[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 17 Jan 2014 10:52:39 +0100
From: Thierry Carrez <thierry@...nstack.org>
To: Open Source Security <oss-security@...ts.openwall.com>
Subject: [OSSA 2014-002] Swift TempURL timing attack (CVE-2014-0006)
OpenStack Security Advisory: 2014-002
CVE: CVE-2014-0006
Date: January 16, 2013
Title: Swift TempURL timing attack
Reporter: Samuel Merritt (SwiftStack)
Products: Swift
Affects: All supported versions
Description:
Samuel Merritt from SwiftStack reported a timing attack vulnerability in
Swift TempURL middleware. By analyzing response times to arbitrary
TempURL requests, an attacker may be able to guess valid secret URLs and
get access to objects that were only intended to be publicly shared with
specific recipients. In order to use this attack, the attacker needs to
know the targeted object name, and the object account needs to have a
TempURL key set. Only Swift setups enabling the TempURL middleware are
affected.
Icehouse (development branch) fix:
https://review.openstack.org/#/c/67185/
Havana (1.10.0) fix:
https://review.openstack.org/#/c/67186/
Grizzly (1.8.0) fix:
https://review.openstack.org/#/c/67187/
Note: the Icehouse fix will be included in upcoming 1.12.0 release.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0006
https://bugs.launchpad.net/swift/+bug/1265665
Regards,
--
Thierry Carrez
OpenStack Vulnerability Management Team
Download attachment "signature.asc" of type "application/pgp-signature" (902 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
