CVE-2013-0266: Puppetlabs-cinder: packstack: openstack: puppetlabs-cinder: information disclosure of openstack administrative passwords due to world-readable configuration files.
A flaw was found in the puppetlabs-cinder module, as used in PackStack. This vulnerability is due to incorrect file permissions, specifically world-readable permissions, on the cinder.conf and api-paste.ini configuration files. A local user can exploit this by reading these files, which leads to the disclosure of OpenStack administrative passwords. This information disclosure could allow unauthorized access to sensitive OpenStack resources.
Other sources
Derek Higgins (derekh) reports:
puppetlabs-cinder / manifests / base.pp as used in OpenStack packstack uses unsafe file permissions (mode 0644) for various config files (cinder.conf and api-paste.ini) which can result in authorization credentials being exposed to local attackers.
External references: https://github.com/puppetlabs/puppetlabs-cinder/blob/master/manifests/base.pp#L31 mode => '0644',
— Red Hat
manifests/base.pp in the puppetlabs-cinder module, as used in PackStack, uses world-readable permissions for the (1) cinder.conf and (2) api-paste.ini configuration files, which allows local users to read OpenStack administrative passwords by reading the files.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0266?
CVE-2013-0266 has a medium severity due to potential exposure of sensitive configuration files.
How do I fix CVE-2013-0266?
To fix CVE-2013-0266, ensure that the file permissions for cinder.conf and api-paste.ini are set to a more restrictive mode, such as 0600.
Which versions of OpenStack are affected by CVE-2013-0266?
CVE-2013-0266 affects OpenStack Essex and Folsom.
What files are vulnerable in CVE-2013-0266?
The vulnerable files in CVE-2013-0266 are cinder.conf and api-paste.ini.
Who reported CVE-2013-0266?
CVE-2013-0266 was reported by Derek Higgins.