Date: Tue, 8 Sep 2015 23:42:49 +0000 From: Tristan Cacqueray <tdecacqu@...hat.com> To: oss-security@...ts.openwall.com Subject: [OSSA 2015-018] Neutron firewall rules bypass through port update (CVE-2015-5240) ================================================================ OSSA-2015-018: Neutron firewall rules bypass through port update ================================================================ :Date: September 08, 2015 :CVE: CVE-2015-5240 Affects ~~~~~~~ - Neutron: versions through 2014.2.3 and 2015.1 versions through 2015.1.1 Description ~~~~~~~~~~~ Kevin Benton from Mirantis reported a vulnerability in Neutron. By changing the device owner of an instance's port right after it is created, an authenticated user may prevent application of firewall rules and so avoid IP anti-spoofing controls. All Neutron setups using the ML2 plugin or a plugin that relies on the security groups AMQP API are affected. Patches ~~~~~~~ - https://review.openstack.org/221345 (Juno) - https://review.openstack.org/221344 (Kilo) - https://review.openstack.org/221342 (Liberty) Credits ~~~~~~~ - Kevin Benton from Mirantis (CVE-2015-5240) References ~~~~~~~~~~ - https://launchpad.net/bugs/1489111 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5240 Notes ~~~~~ - This fix will be included in future 2014.2.4 (juno) and 2015.1.2 (kilo) releases. -- Tristan Cacqueray OpenStack Vulnerability Management Team Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ