Bug 1063141 (CVE-2014-0056) - CVE-2014-0056 openstack-neutron: insufficient authorization checks when creating ports
Summary: CVE-2014-0056 openstack-neutron: insufficient authorization checks when creat...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2014-0056
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1081861 1081862 1081863 1087664
Blocks: 1063143
TreeView+ depends on / blocked
 
Reported: 2014-02-10 06:28 UTC by Murray McAllister
Modified: 2023-05-12 13:03 UTC (History)
15 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-07-15 07:37:51 UTC
Embargoed:

Attachments (Terms of Use)
havana patch (9.98 KB, patch)
2014-05-06 05:25 UTC, Garth Mollett 		no flags Details | Diff
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2014:0516 0 normal SHIPPED_LIVE Moderate: openstack-neutron security, bug fix, and enhancement update 2014-05-30 00:15:59 UTC

Description Murray McAllister 2014-02-10 06:28:55 UTC 
The OpenStack project reports:

Title: Routers can be cross plugged by other tenants
Reporter: Aaron Rosen (VMWare)
Products: Neutron
Affects: 2012.2 versions up to 2013.2.2

Description:
Aaron Rosen from VMWare reported a vulnerability where Neutron fails to
perform proper authorization checks when creating ports. By choosing a
device id of a router from a different tenant when creating a port, an
authenticated user can access the network of other tenants. This affects
deployments of Neutron using plugins relying on the l3-agent.
Comment 1 Murray McAllister 2014-02-10 06:29:51 UTC 
Acknowledgements:

Red Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges Aaron Rosen from VMware as the original reporter.
Comment 4 Murray McAllister 2014-03-28 06:13:00 UTC 
This is public now:

http://www.openwall.com/lists/oss-security/2014/03/27/5
Comment 5 Murray McAllister 2014-03-28 06:15:15 UTC 
Created openstack-neutron tracking bugs for this issue:

Affects: fedora-20 [bug 1081861]
Comment 6 Murray McAllister 2014-03-28 06:15:21 UTC 
Created openstack-quantum tracking bugs for this issue:

Affects: fedora-19 [bug 1081862]
Affects: epel-6 [bug 1081863]
Comment 8 Garth Mollett 2014-05-06 05:25:06 UTC 
Created attachment 892762 [details]
havana patch
Comment 9 errata-xmlrpc 2014-05-29 20:19:07 UTC 
This issue has been addressed in following products:

  OpenStack 4 for RHEL 6

Via RHSA-2014:0516 https://rhn.redhat.com/errata/RHSA-2014-0516.html
Note You need to log in before you can comment on or make changes to this bug.