Swift TempURL timing attack

2014.01.17
Risk: High
Local: No
Remote: Yes
CWE: CWE-200


Ogólna skala CVSS: 4.3/10
Znaczenie: 2.9/10
Łatwość wykorzystania: 8.6/10
Wymagany dostęp: Zdalny
Złożoność ataku: Średnia
Autoryzacja: Nie wymagana
Wpływ na poufność: Częściowy
Wpływ na integralność: Brak
Wpływ na dostępność: Brak

OpenStack Security Advisory: 2014-002 CVE: CVE-2014-0006 Date: January 16, 2013 Title: Swift TempURL timing attack Reporter: Samuel Merritt (SwiftStack) Products: Swift Affects: All supported versions Description: Samuel Merritt from SwiftStack reported a timing attack vulnerability in Swift TempURL middleware. By analyzing response times to arbitrary TempURL requests, an attacker may be able to guess valid secret URLs and get access to objects that were only intended to be publicly shared with specific recipients. In order to use this attack, the attacker needs to know the targeted object name, and the object account needs to have a TempURL key set. Only Swift setups enabling the TempURL middleware are affected. Icehouse (development branch) fix: https://review.openstack.org/#/c/67185/ Havana (1.10.0) fix: https://review.openstack.org/#/c/67186/ Grizzly (1.8.0) fix: https://review.openstack.org/#/c/67187/ Note: the Icehouse fix will be included in upcoming 1.12.0 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0006 https://bugs.launchpad.net/swift/+bug/1265665 Regards, -- Thierry Carrez OpenStack Vulnerability Management Team

Referencje:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0006
https://bugs.launchpad.net/swift/+bug/1265665


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top