full-disclosure - [CVE-2012-5616] Apache CloudStack information disclosure vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <969BB38B-17E3-45BC-AAEF-B545BB432A20@thrashyour.com>
Date: Thu, 10 Jan 2013 09:01:55 -0800
From: John Kinsella <jlk@...ashyour.com>
To: full-disclosure@...ts.grok.org.uk
Subject: [CVE-2012-5616] Apache CloudStack information
	disclosure vulnerability

CVE-2012-5616: Apache CloudStack information disclosure vulnerability

Severity:
Low

CVSS:
3.5, AV:L,AC,H,Au,S,C:P,I:P,A:P

Vendors:
The Apache Software Foundation

Versions Affected:
Apache CloudStack 4.0.0-incubating

Description:
The CloudStack security team was notified of a information disclosure
vulnerability that exists in Apache CloudStack-4.0.0-incubating.
With this vulnerability, when a user calls the createSSHKeyPair API
command to create an SSH key pair to be used when authenticating 
to a user VM, the freshly generated SSH private key is rendered in
a log file at INFO level on the CloudStack "master" server as well
as being returned to the caller. 

While remediating this issue, it was also discovered that the AddHost
API call will log the password of the added host, and DeployVM and 
ResetPasswordForVM will log the password of the VM for VMs that 
take support password management by CloudStack.

To leverage these vulnerabilities, a malicious user would require read
access to logs on the management server, or another location where
those logs are stored (e.g. centralized logging, backup server)

Mitigation:
On the CloudStack management server, modify /etc/cloud/management/log4j.conf
so the CONSOLE and APISERVER appender logs with a Threshold of "WARN" or higher.

We will be addressing this in the upcoming release of Apache
CloudStack 4.1.0-incubating.

Credit:
This issue was identified by Ahmad Emneina of Citrix.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/