Bug 873524 (CVE-2012-5476)

Summary:	CVE-2012-5476 OpenStack: Quantum /etc/quantum/quantum.conf secret password and token exposure
Product:	[Other] Security Response	Reporter:	Kurt Seifried <kseifried>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	apevec, markmc, pbrady, rkukura, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-12-16 05:33:25 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	873527, 873530, 876288
Bug Blocks:	836072

Description Kurt Seifried 2012-11-06 06:08:32 UTC

Within the OpenStack Quantum package (specifically openstack-quantum) the 
file Within the OpenStack dashboard package (specifically openstack-dashboard) the 
file /etc/quantum/quantum.conf is world readable and contains:

===
[filter:authN]
...
auth_admin_user = admin
auth_admin_password = secrete
#auth_admin_token = <token-value>
===

This file should be mode 0600.

Comment 1 Alan Pevec 2012-11-08 11:16:23 UTC

Quantum config files are all
%config(noreplace) %attr(0640, root, quantum)
in 2012.2 (Folsom) so this only affects RHOS Essex Preview.
How urgent is to push this update to Essex Preview, when it is going public?

Comment 2 Kurt Seifried 2012-11-13 18:10:16 UTC

Created openstack-quantum tracking bugs for this issue

Affects: epel-6 [bug 876288]

Comment 3 Fedora Update System 2012-11-17 19:50:14 UTC

python-keystoneclient-0.1.3.27-1.el6, python-glanceclient-0.5.1-1.el6, python-websockify-0.2.0-1.el6, novnc-0.4-2.el6, python-prettytable-0.6.1-1.el6, openstack-quantum-2012.2-2.el6, python-quantumclient-2.1.1-0.el6, python-cinderclient-0.2.26-1.el6, python-novaclient-2.9.0-1.el6, python-django-openstack-auth-1.0.2-3.el6, openstack-nova-2012.2-2.el6, openstack-cinder-2012.2-3.el6, openstack-utils-2012.2-6.el6, openstack-glance-2012.2-3.el6, python-django-horizon-2012.2-4.el6, openstack-keystone-2012.2-5.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 4 Huzaifa S. Sidhpurwala 2012-11-28 06:03:14 UTC

Acknowledgements:

This issue was discovered by Kurt Seifried of Red Hat Security Response Team.

Comment 5 Kurt Seifried 2012-12-16 05:33:25 UTC

This issue was fixed in EPEL-6 in python-keystoneclient-0.1.3.27-1.el6, python-glanceclient-0.5.1-1.el6, python-websockify-0.2.0-1.el6, novnc-0.4-2.el6, python-prettytable-0.6.1-1.el6, openstack-quantum-2012.2-2.el6, python-quantumclient-2.1.1-0.el6, python-cinderclient-0.2.26-1.el6, python-novaclient-2.9.0-1.el6, python-django-openstack-auth-1.0.2-3.el6, openstack-nova-2012.2-2.el6, openstack-cinder-2012.2-3.el6, openstack-utils-2012.2-6.el6, openstack-glance-2012.2-3.el6, python-django-horizon-2012.2-4.el6, openstack-keystone-2012.2-5.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.

For OpenStrack Essex the Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw.

OpenStrack Folsom is not vulnerable to this issue.