what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

Files from Mathijs Schmittmann

Apache CloudStack 4.0.1 Authentication Bypass / Cryptography

Posted Apr 25, 2013

Authored by Wolfram Schlich, Mathijs Schmittmann

The CloudStack PMC was notified of two issues found in Apache CloudStack versions prior to 4.0.2. An attacker with knowledge of CloudStack source code could gain unauthorized access to the console of another tenant's VM. Insecure hash values may lead to information disclosure. URLs generated by Apache CloudStack to provide console access to virtual machines contained a hash of a predictable sequence, the hash of which was generated with a weak algorithm. While not easy to leverage, this may allow a malicious user to gain unauthorized console access.

tags | advisory, bypass, info disclosure

advisories | CVE-2013-2756, CVE-2013-2758

SHA-256 | 474f68a5ee05a485465b64d23eff7bcb693b5ef180963131a4b12caf5a15bc42

Download | Favorite | View