Bug 1346193 (CVE-2016-4985)

Summary: CVE-2016-4985 openstack-ironic: Ironic Node information including credentials exposed to unauthenticated users
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abaron, aortega, apevec, ayoung, chrisw, dtantsur, gmollett, jschluet, lhh, lmartins, lpeer, markmc, mburns, rbryant, sclewis, security-response-team, slong, srevivo, tdecacqu
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
An authentication vulnerability was found in openstack-ironic. A client with network access to the ironic-api service could bypass OpenStack Identity authentication, and retrieve all information about any node registered with OpenStack Bare Metal. If an unprivileged attacker knew (or was able to guess) the MAC address of a network card belonging to a node, the flaw could be exploited by sending a crafted POST request to the node's /v1/drivers/$DRIVER_NAME/vendor_passthru resource. The response included the node's full details, including management passwords, even if the /etc/ironic/policy.json file was configured to hide passwords in API responses.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2016-12-15 05:33:31 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1348038, 1348039, 1348040, 1348041, 1348042, 1348817, 1348818    
Bug Blocks: 1346195    

Description Adam Mariš 2016-06-14 08:56:05 UTC 
A client with network access to the ironic-api service can bypass Keystone authentication and retrieve all information about any Node registered with Ironic, if they know (or are able to guess) the MAC address of a network card belonging to that Node, by sending a crafted POST request to the /v1/drivers/$DRIVER_NAME/vendor_passthru resource.

The response will include the full Node details, including management passwords, even when /etc/ironic/policy.json is configured to hide passwords in API responses.

This vulnerability has been verified in all currently supported branches (liberty, mitaka, master) and traced back to code introduced in commit 3e568fbbbcc5748035c1448a0bdb26306470797c during the Juno development cycle. Therefore, it is likely that both juno and kilo branches (and their releases) are also affected.

Affected versions: >=2014.2, >=4.0.0 <=4.2.4, >=4.3.0 <=5.1.1
Comment 1 Adam Mariš 2016-06-14 08:56:14 UTC 
Acknowledgments:

Name: the OpenStack Ironic project
Upstream: Devananda van der Veen (IBM)
Comment 6 Summer Long 2016-06-20 04:12:59 UTC 
Eric, could you please do a doc text check on this? thanks, Summer
Comment 7 Adam Mariš 2016-06-22 07:18:09 UTC 
Public via:

http://seclists.org/oss-sec/2016/q2/579
Comment 8 Adam Mariš 2016-06-22 07:21:21 UTC 
Created openstack-ironic tracking bugs for this issue:

Affects: openstack-rdo [bug 1348817]
Comment 9 Adam Mariš 2016-06-22 07:21:31 UTC 
Created openstack-ironic tracking bugs for this issue:

Affects: fedora-all [bug 1348818]
Comment 13 errata-xmlrpc 2016-07-04 05:49:37 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 8.0 (Liberty)

Via RHSA-2016:1378 https://access.redhat.com/errata/RHSA-2016:1378
Comment 14 errata-xmlrpc 2016-07-04 05:49:57 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7

Via RHSA-2016:1377 https://access.redhat.com/errata/RHSA-2016:1377