CVE-2011-4076: Infoleak
From:
https://bugs.launchpad.net/nova/+bug/868360
If the secret key doesn't match for the ec2 request, the exception passed back to the user, showing the correct password.
To replicate: # export EC2ACCESSKEY='oomNAG3AGwnlKDAM9gFe' # export EC2SECRETKEY='anything' # euca-describe-instances [...] InvalidSignature: Invalid signature w6q++6lcvoEcBkcQuT1yNDURSpM8tq3a+WbhYeKWuX4= for user User('nova', 'nova', 'oomNAG3AGwnlKDAM9gFe', 'eXTMGYDx7FhSI7ng3YfE', True).
i.e. the correct password is leaked back to the user if the incorrect password is given
CVE 2011-4076 is reserved for the issue
Other sources
OpenStack Nova before 2012.1 allows someone with access to an EC2ACCESSKEY (equivalent to a username) to obtain the EC2SECRETKEY (equivalent to a password). Exposing the EC2ACCESSKEY via http or tools that allow man-in-the-middle over https could allow an attacker to easily obtain the EC2SECRETKEY. An attacker could also presumably brute force values for EC2ACCESSKEY.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4076?
CVE-2011-4076 is classified as a medium severity vulnerability due to its potential to expose sensitive information.
How do I fix CVE-2011-4076?
To remediate CVE-2011-4076, update OpenStack Nova to a version greater than 12.0.0a0 or apply the relevant patches if available.
What systems are affected by CVE-2011-4076?
CVE-2011-4076 affects OpenStack Nova versions between 2010.1 and 2012.1.
What kind of information is exposed due to CVE-2011-4076?
CVE-2011-4076 can inadvertently expose the user's secret key information when an EC2 request fails.
Is CVE-2011-4076 still exploitable in newer versions of OpenStack Nova?
No, CVE-2011-4076 has been addressed in versions newer than 12.0.0a0 of OpenStack Nova.