========================================================================== Ubuntu Security Notice USN-1831-1 May 16, 2013 nova vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 13.04 - Ubuntu 12.10 - Ubuntu 12.04 LTS Summary: Nova could be made to crash the system if instances used a specially crafted image. Software Description: - nova: OpenStack Compute cloud infrastructure Details: Loganathan Parthipan discovered that Nova did not verify the size of QCOW2 instance storage. An authenticated attacker could exploit this to cause a denial of service by creating an image with a large virtual size with little data, then filling the virtual disk. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 13.04: python-nova 1:2013.1-0ubuntu2.1 Ubuntu 12.10: python-nova 2012.2.3-0ubuntu2.1 Ubuntu 12.04 LTS: python-nova 2012.1.3+stable-20130423-e52e6912-0ubuntu1.1 In general, a standard system update will make all the necessary changes. References: http://www.ubuntu.com/usn/usn-1831-1 CVE-2013-2096 Package Information: https://launchpad.net/ubuntu/+source/nova/1:2013.1-0ubuntu2.1 https://launchpad.net/ubuntu/+source/nova/2012.2.3-0ubuntu2.1 https://launchpad.net/ubuntu/+source/nova/2012.1.3+stable-20130423-e52e6912-0ubuntu1.1