CVE-2013-6437

Related Files

Red Hat Security Advisory 2014-0231-01

Posted Mar 4, 2014

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-0231-01 - OpenStack Compute launches and schedules large networks of virtual machines, creating a redundant and scalable cloud computing platform. Compute provides the software, control panels, and APIs required to orchestrate a cloud, including running virtual machine instances, managing networks, and controlling access through users and projects. It was discovered that the metadata agent in OpenStack Networking was missing an authorization check on the device ID that is bound to a specific port. A remote tenant could guess the instance ID bound to a port and retrieve metadata of another tenant, resulting in information disclosure. Note that only OpenStack Networking setups running neutron-metadata-agent were affected.

tags | advisory, remote, info disclosure

systems | linux, redhat

advisories | CVE-2013-6419, CVE-2013-6437, CVE-2013-7048, CVE-2013-7130

SHA-256 | 5df7a83b8fe26fa0470a7d38af7acc1ed469562d7c88efd074564fedb66f3947

Download | Favorite | View