Bug 915586 (CVE-2013-0335)

Summary: CVE-2013-0335 OpenStack nova: VNC proxy can connect to the wrong VM
Product: [Other] Security Response Reporter: Kurt Seifried <kseifried>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: apevec, cpelland, jlieskov, markmc, ndipanov, rbryant, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-04-04 20:46:04 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 915588, 915589    
Bug Blocks: 921759    
Attachments:
Description Flags
openstack-folsom-CVE-2013-0335.patch none

Description Kurt Seifried 2013-02-26 07:28:20 UTC 
Russell Bryant (rbryant) reports:

Title: VNC proxy can connect to the wrong VM
CVE: CVE-2013-0335
Reporter: Loganathan Parthipan (HP), Rohit Karajgi (NTT Data)
Products: Nova
Affects: All versions

Description:
Loganathan Parthipan (HP) and Rohit Karajgi (NTT Data) independently
reported a vulnerability in Nova. If a user requests a console and
then deletes the VM, it is possible that the console token could allow
connectivity to a different VM before the console token expires if the
VNC port gets reused in that time period. This issue can be worked
around by disabling VNC support.

External references:
master (grizzly): https://review.openstack.org/#/c/22086/
stable/folsom: https://review.openstack.org/#/c/22758/
stable/essex: https://review.openstack.org/#/c/22872/
Comment 3 Kurt Seifried 2013-02-26 07:38:04 UTC 
Created attachment 702653 [details]
openstack-folsom-CVE-2013-0335.patch
Comment 4 Jan Lieskovsky 2013-03-25 10:11:03 UTC 
Other references:
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0335
  http://www.openwall.com/lists/oss-security/2013/02/26/7
  https://bugs.launchpad.net/nova/+bug/1125378
  http://www.ubuntu.com/usn/USN-1771-1
  http://www.osvdb.org/90657
  http://secunia.com/advisories/52337
  http://secunia.com/advisories/52728
Comment 5 Murray McAllister 2013-03-27 03:31:30 UTC 
Acknowledgements:

Red Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges Loganathan Parthipan (HP) and Rohit Karajgi (NTT Data) as the original, independent reporters.
Comment 6 errata-xmlrpc 2013-04-04 20:21:31 UTC 
This issue has been addressed in following products:

  OpenStack Folsom for RHEL 6

Via RHSA-2013:0709 https://rhn.redhat.com/errata/RHSA-2013-0709.html