[openstack-announce] [OSSA 2014-011] RBAC policy not properly enforced in Nova EC2 API (CVE-2014-0167)

Tristan Cacqueray tristan.cacqueray at enovance.com
Wed Apr 9 18:27:44 UTC 2014


OpenStack Security Advisory: 2014-011
CVE: CVE-2014-0167
Date: April 09, 2014
Title: RBAC policy not properly enforced in Nova EC2 API
Reporter: Marc Heckmann (Ubisoft)
Products: Nova
Versions: from 2013.1 to 2013.2.3

Description:
Marc Heckmann from Ubisoft reported a vulnerability in the Nova EC2 API
security group implementation. RBAC policies are not enforced when using
the EC2 API, in particular the add_rules, remove_rules and destroy
methods. A restricted user may overcome his limitation by using EC2 API
resulting in unauthorized action on security groups. Only setups using
non-default RBAC rules for Nova may be affected.

Juno (development branch) fix:
https://review.openstack.org/86358

Icehouse (milestone-proposed branch) fix:
https://review.openstack.org/86360

Havana fix:
https://review.openstack.org/86361

Notes:
This fix will be included in the icehouse-rc2 development milestone and
in a future 2013.2.4 release.

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0167
https://launchpad.net/bugs/1290537

-- 
Tristan Cacqueray
OpenStack Vulnerability Management Team



-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 555 bytes
Desc: OpenPGP digital signature
URL: <http://lists.openstack.org/pipermail/openstack-announce/attachments/20140409/22c3e7c2/attachment.pgp>


More information about the OpenStack-announce mailing list