CVE-2013-0266: Race Condition
First published: Thu Feb 07 2013(Updated: )
Derek Higgins (derekh) reports: puppetlabs-cinder / manifests / base.pp as used in OpenStack packstack uses unsafe file permissions (mode 0644) for various config files (cinder.conf and api-paste.ini) which can result in authorization credentials being exposed to local attackers. External references: <a href="https://github.com/puppetlabs/puppetlabs-cinder/blob/master/manifests/base.pp#L31">https://github.com/puppetlabs/puppetlabs-cinder/blob/master/manifests/base.pp#L31</a> mode => '0644',
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenStack Essex | ||
| OpenStack Folsom |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/puppetlabs/puppetlabs-cinder/blob/master/manifests/base.pp#L31
- https://github.com/puppetlabs/puppetlabs-cinder/commit/7da792fbd40c0e6eae1ee093aa00e0b177bd2ebc
- https://rhn.redhat.com/errata/RHSA-2013-0595.html
- https://bugzilla.redhat.com/show_bug.cgi?id=908581
- http://rhn.redhat.com/errata/RHSA-2013-0595.html
Frequently Asked Questions
What is the severity of CVE-2013-0266?
CVE-2013-0266 has a medium severity due to potential exposure of sensitive configuration files.
How do I fix CVE-2013-0266?
To fix CVE-2013-0266, ensure that the file permissions for cinder.conf and api-paste.ini are set to a more restrictive mode, such as 0600.
Which versions of OpenStack are affected by CVE-2013-0266?
CVE-2013-0266 affects OpenStack Essex and Folsom.
What files are vulnerable in CVE-2013-0266?
The vulnerable files in CVE-2013-0266 are cinder.conf and api-paste.ini.
Who reported CVE-2013-0266?
CVE-2013-0266 was reported by Derek Higgins.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/author
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2013-0266
- agent/trending
- agent/tags
- agent/source
- vendor/openstack
- canonical/openstack essex
- canonical/openstack folsom