Thierry Carrez of the Openstack project reports: Title: Swift TempURL timing attack Reporter: Samuel Merritt (SwiftStack) Products: Swift Affects: All supported versions Description: Samuel Merritt from SwiftStack reported a timing attack vulnerability in Swift TempURL middleware. By analyzing response times to arbitrary TempURL requests, an attacker may be able to guess valid secret URLs and get access to objects that were only intended to be publicly shared with specific recipients. In order to use this attack, the attacker needs to know the targeted object name, and the object account needs to have a TempURL key set. Only Swift setups enabling the TempURL middleware are affected.
Created attachment 848380 [details] CVE-2014-0006-grizzly.diff
Created attachment 848381 [details] CVE-2014-0006-havana.diff
Created attachment 848382 [details] CVE-2014-0006-master.diff
Acknowledgements: Red Hat would like to thank the Openstack Project for reporting this issue. Upstream acknowledges Samuel Merritt of SwiftStack as the original reporter.
Created openstack-swift tracking bugs for this issue: Affects: fedora-all [bug 1054665] Affects: epel-6 [bug 1054666]
Upstream patch and code review: https://review.openstack.org/#/c/67185/
This issue has been addressed in following products: OpenStack 4 for RHEL 6 Via RHSA-2014:0232 https://rhn.redhat.com/errata/RHSA-2014-0232.html
This issue has been addressed in following products: OpenStack 3 for RHEL 6 Via RHSA-2014:0367 https://rhn.redhat.com/errata/RHSA-2014-0367.html