Nova VMware instance in resize state may leak

2014.10.22
Credit: Tristan Cacqueray
Risk: Medium
Local: Yes
Remote: No
CVE: CVE-2014-8333
CWE: CWE-399


CVSS Base Score: 4/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8/10
Exploit range: Remote
Attack complexity: Low
Authentication: Single time
Confidentiality impact: None
Integrity impact: None
Availability impact: Partial

OpenStack Security Advisory: 2014-037 CVE: CVE-2014-8333 Date: October 21, 2014 Title: Nova VMware instance in resize state may leak Reporter: Zhu Zhu (IBM) Products: Nova Versions: up to 2014.1.3 Description: Zhu Zhu from IBM reported a vulnerability in Nova VMware driver. If an authenticated user deletes an instance while it is in resize state, it will cause the original instance to not be deleted. An attacker can use this to launch a denial of service attack. All Nova VMware setups are affected. Juno fix: https://review.openstack.org/118595 Icehouse fix: https://review.openstack.org/125492 Notes: This fix was included in the 2014.2 release and will appear in a future 2014.1.4 stable point release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8333 https://launchpad.net/bugs/1359138 -- Tristan Cacqueray OpenStack Vulnerability Management Team

References:

https://review.openstack.org/118595
https://review.openstack.org/125492


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top