National Cyber Awareness System

Vulnerability Summary for CVE-2012-2654

Overview

The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not properly check the protocol when security groups are created and the network protocol is not specified entirely in lowercase, which allows remote attackers to bypass intended access restrictions.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://github.com/openstack/nova/commit/ff06c7c885dc94ed7c828e8cdbb8b5d850a7e654

Type: Patch Information; Exploit

Hyperlink:https://github.com/openstack/nova/commit/ff06c7c885dc94ed7c828e8cdbb8b5d850a7e654

External Source: CONFIRM

Name: https://github.com/openstack/nova/commit/9f9e9da777161426a6f8cb4314b78e09beac2978

Type: Patch Information; Exploit

Hyperlink:https://github.com/openstack/nova/commit/9f9e9da777161426a6f8cb4314b78e09beac2978

External Source: CONFIRM

Name: https://bugs.launchpad.net/nova/+bug/985184

Type: Patch Information

Hyperlink:https://bugs.launchpad.net/nova/+bug/985184

External Source: CONFIRM

Name: https://review.openstack.org/#/c/8239/

Hyperlink:https://review.openstack.org/#/c/8239/

External Source: MLIST

Name: [openstack] 20120606 [OSSA 2012-007] Security groups fail to be set correctly (CVE-2012-2654)

Hyperlink:https://lists.launchpad.net/openstack/msg12883.html

External Source: XF

Name: nova-security-group-sec-bypass(76110)

Hyperlink:http://xforce.iss.net/xforce/xfdb/76110

External Source: UBUNTU

Name: USN-1466-1

Hyperlink:http://www.ubuntu.com/usn/USN-1466-1

External Source: SECUNIA

Name: 49439

Type: Advisory

Hyperlink:http://secunia.com/advisories/49439

External Source: SECUNIA

Name: 46808

Type: Advisory

Hyperlink:http://secunia.com/advisories/46808