lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAKprHVbg2=HZiKmTc1gpRJQtDb4tdUSJ38YAveaKhPcmLC6Pmg@mail.gmail.com> Date: Fri, 10 Jan 2014 09:01:31 -0500 From: David Nalley <ke4qqq@...che.org> To: "security@...udstack.apache.org" <security@...udstack.apache.org>, security <security@...che.org>, full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com, announce@...udstack.apache.org Subject: Updated [CVE-2013-6398] CloudStack Virtual Router stop/start modifies firewall rules allowing additional access Issued: November 27, 2013 Updated: January 10, 2014 [CVE-2013-6398] CloudStack Virtual Router stop/start modifies firewall rules allowing additional access Product: Apache CloudStack Vendor: Apache Software Foundation Vulnerability type: Bypass Vulnerable Versions: Apache CloudStack 4.1.0, 4.1.1, 4.2.0 CVE References: CVE-2013-2136 Risk Level: Low CVSSv2 Base Scores: 2.8 (AV:N/AC:M/Au:M/C:P/I:N/A:N) Description: The Apache CloudStack Security Team was notified of a an issue in the Apache CloudStack virtual router that failed to preserve source restrictions in firewall rules after a virtual router had been stopped and restarted. Mitigation: Upgrading to CloudStack 4.2.1 or higher will mitigate this issue. References: https://issues.apache.org/jira/browse/CLOUDSTACK-5263 Credit: This issue was identified by the Cloud team and Schuberg Philis _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists