Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter to auth/login/. NOTE: this issue was originally assigned CVE-2012-3542 by mistake.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2012:1380 advisory.

    Horizon is the OpenStack Dashboard (http://www.openstack.org), a web     interface for managing OpenStack services.

    An open redirect flaw was found in the way Horizon handled authentication.
    A remote attacker able to trick a victim into opening the Horizon login     page using a specially-crafted link could redirect the victim to an     arbitrary web page, and conduct phishing attacks, after the victim     successfully logs in. (CVE-2012-3540)

    Red Hat would like to thank Thomas Biege of SUSE for reporting this issue.

    All users of Horizon are advised to upgrade to these updated packages,     which correct this issue. After installing the updated packages, the httpd     daemon must be restarted (service httpd restart) for the update to take     effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Latest bugfix update for the essex branch CVE-2012-3540

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Thomas Biege discovered that the Horizon authentication mechanism did not validate the next parameter. An attacker could use this to construct a link to legitimate OpenStack web dashboard that redirected the user to a malicious website after authentication.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
193675	RHEL 6 : python-django-horizon (RHSA-2012:1380)	Nessus	Red Hat Local Security Checks	medium
62671	Fedora 17 : python-django-horizon-2012.1.3-1.fc17 (2012-16148)	Nessus	Fedora Local Security Checks	medium
62073	Ubuntu 12.04 LTS : horizon vulnerability (USN-1565-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2012-3540

medium

Tenable Plugins

medium

medium

medium