Bug 1576947 – CVE-2018-1132 Opendaylight: SDNInterfaceapp SQL Injection

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1576947 - (CVE-2018-1132) CVE-2018-1132 Opendaylight: SDNInterfaceapp SQL Injection

Summary:	CVE-2018-1132 Opendaylight: SDNInterfaceapp SQL Injection

Status:	NEW

Aliases:	CVE-2018-1132

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20180519,reported=2...
Keywords:	Security

Depends On:
Blocks:	1576948
	Show dependency tree / graph

Reported:	2018-05-10 15:47 EDT by Pedro Sampaio
Modified:	2018-06-20 00:16 EDT (History)
CC List:	17 users (show)

See Also:
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in Opendaylight's SDNInterfaceapp (SDNI). Attackers can SQL inject the component's database (SQLite) without authenticating to the controller or SDNInterfaceapp.
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Pedro Sampaio 2018-05-10 15:47:31 EDT

A flaw was found in Opendaylight's SDNInterfaceapp (SDNI). Attackers can SQL inject the component's database(SQLite) without authenticating to the controller or SDNInterfaceapp.

The bug is in /impl/src/main/java/org/opendaylight/sdninterfaceapp/impl/database/SdniDataBase.java (line 373~391)

Comment 1 James Hebden 2018-05-11 00:13:40 EDT

Audited opendaylight packaging, and we don't include this component in our packages for opendaylight. 

The ODL module implicated in this CVE (org.opendaylight.sdninterfaceapp.*) would only be present on RHOSP OpenDayLight if manually installed via karaf, which is outside of our control.

Reviewing the source code mentioned, input to the SQL query on line 377 is clearly not being sanitised - based on a review of the parameters being included in the SQL query, outside manipulation of these variables seems unlikely, and the difficulty to exploit, high. The parameters in question are being exchanged between federated OpenDayLight installs, so the level of trust required is higher than general network access.

Marking notaffected based on this code not being packaged.

Comment 2 James Hebden 2018-05-22 01:11:07 EDT

A patch will not be released for this flaw, given the component is not part of RHOSP. The upstream project has made this flaw public, and stated that a patch will not be released due to the component being deprecated from the Carbon release onwards.

Comment 3 James Hebden 2018-05-22 06:47:19 EDT

Acknowledgments:

Name: Feng Xiao (Wuhan University), Jianwei Huang (Wuhan University)

Comment 4 James Hebden 2018-05-22 06:47:29 EDT

Statement:

SDNInterface has been deprecated in OpenDayLight since it was last used in the final Carbon series release. In addition to the component not being included in OpenDayLight in newer releases, the SDNInterface component is not included in the RHOSP package for opendaylight

Comment 5 James Hebden 2018-05-22 06:47:38 EDT

External References:

https://jira.opendaylight.org/browse/SDNINTRFAC-14

Note You need to log in before you can comment on or make changes to this bug.