Updated [CVE-2013-6398] CloudStack Virtual Router stop/start modifies- firewall rules allowing additional access

From: David Nalley <ke4qqq@apache.org>
To: security@cloudstack.apache.org <security@cloudstack.apache.org>,security <security@apache.org>,full-disclosure@lists.grok.org.uk,bugtraq@securityfocus.com,announce@cloudstack.apache.org
Cc:
Subject: Updated [CVE-2013-6398] CloudStack Virtual Router stop/start modifies- firewall rules allowing additional access
Date:


Issued: November 27, 2013
Updated: January 10, 2014

[CVE-2013-6398] CloudStack Virtual Router stop/start modifies firewall
rules allowing additional access

Product: Apache CloudStack
Vendor: Apache Software Foundation
Vulnerability type: Bypass
Vulnerable Versions: Apache CloudStack 4.1.0, 4.1.1, 4.2.0
CVE References: CVE-2013-2136
Risk Level: Low
CVSSv2 Base Scores: 2.8 (AV:N/AC:M/Au:M/C:P/I:N/A:N)



Description:
The Apache CloudStack Security Team was notified of a an
issue in the Apache CloudStack virtual router that failed to preserve
source restrictions in firewall rules after a virtual router had been
stopped and restarted.

Mitigation:
Upgrading to CloudStack 4.2.1 or higher will mitigate this issue.

References:
https://issues.apache.org/jira/browse/CLOUDSTACK-5263

Credit:
This issue was identified by the Cloud team and Schuberg Philis





Copyright © 1995-2018 LinuxRocket.net. All rights reserved.