Bug 1142012 (CVE-2014-6414)

Summary:	CVE-2014-6414 openstack-neutron: Admin-only network attributes may be reset to defaults by non-privileged users
Product:	[Other] Security Response	Reporter:	Murray McAllister <mmcallis>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abaron, aortega, apevec, apevec, ayoung, carnil, chrisw, dallan, gkotton, gmollett, ihrachys, jlibosva, jrusnack, lhh, lpeer, majopela, markmc, mmcallis, nyechiel, p, rbryant, rk, sclewis, twilson, vdanen, yeylon
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	It was discovered that unprivileged users could in some cases reset admin-only network attributes to their default values. This could lead to unexpected behavior or in some cases result in a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-11-03 12:17:35 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1142013, 1142014, 1147185, 1147186, 1147187
Bug Blocks:	1142015

Description Murray McAllister 2014-09-16 02:41:31 UTC

The OpenStack project reports:

""
Title: Admin-only network attributes may be reset to defaults by
non-privileged users
Reporter: Elena Ezhova (Mirantis)
Products: Neutron
Versions: up to 2013.2.4 and 2014.1 versions up to 2014.1.2

Description:
Elena Ezhova from Mirantis reported a vulnerability in Neutron. By updating
a network attribute with a default value a non-privileged user may reset
admin-only network attributes. This may lead to unexpected behavior with
security implications for operators with a custom policy.json, or in some
extreme cases network outages resulting in denial of service. All
deployments using neutron networking are affected by this flaw.
""

References:

http://seclists.org/oss-sec/2014/q3/602
https://bugs.launchpad.net/neutron/+bug/1357379
https://review.openstack.org/#/c/114531/

Comment 3 Murray McAllister 2014-09-16 02:43:17 UTC

Created openstack-neutron tracking bugs for this issue:

Affects: fedora-20 [bug 1142013]

Comment 6 Ihar Hrachyshka 2014-09-26 08:13:02 UTC

I've already backported the fix to RDO Havana, so there should be no issues with that. So please create trackers. Also, the earlier we handle the issue, the better.

Comment 9 Garth Mollett 2014-09-28 01:12:52 UTC

(In reply to Ihar Hrachyshka from comment #6)
> I've already backported the fix to RDO Havana, so there should be no issues
> with that. So please create trackers. Also, the earlier we handle the issue,
> the better.

Great, thanks Ihar.

Comment 10 Fedora Update System 2014-10-10 15:56:56 UTC

openstack-neutron-2013.2.4-4.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 Martin Prpič 2014-10-20 11:50:05 UTC

IssueDescription:

It was discovered that unprivileged users could in some cases reset admin-only network attributes to their default values. This could lead to unexpected behavior or in some cases result in a denial of service.

Comment 12 errata-xmlrpc 2014-10-22 17:23:30 UTC

This issue has been addressed in the following products:

  OpenStack 4 for RHEL 6

Via RHSA-2014:1686 https://rhn.redhat.com/errata/RHSA-2014-1686.html

Comment 13 errata-xmlrpc 2014-11-03 08:38:56 UTC

This issue has been addressed in the following products:

  OpenStack 5 for RHEL 7

Via RHSA-2014:1786 https://rhn.redhat.com/errata/RHSA-2014-1786.html

Comment 14 errata-xmlrpc 2014-11-03 08:40:22 UTC

This issue has been addressed in the following products:

  OpenStack 5 for RHEL 6

Via RHSA-2014:1785 https://rhn.redhat.com/errata/RHSA-2014-1785.html