The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:1199 advisory.

    The openstack-nova packages provide OpenStack Compute (Nova), which     provides services for provisioning, managing, and using virtual machine     instances.

    It was found that the fixes for CVE-2013-1664 and CVE-2013-1665, released     via RHSA-2013:0657, did not fully correct the issues in the Extensible     Markup Language (XML) parser used by Nova. A remote attacker could use     this flaw to send a specially-crafted request to a Nova API, causing     Nova to consume an excessive amount of CPU and memory, or possibly crash.
    (CVE-2013-4179)

    A denial of service flaw was found in the way Nova handled network source     security group policy updates. An authenticated user could send a large     number of server creation operations, causing nova-network to become     unresponsive. (CVE-2013-4185)

    An information disclosure flaw and a resource limit bypass were found in     the way Nova handled virtual hardware templates (flavors). These allowed     tenants to show and boot other tenants' flavors and bypass resource limits     enforced via the os-flavor-access:is_public property. (CVE-2013-2256)

    It was discovered that, in some configurations, certain messages in     console-log could cause nova-compute to become unresponsive, resulting in a     denial of service. (CVE-2013-4261)

    Red Hat would like to thank the OpenStack project for reporting     CVE-2013-2256 and CVE-2013-4185. Upstream acknowledges hzrandd from NetEase     as the original reporter of CVE-2013-2256, and Vishvananda Ishaya     from Nebula as the original reporter of CVE-2013-4185. Upstream also     acknowledges Ken'ichi Ohmichi from NEC for providing a corrected fix for     CVE-2013-2256.

    The CVE-2013-4179 issue was discovered by Grant Murphy of the Red Hat     Product Security Team, and CVE-2013-4261 was discovered by Jaroslav Henner     of Red Hat.

    This update also fixes a number of bugs in openstack-nova.

    Additionally, openstack-nova has been rebased to the latest stable release     2013.1.3. (BZ#993100)

    All users of openstack-nova are advised to upgrade to these updated     packages, which correct these issues. After installing the updated     packages, the running Nova services will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Rongze Zhu discovered that the Cinder LVM driver did not zero out data when deleting snapshots. This could expose sensitive information to authenticated users when subsequent servers use the volume.
(CVE-2013-4183)

Grant Murphy discovered that Cinder would allow XML entity processing.
A remote unauthenticated attacker could exploit this using the Cinder API to cause a denial of service via resource exhaustion.
(CVE-2013-4179, CVE-2013-4202).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Nova did not properly enforce the is_public property when determining flavor access. An authenticated attacker could exploit this to obtain sensitive information in private flavors.
This issue only affected Ubuntu 12.10 and 13.10. (CVE-2013-2256, CVE-2013-4278)

Grant Murphy discovered that Nova would allow XML entity processing. A remote unauthenticated attacker could exploit this using the Nova API to cause a denial of service via resource exhaustion. This issue only affected Ubuntu 13.10. (CVE-2013-4179)

Vishvananda Ishaya discovered that Nova inefficiently handled network security group updates when Nova was configured to use nova-network.
An authenticated attacker could exploit this to cause a denial of service. (CVE-2013-4185)

Jaroslav Henner discovered that Nova did not properly handle certain inputs to the instance console when Nova was configured to use Apache Qpid. An authenticated attacker could exploit this to cause a denial of service on the compute node running the instance. By default, Ubuntu uses RabbitMQ instead of Qpid. (CVE-2013-4261).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fixes 2 CVEs that were missed with the 2013.1.3 stable update Update to latest stable/grizzly 2013.1.3

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
210148	RHEL 6 : openstack-nova (RHSA-2013:1199)	Nessus	Red Hat Local Security Checks	high
70584	Ubuntu 13.04 : cinder vulnerabilities (USN-2005-1)	Nessus	Ubuntu Local Security Checks	medium
70579	Ubuntu 12.04 LTS / 12.10 / 13.04 : nova vulnerabilities (USN-2000-1)	Nessus	Ubuntu Local Security Checks	medium
69785	Fedora 19 : openstack-nova-2013.1.3-2.fc19 (2013-15373)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-4179

high

Tenable Plugins

high

medium

medium

medium