OpenStack Cinder before 2014.1.5 (icehouse), 2014.2.x before 2014.2.4 (juno), and 2015.1.x before 2015.1.1 (kilo) allows remote authenticated users to read arbitrary files via a crafted qcow2 signature in an image to the upload-to-image command.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:1206 advisory.

    OpenStack Block Storage (cinder) manages block storage mounting and the     presentation of such mounted block storage to instances. The backend     physical storage can consist of local disks, or Fiber Channel, iSCSI, and     NFS mounts attached to Compute nodes. In addition, Block Storage supports     volume backups, and snapshots for temporary save and restore operations.
    Programatic management is available via Block Storages API.

    A flaw was found in the cinder upload-to-image functionality. When     processing a malicious qcow2 header cinder could be tricked into reading     an arbitrary file from the cinder host. (CVE-2015-1851)

    All users of openstack-cinder are advised to upgrade to these updated     packages, which correct these issues. After installing the updated     packages, the cinder running services will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Bastian Blank discovered that Cinder guessed image formats based on untrusted data. An attacker could use this to read arbitrary files from the Cinder host.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Bastian Blank from credativ discovered that cinder, a storage-as-a-service system for the OpenStack cloud computing suite, contained a bug that would allow an authenticated user to read any file from the cinder server.

ID	Name	Product	Family	Severity
233048	RHEL 6 / 7 : openstack-cinder (RHSA-2015:1206)	Nessus	Red Hat Local Security Checks	medium
85251	Ubuntu 15.04 : cinder vulnerability (USN-2703-1)	Nessus	Ubuntu Local Security Checks	medium
84299	Debian DSA-3292-1 : cinder - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2015-1851

medium

Tenable Plugins

medium

medium

medium