Executive Summary

Summary
Title Nova regression
Informations
Name USN-1466-2 First vendor Publication 2012-06-12
Vendor Ubuntu Last vendor Modification 2012-06-12
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector :
Cvss Base Score Not Defined Attack Range Not Defined
Cvss Impact Score Not Defined Attack Complexity Not Defined
Cvss Expoit Score Not Defined Authentication Not Defined
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.04 LTS - Ubuntu 11.10

Summary:

USN 1466-1 introduced a regression in Nova.

Software Description: - nova: OpenStack Compute cloud infrastructure

Details:

USN 1466-1 fixed a vulnerability in Nova. The upstream patch introduced a regression when a security group granted full access and therefore the network protocol was left unset, causing an error in processing. This update fixes the issue.

We apologize for the inconvenience.

Original advisory details:

It was discovered that, when defining security groups in Nova using
the EC2 or OS APIs, specifying the network protocol (e.g. 'TCP') in
the incorrect case would cause the security group to not be applied
correctly. An attacker could use this to bypass Nova security group
restrictions.

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 12.04 LTS:
python-nova 2012.1-0ubuntu2.3

Ubuntu 11.10:
python-nova 2011.3-0ubuntu6.8

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1466-2
http://www.ubuntu.com/usn/usn-1466-1
https://bugs.launchpad.net/bugs/1010514

Package Information:
https://launchpad.net/ubuntu/+source/nova/2012.1-0ubuntu2.3
https://launchpad.net/ubuntu/+source/nova/2011.3-0ubuntu6.8

Original Source

Url : http://www.ubuntu.com/usn/USN-1466-2

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 12:00:13
  • Multiple Updates