XML injection vulnerability in account/utils.py in OpenStack Swift Folsom, Grizzly, and Havana allows attackers to trigger invalid or spoofed Swift responses via an account name.

This update of openstack-swift fixes a security vulnerability.

  - Add CVE-2013-2161.patch: fix unchecked user input in     Swift XML responses (CVE-2013-2161, bnc#824286).

Several vulnerabilities have been discovered in Swift, the Openstack object storage. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2013-2161     Alex Gaynor from Rackspace reported a vulnerability in     XML handling within Swift account servers. Account     strings were unescaped in xml listings, and an attacker     could potentially generate unparsable or arbitrary XML     responses which may be used to leverage other     vulnerabilities in the calling software.

  - CVE-2013-4155     Peter Portante from Red Hat reported a vulnerability in     Swift. By issuing requests with an old X-Timestamp     value, an authenticated attacker can fill an object     server with superfluous object tombstones, which may     significantly slow down subsequent requests to that     object server, facilitating a Denial of Service attack     against Swift clusters.

Sebastian Krahmer discovered that Swift used the loads function in the pickle Python module when it was configured to use memcached. A remote attacker on the same network as memcached could exploit this to execute arbitrary code. This update adds a new memcache_serialization_support option to support secure json serialization. For details on this new option, please see /usr/share/doc/swift-proxy/memcache.conf-sample. This issue only affected Ubuntu 12.04 LTS. (CVE-2012-4406)

Alex Gaynor discovered that Swift did not safely generate XML. An attacker could potentially craft an account name to generate arbitrary XML responses to trigger vulnerabilities in software parsing Swift's XML. (CVE-2013-2161).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75074	openSUSE Security Update : openstack-swift (openSUSE-SU-2013:1146-1)	Nessus	SuSE Local Security Checks	high
69354	Debian DSA-2737-1 : swift - several vulnerabilities	Nessus	Debian Local Security Checks	high
66960	Ubuntu 12.04 LTS / 12.10 / 13.04 : swift vulnerabilities (USN-1887-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2013-2161

critical

Tenable Plugins

high

high

high