23 January 2014
Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2014.0091 Moderate: openstack-heat security, bug fix, and enhancement update 23 January 2014 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: openstack-heat Publisher: Red Hat Operating System: Red Hat Linux variants Impact/Access: Increased Privileges -- Existing Account Modify Arbitrary Files -- Existing Account Create Arbitrary Files -- Existing Account Resolution: Patch/Upgrade CVE Names: CVE-2013-6428 CVE-2013-6426 Original Bulletin: https://rhn.redhat.com/errata/RHSA-2014-0090.html Comment: This advisory references vulnerabilities in products which run on platforms other than Red Hat. It is recommended that administrators running openstack-heat check for an updated version of the software for their operating system. - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: openstack-heat security, bug fix, and enhancement update Advisory ID: RHSA-2014:0090-01 Product: Red Hat OpenStack Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-0090.html Issue date: 2014-01-22 CVE Names: CVE-2013-6426 CVE-2013-6428 ===================================================================== 1. Summary: Updated openstack-heat packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux OpenStack Platform 4.0. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: OpenStack 4 - noarch 3. Description: The openstack-heat packages provide heat, a Python implementation of the OpenStack Orchestration engine, to launch multiple composite cloud applications based on templates. It was found that heat did not properly enforce cloudformation-compatible API policy rules. An in-instance attacker could use the CreateStack or UpdateStack methods to create or update a stack, resulting in a violation of the API policy. Note that only setups using Orchestration's cloudformation-compatible API were affected. (CVE-2013-6426) A flaw was found in the way Orchestration's REST API implementation handled modified request paths. An authenticated remote user could use this flaw to bypass the tenant-scoping restriction by modifying the request path, resulting in privilege escalation. Note that only setups using Orchestration's cloudformation-compatible API were affected. (CVE-2013-6428) Red Hat would like to thank Jeremy Stanley of the OpenStack Project for reporting these issues. Upstream acknowledges Steven Hardy of Red Hat as the original reporter. The openstack-heat packages have been upgraded to upstream version 2013.2.1, which provides a number of bug fixes and enhancements over the previous version. The most notable fixes and enhancements are: * Auto-scaling has been fixed when AdjustmentType was set to PercentChangeInCapacity. * A QPID broker restart no longer permanently disrupts subscribed clients. * RPC requests are now only serviced by one server in a given topic group. * Auto-scaling group growth or shrinkage has been fixed to utilize the full available size, regardless of the scaling policy adjustment. (BZ#1045430) This update also fixes the following bugs: * The outdated heat-db-setup tool, which only supported local installs, has been removed. The Red Hat Enterprise Linux OpenStack Platform 4 Installation and Configuration Guide has been updated to show how to create the necessary database and associated tables for Orchestration, allowing the deployment of the database server on a local or remote system (see Installing the OpenStack Orchestration Service). (BZ#1046326) * The heat-engine source code had a hard-coded reference to a Fedora image name in the implementation of the AWS-compatible LoadBalancer resource. This meant that you could not specify an alternative LoadBalancer image name in deployments (for example, Red Hat Enterprise Linux). A new option has been added to the Orchestration configuration file, /etc/heat/heat.conf, which is named loadbalancer_template. The new loadbalancer_template option can now be used to specify an alternate LoadBalancer template that contains a different image name. (BZ#1048215) * Due to a packaging error, the heat-manage tool was not working properly (which prohibited a successful database creation). This error has been fixed by moving the parallel package selection code so that all Orchestration tools now use the proper packages for use at runtime. (BZ#1048335) All openstack-heat users are advised to upgrade to these updated packages, which correct these issues and add these enhancements. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 Documentation for releases of Red Hat Enterprise Linux OpenStack Platform is available at https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux_OpenStack_Platform/ 5. Bugs fixed (https://bugzilla.redhat.com/): 1039141 - CVE-2013-6426 OpenStack Heat: CFN policy rules not all enforced 1039144 - CVE-2013-6428 OpenStack Heat: ReST API doesn't respect tenant scoping 1046326 - remove heat-db-setup from openstack-heat packaging 1048335 - heat-manage doesn't work on EL 6. Package List: OpenStack 4: Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/RHOS/SRPMS/openstack-heat-2013.2.1-4.el6ost.src.rpm noarch: openstack-heat-api-2013.2.1-4.el6ost.noarch.rpm openstack-heat-api-cfn-2013.2.1-4.el6ost.noarch.rpm openstack-heat-api-cloudwatch-2013.2.1-4.el6ost.noarch.rpm openstack-heat-common-2013.2.1-4.el6ost.noarch.rpm openstack-heat-engine-2013.2.1-4.el6ost.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2013-6426.html https://www.redhat.com/security/data/cve/CVE-2013-6428.html https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux_OpenStack_Platform/ 8. Contact: The Red Hat security contact is <firstname.lastname@example.org>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFS4BA4XlSAg2UNWIIRAlGlAJ9QjRKqFby9CXkYiulBoGfsoJ2HNwCgoGeq pD/FnCr48t8vlgZB9GOXe2A= =j0il - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to email@example.com and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: firstname.lastname@example.org Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBUuCKKRLndAQH1ShLAQINihAAi/0lVvLQ9CQatU2FstfuJWVh5fM7xquj KNyxSArMCBZbS3NEvjH1lYK+jawSqeZ8fpPm6j2lDLEtRqkqOl9Gust0NRfhtknA 1YwqU2qnKxBcHyiiDDW/GtsunIo0ca8hjs3HONwK/Ug0OVJJuWJvbb/iX6yvQNLY NfxYsMYtdA1XDVtM9ZX+OBVDW440cmeNJC/dEPKPnTz+hwRUzJ5/yOSTZt7OGJlk OYhnYe6lPkdnMXMjVf5RKKN1Kv9e79KT2CmEZIwAGRNB9KkSjm2QHi4LhamO5a2z FFqZu5Ay38G0vID6c0UdQFFk0CzGl3Adhuk0CYMBKpfea3ts/9YAjAYIdWiEK7sp x2+2yF+n00J1vQ/qwCYmo+fbWE0w2dBFLumsuU/e4dSUIokDtbX8/QGXiADQuyFe xtsAborq1aw4SXCEKclzPpi24jaJc5J8PaKCGBk3UDrzp/6ZL+/g9ux0JVy52ZFe gEJSDnEeTJcKnrF5nF7XYy0GqgJPA5lowIL2KQa9gamS4MepqtH/KmGAjP+/q+hY PGqspOm6t8ub/RGeN7SIcOyiy7zQfrONWWHVGlaHDKiQ/l4bdpgLVwxRDA0uOVds 4XuBxS4m6AIwmJH+s4UAb/1IwY1D2I3uZWnUPPlz7u3qFydENEPTaIBVMRoSEofZ i1sY06/B6GQ= =ksuh -----END PGP SIGNATURE-----