Bug 952858 (CVE-2013-2296)

Summary: CVE-2013-2296 eucalyptus: Missing Authorization Vulnerability in Walrus
Product: [Other] Security Response Reporter: Andy Grimm <agrimm>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: djorm
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: impact=low,public=20130416,reported=20130416,source=upstream,cvss2=4.9/AV:N/AC:M/Au:S/C:P/I:P/A:N,fedora-all/eucalyptus=affected,jboss/jboss-fuse-6=notaffected,jboss/fuse-esb-enterprise-7=notaffected
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-04-17 22:49:53 EDT Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 953355    
Bug Blocks:    

Description Andy Grimm 2013-04-16 17:24:59 EDT
A flaw was
identified in the way Walrus checks authorization for some operations
on buckets. As a result, an authenticated user does not require
authorization to enable logging and versioning on buckets and
could potentially get access to activity logs for that bucket.

Links:
http://www.eucalyptus.com/eucalyptus-cloud/security/esa-10
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2296
https://eucalyptus.atlassian.net/browse/EUCA-3074
Comment 1 David Jorm 2013-04-17 22:48:26 EDT
Statement:

Not affected. This flaw does not affect the jclouds Eucalyptus API as shipped with JBoss Fuse 6.0.0 and Fuse ESB Enterprise 7.1.0.
Comment 2 David Jorm 2013-04-17 22:49:09 EDT
Created eucalyptus tracking bugs for this issue

Affects: fedora-all [bug 953355]