Ubuntu Security Notice 2105-1 - James Troup discovered that MAAS stored RabbitMQ authentication credentials in a world-readable file. A local authenticated user could read this password and potentially gain privileges of other user accounts. This update restricts the file permissions to prevent unintended access. Chris Glass discovered that the MAAS API was vulnerable to cross-site scripting vulnerabilities. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. Various other issues were also addressed.
b3b580b276826bc153e8f810e4aa0d9ddaf93bffecd797cccea9a87b941157b3
Content-Disposition: inline
==========================================================================Ubuntu Security Notice USN-2105-1
February 13, 2014
maas vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 13.10
- Ubuntu 12.10
- Ubuntu 12.04 LTS
Summary:
The cluster could be made to run programs as an administrator.
Software Description:
- maas: Ubuntu MAAS Server
Details:
James Troup discovered that MAAS stored RabbitMQ authentication
credentials in a world-readable file. A local authenticated user
could read this password and potentially gain privileges of other
user accounts. This update restricts the file permissions to prevent
unintended access. (CVE-2013-1070)
Chris Glass discovered that the MAAS API was vulnerable to cross-site
scripting vulnerabilities. With cross-site scripting vulnerabilities,
if a user were tricked into viewing a specially crafted page, a remote
attacker could exploit this to modify the contents, or steal confidential
data, within the same domain. (CVE-2013-1069)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 13.10:
maas-region-controller 1.4+bzr1693+dfsg-0ubuntu2.3
python-django-maas 1.4+bzr1693+dfsg-0ubuntu2.3
Ubuntu 12.10:
maas-region-controller 1.2+bzr1373+dfsg-0ubuntu1.2
python-django-maas 1.2+bzr1373+dfsg-0ubuntu1.2
Ubuntu 12.04 LTS:
maas-region-controller 1.2+bzr1373+dfsg-0ubuntu1~12.04.5
python-django-maas 1.2+bzr1373+dfsg-0ubuntu1~12.04.5
After a standard system update you need to restart apache2 to make all
the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2105-1
CVE-2013-1069, CVE-2013-1070
Package Information:
https://launchpad.net/ubuntu/+source/maas/1.4+bzr1693+dfsg-0ubuntu2.3
https://launchpad.net/ubuntu/+source/maas/1.2+bzr1373+dfsg-0ubuntu1.2
https://launchpad.net/ubuntu/+source/maas/1.2+bzr1373+dfsg-0ubuntu1~12.04.5