CVE-2012-3426

Related Files

Ubuntu Security Notice USN-1552-1

Posted Sep 4, 2012

Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1552-1 - Dolph Mathews discovered that OpenStack Keystone did not properly restrict to administrative users the ability to update users' tenants. A remote attacker that can reach the administrative API can use this to add any user to any tenant. Derek Higgins discovered that OpenStack Keystone did not properly implement token expiration. A remote attacker could use this to continue to access an account that has been disabled or has a changed password. Various other issues were also addressed.

tags | advisory, remote

systems | linux, ubuntu

advisories | CVE-2012-3542, CVE-2012-3426, CVE-2012-3426, CVE-2012-3542

SHA-256 | 59149cce4d114cf139fd83ef482149eeb779aa9502a7314825844647a6c6e931

Download | Favorite | View