2015.1.4-32.el7ost
  • openstack-nova-compute-0:2015.1.4-32.el7ost
  • openstack-nova-conductor-0:2015.1.4-32.el7ost
  • openstack-nova-console-0:2015.1.4-32.el7ost
  • openstack-nova-doc-0:2015.1.4-32.el7ost
  • openstack-nova-network-0:2015.1.4-32.el7ost
  • openstack-nova-novncproxy-0:2015.1.4-32.el7ost
  • openstack-nova-objectstore-0:2015.1.4-32.el7ost
  • openstack-nova-scheduler-0:2015.1.4-32.el7ost
  • openstack-nova-serialproxy-0:2015.1.4-32.el7ost
  • openstack-nova-spicehtml5proxy-0:2015.1.4-32.el7ost
  • python-cinder-0:2015.1.3-12.el7ost
  • python-glance-0:2015.1.2-3.el7ost
  • python-nova-0:2015.1.4-32.el7ost
  • python-oslo-concurrency-0:1.8.2-2.el7ost
  • python-oslo-concurrency-doc-0:1.8.2-2.el7ost