bugtraq - [oCERT 2015-012] Ganeti multiple issues

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20151230132918.GW4273@ns360119.ovh.net>
Date: Wed, 30 Dec 2015 14:29:18 +0100
From: Daniele Bianco <danbia@...rt.org>
To: oss-security@...ts.openwall.com, bugtraq@...urityfocus.com,
  ocert-announce@...ts.ocert.org
Subject: [oCERT 2015-012] Ganeti multiple issues

#2015-012 Ganeti multiple issues

Description:

Ganeti, an open source virtualization manager, suffers from multiple issues in
its RESTful control interface (RAPI).

The distributed replicated storage (DRBD) secret is leaked by the RAPI
interface when job results are requested. Leveraging on the knowledge of
this secret, a malicious user who had already gained access to the storage
network of the cluster can retrieve instance data more easily and reliably.

The RAPI interface is also vulnerable to a DoS condition, triggered via SSL
parameter renegotiation issued by a malicious client. The condition leads to
resource exhaustion on the master node.

Affected version:

Ganeti <=2.9.6, <=2.10.7, <=2.11.7, <=2.12.5, <=2.13.2, <=2.14.1, <=2.15.1

Fixed version:

Ganeti >=2.9.7, >=2.10.8, >=2.11.8, >=2.12.6, >=2.13.3, >=2.14.2, >=2.15.2

Credit: vulnerability reported by Pierre Kim <pierre [dot] kim [dot] sec [at] gmail [dot] com>.

CVE:

CVE-2015-7944 (DoS), CVE-2015-7945 (DRBD secret leak) 

Timeline:

2015-12-21: vulnerability report received
2015-12-24: contacted affected vendors
2015-12-30: advisory release

References:

http://downloads.ganeti.org/releases

Permalink:

http://www.ocert.org/advisories/ocert-2015-012.html

--
  Daniele Bianco      Open Source Computer Security Incident Response Team
  <danbia@...rt.org>                                  http://www.ocert.org

  GPG Key 0x9544A497
  GPG Key fingerprint = 88A7 43F4 F28F 1B9D 6F2D  4AC5 AE75 822E 9544 A497