Bug 459364 – <sys-cluster/nova-2012.2.3-r1: VNC proxy can connect to the wrong VM (CVE-2013-0335)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2013-02-26 21:19:23 UTC]

From ${URL} :

OpenStack Security Advisory: 2013-006
CVE: CVE-2013-0335
Date: February 26, 2013
Title: VNC proxy can connect to the wrong VM
Reporter: Loganathan Parthipan (HP), Rohit Karajgi (NTT Data)
Products: Nova
Affects: All versions

Description:
Loganathan Parthipan (HP) and Rohit Karajgi (NTT Data) independently
reported a vulnerability in Nova. If a user requests a console and
then deletes the VM, it is possible that the console token could allow
connectivity to a different VM before the console token expires if the
VNC port gets reused in that time period. This issue can be worked
around by disabling VNC support.

Fixes:
master (grizzly): https://review.openstack.org/#/c/22086/
stable/folsom: https://review.openstack.org/#/c/22758
stable/essex: https://review.openstack.org/#/c/22872/

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2013-0335
https://bugs.launchpad.net/nova/+bug/1125378

[Comment 1 Matthew Thode ( prometheanfire ) 2013-02-26 21:44:28 UTC]

fixed in tree

[Comment 2 Matthew Thode ( prometheanfire ) 2013-02-26 21:46:00 UTC]

nova-2012.2.3-r1 (only one in tree) has the fix

[Comment 3 Sean Amoss (RETIRED) 2013-03-04 01:20:44 UTC]

Thanks, Matthew!

Closing noglsa for ~arch only.