CVE-2013-0335

Summary

OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access to a VM in opportunistic circumstances by using the VNC token for a deleted VM that was bound to the same VNC port.

Affected Software

Weaknesses

• CWE-613: Insufficient Session Expiration

Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

ADP Enrichment

CVE Program Container

Additional References

• http://www.osvdb.org/90657
• http://secunia.com/advisories/52728
• https://bugs.launchpad.net/nova/+bug/1125378
• http://www.openwall.com/lists/oss-security/2013/02/26/7
• https://review.openstack.org/#/c/22872/
• http://www.ubuntu.com/usn/USN-1771-1
• https://review.openstack.org/#/c/22758
• http://rhn.redhat.com/errata/RHSA-2013-0709.html
• http://secunia.com/advisories/52337
• https://review.openstack.org/#/c/22086/

References

• http://rhn.redhat.com/errata/RHSA-2013-0709.html
• http://secunia.com/advisories/52337
• http://secunia.com/advisories/52728
• http://www.openwall.com/lists/oss-security/2013/02/26/7
• http://www.osvdb.org/90657
• http://www.ubuntu.com/usn/USN-1771-1
• https://access.redhat.com/errata/RHSA-2013:0709
• https://access.redhat.com/security/cve/CVE-2013-0335
• https://bugs.launchpad.net/nova/+bug/1125378
• https://github.com/advisories/GHSA-qfp8-hfqx-c79c
• https://review.openstack.org/#/c/22086/
• https://review.openstack.org/#/c/22758
• https://review.openstack.org/#/c/22872/

• ←Previous
• Next→