In OpenStack Heat, by launching a new Heat stack with a local URL an authenticated user may conduct network discovery revealing internal network configuration. Affected versions are <=5.0.3, >=6.0.0 <=6.1.0, and ==7.0.0.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:1450 advisory.

    OpenStack Orchestration (heat) is a template-driven engine used to specify and deploy configurations for     Compute, Storage, and OpenStack Networking. The service can be used to automate post-deployment actions,     which in turn allows automated provisioning of infrastructure, services, and applications. Additionally,     Orchestration can be integrated with Telemetry alarms to implement auto-scaling for certain infrastructure     resources.

    Security Fix(es):

    * An information-leak vulnerability was found in the OpenStack Orchestration (heat) service. Launching a     new stack with a local URL resulted in a detailed error message, allowing an authenticated user to conduct     network discovery and reveal the details of internal network services. (CVE-2016-9185)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - openstack-heat: Template source URL allows network port scan (CVE-2016-9185)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

ID	Name	Product	Family	Severity
210160	RHEL 7 : openstack-heat (RHSA-2017:1450)	Nessus	Red Hat Local Security Checks	medium
200045	RHEL 6 : openstack-heat (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
196352	RHEL 6 : openstack-heat (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2016-9185

medium

Tenable Plugins

medium

medium

medium