Hash: SHA1

             AUSCERT External Security Bulletin Redistribution

    Moderate: openstack-heat security, bug fix, and enhancement update
                              23 January 2014


        AusCERT Security Bulletin Summary

Product:           openstack-heat
Publisher:         Red Hat
Operating System:  Red Hat
                   Linux variants
Impact/Access:     Increased Privileges   -- Existing Account
                   Modify Arbitrary Files -- Existing Account
                   Create Arbitrary Files -- Existing Account
Resolution:        Patch/Upgrade
CVE Names:         CVE-2013-6428 CVE-2013-6426 

Original Bulletin: 

Comment: This advisory references vulnerabilities in products which run on 
         platforms other than Red Hat. It is recommended that administrators
         running openstack-heat check for an updated version of the software
         for their operating system.

- --------------------------BEGIN INCLUDED TEXT--------------------

Hash: SHA1

                   Red Hat Security Advisory

Synopsis:          Moderate: openstack-heat security, bug fix, and enhancement update
Advisory ID:       RHSA-2014:0090-01
Product:           Red Hat OpenStack
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2014-0090.html
Issue date:        2014-01-22
CVE Names:         CVE-2013-6426 CVE-2013-6428 

1. Summary:

Updated openstack-heat packages that fix two security issues, several bugs,
and add various enhancements are now available for Red Hat Enterprise Linux
OpenStack Platform 4.0.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

2. Relevant releases/architectures:

OpenStack 4 - noarch

3. Description:

The openstack-heat packages provide heat, a Python implementation of the
OpenStack Orchestration engine, to launch multiple composite cloud
applications based on templates.

It was found that heat did not properly enforce cloudformation-compatible
API policy rules. An in-instance attacker could use the CreateStack or
UpdateStack methods to create or update a stack, resulting in a violation
of the API policy. Note that only setups using Orchestration's
cloudformation-compatible API were affected. (CVE-2013-6426)

A flaw was found in the way Orchestration's REST API implementation handled
modified request paths. An authenticated remote user could use this flaw to
bypass the tenant-scoping restriction by modifying the request path,
resulting in privilege escalation. Note that only setups using
Orchestration's cloudformation-compatible API were affected.

Red Hat would like to thank Jeremy Stanley of the OpenStack Project for
reporting these issues. Upstream acknowledges Steven Hardy of Red Hat as
the original reporter.

The openstack-heat packages have been upgraded to upstream version
2013.2.1, which provides a number of bug fixes and enhancements over the
previous version. The most notable fixes and enhancements are:

* Auto-scaling has been fixed when AdjustmentType was set to

* A QPID broker restart no longer permanently disrupts subscribed clients.

* RPC requests are now only serviced by one server in a given topic group.

* Auto-scaling group growth or shrinkage has been fixed to utilize the full
  available size, regardless of the scaling policy adjustment.


This update also fixes the following bugs:

* The outdated heat-db-setup tool, which only supported local installs, has
been removed. The Red Hat Enterprise Linux OpenStack Platform 4
Installation and Configuration Guide has been updated to show how to create
the necessary database and associated tables for Orchestration, allowing
the deployment of the database server on a local or remote system (see
Installing the OpenStack Orchestration Service). (BZ#1046326)

* The heat-engine source code had a hard-coded reference to a Fedora image
name in the implementation of the AWS-compatible LoadBalancer resource.
This meant that you could not specify an alternative LoadBalancer image
name in deployments (for example, Red Hat Enterprise Linux). A new option
has been added to the Orchestration configuration file,
/etc/heat/heat.conf, which is named loadbalancer_template. The new
loadbalancer_template option can now be used to specify an alternate
LoadBalancer template that contains a different image name. (BZ#1048215)

* Due to a packaging error, the heat-manage tool was not working properly
(which prohibited a successful database creation). This error has been
fixed by moving the parallel package selection code so that all
Orchestration tools now use the proper packages for use at runtime.

All openstack-heat users are advised to upgrade to these updated packages,
which correct these issues and add these enhancements.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at

Documentation for releases of Red Hat Enterprise Linux OpenStack Platform
is available at

5. Bugs fixed (https://bugzilla.redhat.com/):

1039141 - CVE-2013-6426 OpenStack Heat: CFN policy rules not all enforced
1039144 - CVE-2013-6428 OpenStack Heat: ReST API doesn't respect tenant scoping
1046326 - remove heat-db-setup from openstack-heat packaging
1048335 - heat-manage doesn't work on EL

6. Package List:

OpenStack 4:



These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from

7. References:


8. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2014 Red Hat, Inc.
Version: GnuPG v1.4.4 (GNU/Linux)


- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:


Australian Computer Emergency Response Team
The University of Queensland
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
Comment: http://www.auscert.org.au/render.html?it=1967