OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote attackers to bypass authentication via an empty password.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:0994 advisory.

    The openstack-keystone packages provide Keystone, a Python implementation     of the OpenStack identity service API, which provides Identity, Token,     Catalog, and Policy services.

    A flaw was found in the way Keystone handled LDAP (Lightweight Directory     Access Protocol) based authentication. If Keystone was configured to use     LDAP authentication, and the LDAP server was configured to allow anonymous     binds (anonymous binds is a common default), anyone able to connect to a     given service using Keystone could connect as any user, including the     admin, without supplying a password. (CVE-2013-2157)

    Red Hat would like to thank Thierry Carrez of OpenStack upstream for     reporting this issue. Upstream acknowledges Jose Castro Leon of CERN as     the original reporter.

    These updated packages have been upgraded to upstream version 2013.1.2,     which provides a number of bug fixes over the previous version. (BZ#972660)

    All users of openstack-keystone are advised to upgrade to these updated     packages, which correct these issues. After installing the updated     packages, the Keystone service (openstack-keystone) will be restarted     automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update of openstack-keystone fixes two security vulnerabilities.

  - Add CVE-2013-2104.patch: fix missing expiration check in     Keystone PKI token validation (CVE-2013-2104,     bnc#821201)

  - Add CVE-2013-2157.patch: fix authentication bypass when     using LDAP backend (CVE-2013-2157, bnc#823783)

authtoken: Check token expiry CVE-2013-2104 Force simple Bind for authentication CVE-2013-2157

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Stable Grizzly update 2013.1.2 Force simple Bind for authentication CVE-2013-2157 restrict /var/log/keystone/ rhbz#956814

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Eoghan Glynn and Alex Meade discovered that Keystone did not properly perform expiry checks for the PKI tokens used in Keystone. If Keystone were setup to use PKI tokens, a previously authenticated user could continue to use a PKI token for longer than intended. This issue only affected Ubuntu 12.10 which does not use PKI tokens by default.
(CVE-2013-2104)

Jose Castro Leon discovered that Keystone did not properly authenticate users when using the LDAP backend. An attacker could obtain valid tokens and impersonate other users by supplying an empty password. By default, Ubuntu does not use the LDAP backend.
(CVE-2013-2157).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
193678	RHEL 6 : openstack-keystone (RHSA-2013:0994)	Nessus	Red Hat Local Security Checks	critical
75063	openSUSE Security Update : openstack-keystone (openSUSE-SU-2013:1089-1)	Nessus	SuSE Local Security Checks	medium
69288	Fedora 18 : openstack-keystone-2012.2.4-5.fc18 (2013-10713)	Nessus	Fedora Local Security Checks	medium
68985	Fedora 19 : openstack-keystone-2013.1.2-3.fc19 (2013-10467)	Nessus	Fedora Local Security Checks	medium
66893	Ubuntu 12.10 / 13.04 : keystone vulnerabilities (USN-1875-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2013-2157

critical

Tenable Plugins

critical

medium

medium

medium

medium