bugtraq - [CVE-2012-4501] CloudStack configuration vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 9 Oct 2012 22:50:24 -0700
From: John Kinsella <jlk@...ashyour.com>
To: "bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>
Subject: [CVE-2012-4501] CloudStack configuration vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

CVE-2012-4501: Apache CloudStack configuration vulnerability

Severity: Critical

Vendors:
The Apache Software Foundation
Citrix, Inc.

Versions Affected:
As no official releases have been made, this does not affect any
official Apache CloudStack releases.

Anybody using a version of CloudStack generated from the Apache
CloudStack source tree prior to October 7th, 2012 will need to take
the actions specified below. Please note this includes both Citrix
CloudStack commercial and open-source, pre-ASF versions.

Description:
The CloudStack PPMC was notified of a configuration vulnerability that
exists in development versions of the Apache Incubated CloudStack
project. This vulnerability allows a malicious user to execute
arbitrary CloudStack API calls. A malicious user could, for example,
delete all VMs in the system.

Addressing this issue is especially important for anybody using
CloudStack in a public environment.

Mitigation:
1) Login to the CloudStack Database via MySQL
$ mysql -u cloud -p -h host-ip-address
(enter password as prompted)

2) Disable the system user and set a random password:
mysql> update cloud.user set password=RAND() where id=1;

3) Exit MySQL
mysql> \q

Alternatively, users can update to a version of CloudStack based on
the git repository on or after October 7th, 2012.

Credit:
This issue was identified by Hugo Trippaers of Schuberg Philis.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/

iQIcBAEBCgAGBQJQcebmAAoJEOom9N0pCN7SdZwQAKd82/zTgWAMibLYhgnsiKDo
hJ/O0kNxP3MUGN5L131K61titfZ9se37z2dmBpBEYKc5X3jHkbnG+o7vPSyD9Bc6
+UzddIkkUy/eXZSNuFXdth+GTFKuCBhbMpWzRYYzXLU+v6G8YqwdZGdUyNTp8oi1
MnQ/2KvLCAi5hiG1YeZCXnNdDyv2fLGW6phbS5UTsG8OLUDZe2Ycerjw+zl88BCi
MhgHpBwOti8mikTrodEWG5lSlIksVOHnLPA2Ycz4QSGnqK6VhyCfQWNJeMq+/TGK
JYc30c0DiUsCDjXCsymxWyEmK9ePFWxOLzvFYYRA/Iuhg9J89ADvHr1JM8QEoFGV
cOt1YLV+zTKuUhxCx0nHTVUxBS9A2Giez3GyPQ+WmW7ph2erC7GL7oKdLtdgJBBc
odlf8F+0xREQocqi85t9v65PDXRjOdmAfaGwogzibIA9sweDlefhMTzCgSsAtIKF
+hkHqZD2oRP4YxQ05vp8CSXBf4UCVx7169nSu9GA3HjllsXNqyhY0h1hjkZkBcd1
To5Rfd0bVNNoxMyfdCA9sd5fQZ1XTivwRpBGkEWJirxM7Z7hFddDQdqebeeBExk/
yE+geeNcK2RMl5Tqtzkbs9DeLnijJyRuU1xzRHQOsXLSp/RYaZlrEnd/UzxZ+9up
bvYem89raMxulY7lzngu
=+bQS
-----END PGP SIGNATURE-----