Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2014.0091
Moderate: openstack-heat security, bug fix, and enhancement update
23 January 2014
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: openstack-heat
Publisher: Red Hat
Operating System: Red Hat
Linux variants
Impact/Access: Increased Privileges -- Existing Account
Modify Arbitrary Files -- Existing Account
Create Arbitrary Files -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2013-6428 CVE-2013-6426
Original Bulletin:
https://rhn.redhat.com/errata/RHSA-2014-0090.html
Comment: This advisory references vulnerabilities in products which run on
platforms other than Red Hat. It is recommended that administrators
running openstack-heat check for an updated version of the software
for their operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: openstack-heat security, bug fix, and enhancement update
Advisory ID: RHSA-2014:0090-01
Product: Red Hat OpenStack
Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-0090.html
Issue date: 2014-01-22
CVE Names: CVE-2013-6426 CVE-2013-6428
=====================================================================
1. Summary:
Updated openstack-heat packages that fix two security issues, several bugs,
and add various enhancements are now available for Red Hat Enterprise Linux
OpenStack Platform 4.0.
The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
2. Relevant releases/architectures:
OpenStack 4 - noarch
3. Description:
The openstack-heat packages provide heat, a Python implementation of the
OpenStack Orchestration engine, to launch multiple composite cloud
applications based on templates.
It was found that heat did not properly enforce cloudformation-compatible
API policy rules. An in-instance attacker could use the CreateStack or
UpdateStack methods to create or update a stack, resulting in a violation
of the API policy. Note that only setups using Orchestration's
cloudformation-compatible API were affected. (CVE-2013-6426)
A flaw was found in the way Orchestration's REST API implementation handled
modified request paths. An authenticated remote user could use this flaw to
bypass the tenant-scoping restriction by modifying the request path,
resulting in privilege escalation. Note that only setups using
Orchestration's cloudformation-compatible API were affected.
(CVE-2013-6428)
Red Hat would like to thank Jeremy Stanley of the OpenStack Project for
reporting these issues. Upstream acknowledges Steven Hardy of Red Hat as
the original reporter.
The openstack-heat packages have been upgraded to upstream version
2013.2.1, which provides a number of bug fixes and enhancements over the
previous version. The most notable fixes and enhancements are:
* Auto-scaling has been fixed when AdjustmentType was set to
PercentChangeInCapacity.
* A QPID broker restart no longer permanently disrupts subscribed clients.
* RPC requests are now only serviced by one server in a given topic group.
* Auto-scaling group growth or shrinkage has been fixed to utilize the full
available size, regardless of the scaling policy adjustment.
(BZ#1045430)
This update also fixes the following bugs:
* The outdated heat-db-setup tool, which only supported local installs, has
been removed. The Red Hat Enterprise Linux OpenStack Platform 4
Installation and Configuration Guide has been updated to show how to create
the necessary database and associated tables for Orchestration, allowing
the deployment of the database server on a local or remote system (see
Installing the OpenStack Orchestration Service). (BZ#1046326)
* The heat-engine source code had a hard-coded reference to a Fedora image
name in the implementation of the AWS-compatible LoadBalancer resource.
This meant that you could not specify an alternative LoadBalancer image
name in deployments (for example, Red Hat Enterprise Linux). A new option
has been added to the Orchestration configuration file,
/etc/heat/heat.conf, which is named loadbalancer_template. The new
loadbalancer_template option can now be used to specify an alternate
LoadBalancer template that contains a different image name. (BZ#1048215)
* Due to a packaging error, the heat-manage tool was not working properly
(which prohibited a successful database creation). This error has been
fixed by moving the parallel package selection code so that all
Orchestration tools now use the proper packages for use at runtime.
(BZ#1048335)
All openstack-heat users are advised to upgrade to these updated packages,
which correct these issues and add these enhancements.
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Documentation for releases of Red Hat Enterprise Linux OpenStack Platform
is available at
https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux_OpenStack_Platform/
5. Bugs fixed (https://bugzilla.redhat.com/):
1039141 - CVE-2013-6426 OpenStack Heat: CFN policy rules not all enforced
1039144 - CVE-2013-6428 OpenStack Heat: ReST API doesn't respect tenant scoping
1046326 - remove heat-db-setup from openstack-heat packaging
1048335 - heat-manage doesn't work on EL
6. Package List:
OpenStack 4:
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/RHOS/SRPMS/openstack-heat-2013.2.1-4.el6ost.src.rpm
noarch:
openstack-heat-api-2013.2.1-4.el6ost.noarch.rpm
openstack-heat-api-cfn-2013.2.1-4.el6ost.noarch.rpm
openstack-heat-api-cloudwatch-2013.2.1-4.el6ost.noarch.rpm
openstack-heat-common-2013.2.1-4.el6ost.noarch.rpm
openstack-heat-engine-2013.2.1-4.el6ost.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package
7. References:
https://www.redhat.com/security/data/cve/CVE-2013-6426.html
https://www.redhat.com/security/data/cve/CVE-2013-6428.html
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux_OpenStack_Platform/
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2014 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFS4BA4XlSAg2UNWIIRAlGlAJ9QjRKqFby9CXkYiulBoGfsoJ2HNwCgoGeq
pD/FnCr48t8vlgZB9GOXe2A=
=j0il
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBUuCKKRLndAQH1ShLAQINihAAi/0lVvLQ9CQatU2FstfuJWVh5fM7xquj
KNyxSArMCBZbS3NEvjH1lYK+jawSqeZ8fpPm6j2lDLEtRqkqOl9Gust0NRfhtknA
1YwqU2qnKxBcHyiiDDW/GtsunIo0ca8hjs3HONwK/Ug0OVJJuWJvbb/iX6yvQNLY
NfxYsMYtdA1XDVtM9ZX+OBVDW440cmeNJC/dEPKPnTz+hwRUzJ5/yOSTZt7OGJlk
OYhnYe6lPkdnMXMjVf5RKKN1Kv9e79KT2CmEZIwAGRNB9KkSjm2QHi4LhamO5a2z
FFqZu5Ay38G0vID6c0UdQFFk0CzGl3Adhuk0CYMBKpfea3ts/9YAjAYIdWiEK7sp
x2+2yF+n00J1vQ/qwCYmo+fbWE0w2dBFLumsuU/e4dSUIokDtbX8/QGXiADQuyFe
xtsAborq1aw4SXCEKclzPpi24jaJc5J8PaKCGBk3UDrzp/6ZL+/g9ux0JVy52ZFe
gEJSDnEeTJcKnrF5nF7XYy0GqgJPA5lowIL2KQa9gamS4MepqtH/KmGAjP+/q+hY
PGqspOm6t8ub/RGeN7SIcOyiy7zQfrONWWHVGlaHDKiQ/l4bdpgLVwxRDA0uOVds
4XuBxS4m6AIwmJH+s4UAb/1IwY1D2I3uZWnUPPlz7u3qFydENEPTaIBVMRoSEofZ
i1sY06/B6GQ=
=ksuh
-----END PGP SIGNATURE-----