CVE-2012-2654

CVSS V2 Medium 4.3 CVSS V3 None

Description

The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not properly check the protocol when security groups are created and the network protocol is not specified entirely in lowercase, which allows remote attackers to bypass intended access restrictions.

Overview

CVE ID
CVE-2012-2654

Assigner
secalert@redhat.com

Vulnerability Status
Modified

Published Version
2012-06-21T15:55:12

Last Modified Date
2017-08-29T01:31:38

Weakness Enumerations

CWE	URL
CWE-20	http://cwe.mitre.org/data/definitions/20.html

CPE Configuration (Product)

CPE	Vulnerable	Operator
cpe:2.3:a:openstack:compute:2012.2:::::::*	1	OR
cpe:2.3:a:openstack:diablo:2011.3:::::::*	1	OR
cpe:2.3:a:openstack:essex:2012.1:::::::*	1	OR

CVSS Version 2

Version
2.0

Vector String
AV:N/AC:M/Au:N/C:N/I:P/A:N

Access Vector
NETWORK

Access Compatibility
MEDIUM

Authentication
NONE

Confidentiality Impact
NONE

Integrity Impact
PARTIAL

Availability Impact
NONE

Base Score
4.3

Severity
MEDIUM

Exploitability Score
8.6

Impact Score
2.9

References

Reference URL	Reference Tags
https://review.openstack.org/#/c/8239/
https://github.com/openstack/nova/commit/9f9e9da777161426a6f8cb4314b78e09beac2978	Exploit Patch
https://github.com/openstack/nova/commit/ff06c7c885dc94ed7c828e8cdbb8b5d850a7e654	Exploit Patch
https://lists.launchpad.net/openstack/msg12883.html
http://www.ubuntu.com/usn/USN-1466-1
https://bugs.launchpad.net/nova/+bug/985184	Patch
http://secunia.com/advisories/49439	Vendor Advisory
http://secunia.com/advisories/46808	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/76110

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2012-2654
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2654

History

Created	Old Value	New Value	Data Type	Notes
2022-05-10 08:49:44				Added to TrackCVE