Published: 08/05/2014 Updated: 21/06/2014

CVSS v2 Base Score: 3.5 | Impact Score: 2.9 | Exploitability Score: 6.8

VMScore: 312

Vector: AV:N/AC:M/Au:S/C:P/I:N/A:N

The instance rescue mode in OpenStack Compute (Nova) 2013.2 prior to 2013.2.3 and Icehouse prior to 2014.1, when using libvirt to spawn images and use_cow_images is set to false, allows remote authenticated users to read certain compute host files by overwriting an instance disk with a crafted image.

Vulnerable Product	Search on Vulmon	Subscribe to Product
openstack compute 2013.2
openstack compute 2013.2.1
openstack compute 2013.2.2

Several security issues were fixed in OpenStack Nova ...

Debian Bug report logs - #742712 CVE-2014-0134: Nova host data leak to vm instance in rescue mode Package: src:nova; Maintainer for src:nova is Debian OpenStack <team+openstack@trackerdebianorg>; Reported by: Thomas Goirand <zigo@debianorg> Date: Wed, 26 Mar 2014 15:30:01 UTC Severity: important Tags: security Fo ...

Debian Bug report logs - #744051 CVE-2014-0167: RBAC policy not properly enforced in Nova EC2 API Package: src:nova; Maintainer for src:nova is Debian OpenStack <team+openstack@trackerdebianorg>; Reported by: Thomas Goirand <zigo@debianorg> Date: Wed, 9 Apr 2014 16:03:01 UTC Severity: important Tags: security, up ...

CWE-200 http://www.openwall.com/lists/oss-security/2014/03/27/6 https://bugs.launchpad.net/nova/+bug/1221190 http://www.ubuntu.com/usn/USN-2247-1 https://usn.ubuntu.com/2247-1/https://nvd.nist.gov

CVE-2014-0134

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect