OpenStack Swift before 1.9.1 in Folsom, Grizzly, and Havana allows authenticated users to cause a denial of service ("superfluous" tombstone consumption and Swift cluster slowdown) via a DELETE request with a timestamp that is older than expected.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:1197 advisory.

    OpenStack Swift (http://swift.openstack.org) is a highly available,     distributed, eventually consistent object/blob store.

    A denial of service flaw in OpenStack Swift allowed attackers to fill the     object server with object tombstones. This could lead to subsequent     requests from legitimate users taking an excessive amount of time.
    (CVE-2013-4155)

    This issue was discovered by Peter Portante of Red Hat.

    All users of openstack-swift are advised to upgrade to these updated     packages, which correct this issue. After installing this update, the     OpenStack Swift services will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Peter Portante discovered that Swift did not properly handle requests with old X-Timestamp values. An authenticated attacker could exploit this to cause a denial of service via disk consumption.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the possibility to fill up a Swift fluster with invalid tombstone files by attacking with DELETE requests with a special timestamp.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in Swift, the Openstack object storage. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2013-2161     Alex Gaynor from Rackspace reported a vulnerability in     XML handling within Swift account servers. Account     strings were unescaped in xml listings, and an attacker     could potentially generate unparsable or arbitrary XML     responses which may be used to leverage other     vulnerabilities in the calling software.

  - CVE-2013-4155     Peter Portante from Red Hat reported a vulnerability in     Swift. By issuing requests with an old X-Timestamp     value, an authenticated attacker can fill an object     server with superfluous object tombstones, which may     significantly slow down subsequent requests to that     object server, facilitating a Denial of Service attack     against Swift clusters.

ID	Name	Product	Family	Severity
210149	RHEL 6 : openstack-swift (RHSA-2013:1197)	Nessus	Red Hat Local Security Checks	medium
70580	Ubuntu 12.04 LTS / 12.10 / 13.04 : swift vulnerability (USN-2001-1)	Nessus	Ubuntu Local Security Checks	medium
69387	Fedora 19 : openstack-swift-1.8.0-3.fc19 (2013-14477)	Nessus	Fedora Local Security Checks	medium
69354	Debian DSA-2737-1 : swift - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2013-4155

medium

Tenable Plugins

medium

medium

medium

high