OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. NOTE: this issue exists because of a CVE-2012-3426 regression.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1557 advisory.

    The openstack-keystone packages provide Keystone, a Python implementation     of the OpenStack identity service API, which provides Identity, Token,     Catalog, and Policy services.

    The openstack-keystone packages have been upgraded to upstream version     2012.2.1, which provides a number of bug fixes and enhancements over the     previous version. (BZ#883829)

    This update also fixes the following security issues:

    A flaw in Keystone allowed an attacker with access to the web and network     interfaces to continue using chained tokens linked to tokens that had     expired. This would allow the attacker to continue using the tokens despite     the parent token being expired, giving them continued access to OpenStack     services. (CVE-2012-5563)

    It was found that Keystone did not correctly handle users being removed     from tenants when Amazon Elastic Compute Cloud (Amazon EC2) style     credentials (credentials that are issued in the same format as standard     Amazon EC2 credentials) were in use. When a user was removed from a tenant,     they retained the privileges provided by that tenant, allowing them to     access resources they should no longer have access to. (CVE-2012-5571)

    Red Hat would like to thank the OpenStack project for reporting these     issues. Upstream acknowledges Anndy as the original reporter of     CVE-2012-5563, and Vijaya Erukala as the original reporter of     CVE-2012-5571.

    All users of openstack-keystone are advised to upgrade to these updated     packages, which correct these issues and add these enhancements. After     installing the updated packages, the Keystone service (openstack-keystone)     will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

update to stable folsom release 2012.2.1

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Vijaya Erukala discovered that Keystone did not properly invalidate EC2-style credentials such that if credentials were removed from a tenant, an authenticated and authorized user using those credentials may still be allowed access beyond the account owner's expectations.
(CVE-2012-5571)

It was discovered that Keystone did not properly implement token expiration. A remote attacker could use this to continue to access an account that is disabled or has a changed password. This issue was previously fixed as CVE-2012-3426 but was reintroduced in Ubuntu 12.10. (CVE-2012-5563).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
210170	RHEL 6 : openstack-keystone (RHSA-2012:1557)	Nessus	Red Hat Local Security Checks	critical
63213	Fedora 18 : openstack-keystone-2012.2.1-1.fc18 (2012-19584)	Nessus	Fedora Local Security Checks	medium
63093	Ubuntu 12.04 LTS / 12.10 : keystone vulnerabilities (USN-1641-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2012-5563

medium

Tenable Plugins

critical

medium

medium