The handle_command function in mon/Monitor.cc in Ceph allows remote authenticated users to cause a denial of service (segmentation fault and ceph monitor crash) via an (1) empty or (2) crafted prefix.

An updated ceph package that fixes one security issue is now available for Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Red Hat Ceph Storage is a massively scalable, open, software-defined storage platform that combines the most stable version of Ceph with a Ceph management platform, deployment tools, and support services.

A flaw was found in the way handle_command() function would validate prefix value from user. An authenticated attacker could send a specially crafted prefix value resulting in ceph monitor crash.(CVE-2016-5009)

Upstream acknowledges Xiaoxi Chen as the original reporter of CVE-2016-5009.

All ceph users are advised to upgrade to this updated package, which contains backported patches to correct this issue.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3452-1 advisory.

    It was discovered that Ceph incorrectly handled the handle_command function. A remote authenticated user     could use this issue to cause Ceph to crash, resulting in a denial of service. (CVE-2016-5009)

    Rahul Aggarwal discovered that Ceph incorrectly handled the authenticated-read ACL. A remote attacker     could possibly use this issue to list bucket contents via a URL. (CVE-2016-7031)

    Diluga Salome discovered that Ceph incorrectly handled certain POST objects with null conditions. A remote     attacker could possibly use this issue to cuase Ceph to crash, resulting in a denial of service.
    (CVE-2016-8626)

    Yang Liu discovered that Ceph incorrectly handled invalid HTTP Origin headers. A remote attacker could     possibly use this issue to cuase Ceph to crash, resulting in a denial of service. (CVE-2016-9579)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for ceph fixes the following issues :

  - CVE-2016-5009: moncommand with empty prefix could crash     monitor [bsc#987144]

  - Invalid commandd in SOC7 with ceph [bsc#1008894]

  - Performance fix was missing in SES4 [bsc#1005179]

  - ceph build problems on ppc64le [bsc#982141]

  - ceph make build unit test failure [bsc#977940]

  - ceph-deploy mon create-initial fails on one node     [bsc#999688]

  - MDS dies while running xfstests [bsc#985232]

  - Typerror while calling _recover_auth_meta()     [bsc#1008501]

  - OSD daemon uses ~100% CPU load right after OSD creation     / first OSD start [bsc#1014338]

  - civetweb HTTPS support not working [bsc#990438]

  - systemd is killing off OSDs [bsc#1007216]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ceph was updated to version 10.2.4 and fixes the following issues :

  - A moncommand with empty prefix could crash the monitor     (boo#987144, CVE-2016-5009)

  - Detect crc32 extension support from assembler on AArch64     (boo#999688)

  - Failing file operations on kernel based cephfs mount     point could leave unaccessible file behind on hammer     0.94.7 (boo#985232)

  - Fixed boo#1008501

  + ceph_volume_client: fix _recover_auth_meta() method

  + ceph_volume_client: check if volume metadata is empty

  + ceph_volume_client: fix partial auth recovery

  - Avoid ~100% CPU load after OSD creation / first OSD     start (boo#1014338)

  - Fixed boo#990438: civetweb HTTPS support not working

  - Avoid systemd limiting OSDs (boo#1007216)

  - Fix 'make check' when building unit tests with
    --with-xio (boo#977940)

  - Fix build for ppc64le (boo#982141)

  - Including performance fix for linux dcache hash     algorithm (boo#1005179)

  - Fix invalid command in SOC7 (boo#1008894)

ID	Name	Product	Family	Severity
112171	RHEL 7 : ceph (RHSA-2016:1384)	Nessus	Red Hat Local Security Checks	medium
103815	Ubuntu 14.04 LTS : Ceph vulnerabilities (USN-3452-1)	Nessus	Ubuntu Local Security Checks	high
96977	SUSE SLED12 / SLES12 Security Update : ceph (SUSE-SU-2017:0367-1)	Nessus	SuSE Local Security Checks	medium
95976	openSUSE Security Update : ceph (openSUSE-2016-1500)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2016-5009

medium

Tenable Plugins

medium

high

medium

medium