CVE-2012-3447: Medium severity Openstack folsom vulnerability
virt/disk/api.py in OpenStack Compute (Nova) 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image that uses a symlink that is only readable by root. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3361.
Other sources
Thierry Carrez <thierry> reports:
Pádraig Brady from Red Hat discovered that the fix implemented for CVE-2012-3361 (OSSA-2012-008) was not covering all attack scenarios. By crafting a malicious image with root-readable-only symlinks and requesting a server based on it, an authenticated user could still corrupt arbitrary files (all setups affected) or inject arbitrary files (Essex and later setups with OpenStack API enabled and a libvirt-based hypervisor) on the host filesystem, potentially resulting in full compromise of that compute node.
— Red Hat
virt/disk/api.py in OpenStack Compute (Nova) 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image that uses a symlink that is only readable by root. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3361.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3447?
CVE-2012-3447 is considered a moderate severity vulnerability due to its potential for remote authenticated users to overwrite arbitrary files.
How do I fix CVE-2012-3447?
To fix CVE-2012-3447, upgrade OpenStack Nova to version 12.0.0 or later.
Who is affected by CVE-2012-3447?
CVE-2012-3447 affects users of OpenStack Compute (Nova) versions 2012.1.x before 2012.1.2 and Folsom before Folsom-3.
What type of attack is exploited in CVE-2012-3447?
CVE-2012-3447 is exploited through a symlink attack, allowing file overwriting by leveraging symlink permissions.
Can remote unauthenticated users exploit CVE-2012-3447?
No, CVE-2012-3447 can only be exploited by remote authenticated users.