National Cyber Awareness System

Vulnerability Summary for CVE-2013-0208

Overview

The boot-from-volume feature in OpenStack Compute (Nova) Folsom and Essex, when using nova-volumes, allows remote authenticated users to boot from other users' volumes via a volume id in the block_device_mapping parameter.

Description

Per http://www.ubuntu.com/usn/USN-1709-1/ A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 12.10 Ubuntu 12.04 LTS Ubuntu 11.10

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://github.com/openstack/nova/commit/317cc0af385536dee43ef2addad50a91357fc1ad

Hyperlink:https://github.com/openstack/nova/commit/317cc0af385536dee43ef2addad50a91357fc1ad

External Source: CONFIRM

Name: https://github.com/openstack/nova/commit/243d516cea9d3caa5a8267b12d2f577dcb24193b

Hyperlink:https://github.com/openstack/nova/commit/243d516cea9d3caa5a8267b12d2f577dcb24193b

External Source: MISC

Name: https://bugzilla.redhat.com/show_bug.cgi?id=902629

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=902629

External Source: CONFIRM

Name: https://bugs.launchpad.net/nova/+bug/1069904

Hyperlink:https://bugs.launchpad.net/nova/+bug/1069904

External Source: XF

Name: nova-volume-security-bypass(81697)

Hyperlink:http://xforce.iss.net/xforce/xfdb/81697

External Source: UBUNTU

Name: USN-1709-1

Hyperlink:http://www.ubuntu.com/usn/USN-1709-1

External Source: BID

Name: 57613

Hyperlink:http://www.securityfocus.com/bid/57613

External Source: MLIST

Name: [oss-security] 20130129 [OSSA 2013-001] Boot from volume allows access to random volumes (CVE-2013-0208)

Hyperlink:http://www.openwall.com/lists/oss-security/2013/01/29/9

External Source: SECUNIA

Name: 51992

Type: Advisory

Hyperlink:http://secunia.com/advisories/51992

External Source: SECUNIA

Name: 51963

Type: Advisory

Hyperlink:http://secunia.com/advisories/51963

External Source: REDHAT

Name: RHSA-2013:0208

Hyperlink:http://rhn.redhat.com/errata/RHSA-2013-0208.html

External Source: OSVDB

Name: 89661

Hyperlink:http://osvdb.org/89661