Bug 1142012 (CVE-2014-6414) - CVE-2014-6414 openstack-neutron: Admin-only network attributes may be reset to defaults by non-privileged users
Summary: CVE-2014-6414 openstack-neutron: Admin-only network attributes may be reset t...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2014-6414
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1142013 1142014 1147185 1147186 1147187
Blocks: 1142015
TreeView+ depends on / blocked
 
Reported: 2014-09-16 02:41 UTC by Murray McAllister
Modified: 2021-02-17 06:13 UTC (History)
26 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
It was discovered that unprivileged users could in some cases reset admin-only network attributes to their default values. This could lead to unexpected behavior or in some cases result in a denial of service.
Clone Of:
Environment:
Last Closed: 2014-11-03 12:17:35 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2014:1686 0 normal SHIPPED_LIVE Moderate: openstack-neutron security and bug fix update 2014-10-22 21:21:18 UTC
Red Hat Product Errata RHSA-2014:1785 0 normal SHIPPED_LIVE Moderate: openstack-neutron security, bug fix, and enhancement update 2014-11-03 13:36:40 UTC
Red Hat Product Errata RHSA-2014:1786 0 normal SHIPPED_LIVE Moderate: openstack-neutron security, bug fix, and enhancement update 2014-11-03 13:36:33 UTC

Description Murray McAllister 2014-09-16 02:41:31 UTC 
The OpenStack project reports:

""
Title: Admin-only network attributes may be reset to defaults by
non-privileged users
Reporter: Elena Ezhova (Mirantis)
Products: Neutron
Versions: up to 2013.2.4 and 2014.1 versions up to 2014.1.2

Description:
Elena Ezhova from Mirantis reported a vulnerability in Neutron. By updating
a network attribute with a default value a non-privileged user may reset
admin-only network attributes. This may lead to unexpected behavior with
security implications for operators with a custom policy.json, or in some
extreme cases network outages resulting in denial of service. All
deployments using neutron networking are affected by this flaw.
""

References:

http://seclists.org/oss-sec/2014/q3/602
https://bugs.launchpad.net/neutron/+bug/1357379
https://review.openstack.org/#/c/114531/
Comment 3 Murray McAllister 2014-09-16 02:43:17 UTC 
Created openstack-neutron tracking bugs for this issue:

Affects: fedora-20 [bug 1142013]
Comment 6 Ihar Hrachyshka 2014-09-26 08:13:02 UTC 
I've already backported the fix to RDO Havana, so there should be no issues with that. So please create trackers. Also, the earlier we handle the issue, the better.
Comment 9 Garth Mollett 2014-09-28 01:12:52 UTC 
(In reply to Ihar Hrachyshka from comment #6)
> I've already backported the fix to RDO Havana, so there should be no issues
> with that. So please create trackers. Also, the earlier we handle the issue,
> the better.

Great, thanks Ihar.
Comment 10 Fedora Update System 2014-10-10 15:56:56 UTC 
openstack-neutron-2013.2.4-4.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 11 Martin Prpič 2014-10-20 11:50:05 UTC 
IssueDescription:

It was discovered that unprivileged users could in some cases reset admin-only network attributes to their default values. This could lead to unexpected behavior or in some cases result in a denial of service.
Comment 12 errata-xmlrpc 2014-10-22 17:23:30 UTC 
This issue has been addressed in the following products:

  OpenStack 4 for RHEL 6

Via RHSA-2014:1686 https://rhn.redhat.com/errata/RHSA-2014-1686.html
Comment 13 errata-xmlrpc 2014-11-03 08:38:56 UTC 
This issue has been addressed in the following products:

  OpenStack 5 for RHEL 7

Via RHSA-2014:1786 https://rhn.redhat.com/errata/RHSA-2014-1786.html
Comment 14 errata-xmlrpc 2014-11-03 08:40:22 UTC 
This issue has been addressed in the following products:

  OpenStack 5 for RHEL 6

Via RHSA-2014:1785 https://rhn.redhat.com/errata/RHSA-2014-1785.html
Note You need to log in before you can comment on or make changes to this bug.