full-disclosure - Updated [CVE-2014-0031] CloudStack ListNetworkACL API discloses ACLs for other users

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAKprHVa_3sLEk8+J8BVA+BwMxmwsQ=9mu+1Z9xwJLrmyW0V7uw@mail.gmail.com>
Date: Fri, 10 Jan 2014 09:01:38 -0500
From: David Nalley <ke4qqq@...che.org>
To: "security@...udstack.apache.org" <security@...udstack.apache.org>,
 security <security@...che.org>, 
 full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com, 
 announce@...udstack.apache.org
Subject: Updated [CVE-2014-0031] CloudStack ListNetworkACL
 API discloses ACLs for other users

Issued: January 9, 2014
Updated: January 10, 2014

[CVE-2014-0031] CloudStack ListNetworkACL API discloses ACLs for other users

Product: Apache CloudStack
Vendor: Apache Software Foundation
Vulnerability type: Information Disclosure
Vulnerable Versions: Apache CloudStack 4.2.0
CVE References: CVE-2014-0031
Risk Level: Low
CVSSv2 Base Scores: 3.5  (AV:N/AC:M/Au:S/C:P/I:N/A:N)

Description:
The Apache CloudStack Security Team was notified of a an
issue in Apache CloudStack which permits an authenticated user to list
network ACLs for other users.

Mitigation:
Upgrading to CloudStack 4.2.1 or higher will mitigate this issue.

References:
https://issues.apache.org/jira/browse/CLOUDSTACK-5145

Credit:
This issue was identified by Marcus Sorensen

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/