CVE-2012-5483: Low severity keystone vulnerability
tools/sampledata.sh in OpenStack Keystone 2012.1.3, when access to Amazon Elastic Compute Cloud (Amazon EC2) is configured, uses world-readable permissions for /etc/keystone/ec2rc, which allows local users to obtain access to EC2 services by reading administrative access and secret values from this file.
Other sources
Within the OpenStack keystone package the file /etc/keystone/ec2rc is world readable and contains:
=== ADMINACCESS=109a7daa83054fc58ec8ade83b114117 ADMINSECRET=3bbbcba9514e4e8e8d0eb9e528754091 DEMOACCESS=81c2326383e34b888e0589057bc7fae2 DEMOSECRET=ceb87a47838a442ea2923ad1bd6f0a16 ===
Also please note that the /etc/keystone/ directory should probably not be world readable at all.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5483?
CVE-2012-5483 is rated as a Medium severity vulnerability due to the potential for local users to access sensitive data.
How do I fix CVE-2012-5483?
To fix CVE-2012-5483, you should change the permissions of /etc/keystone/ec2rc to restrict access to only authorized users.
What impact does CVE-2012-5483 have on OpenStack Keystone?
CVE-2012-5483 allows local users to gain unauthorized access to Amazon EC2 services by reading sensitive information from a world-readable file.
Which versions of OpenStack Keystone are affected by CVE-2012-5483?
CVE-2012-5483 specifically affects OpenStack Keystone version 2012.1.3.
Is CVE-2012-5483 exploitable remotely?
CVE-2012-5483 is not remotely exploitable as it requires local access to the affected system.