CVE-2013-2296
First published: Tue Sep 17 2013(Updated: )
Walrus in Eucalyptus before 3.2.2 does not verify authorization for the GetBucketLoggingStatus, SetBucketLoggingStatus, and SetBucketVersioningStatus bucket operations, which allows remote authenticated users to bypass intended restrictions on (1) modifying the logging setting, (2) modifying the versioning setting, or (3) accessing activity logs via a request.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Eucalyptus | <=3.2.1 | |
| Eucalyptus | =1.0 | |
| Eucalyptus | =1.1 | |
| Eucalyptus | =1.2 | |
| Eucalyptus | =1.3 | |
| Eucalyptus | =1.4 | |
| Eucalyptus | =1.5.1 | |
| Eucalyptus | =1.5.2 | |
| Eucalyptus | =1.6 | |
| Eucalyptus | =1.6.2 | |
| Eucalyptus | =2.0 | |
| Eucalyptus | =2.0.0 | |
| Eucalyptus | =2.0.1 | |
| Eucalyptus | =2.0.2 | |
| Eucalyptus | =2.0.3 | |
| Eucalyptus | =3.0 | |
| Eucalyptus | =3.0.1 | |
| Eucalyptus | =3.1.0 | |
| Eucalyptus | =3.1.1 | |
| Eucalyptus | =3.1.2 | |
| Eucalyptus | =3.2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2013-2296?
CVE-2013-2296 is classified as a medium severity vulnerability due to improper authorization handling in bucket operations.
How do I fix CVE-2013-2296?
To fix CVE-2013-2296, upgrade to Eucalyptus version 3.2.2 or newer.
Which versions of Eucalyptus are affected by CVE-2013-2296?
CVE-2013-2296 affects all Eucalyptus versions prior to 3.2.2, as well as specific older versions up to 1.6.2.
What attacks are possible due to CVE-2013-2296?
Due to CVE-2013-2296, remote authenticated users can bypass permissions to modify bucket logging and versioning settings.
Is user authentication sufficient to protect against CVE-2013-2296?
No, user authentication is not sufficient as CVE-2013-2296 allows authenticated users to bypass intended access restrictions.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/eucalyptus
- canonical/eucalyptus
- version/eucalyptus/3.2.1
- version/eucalyptus/1.0
- version/eucalyptus/1.1
- version/eucalyptus/1.2
- version/eucalyptus/1.3
- version/eucalyptus/1.4
- version/eucalyptus/1.5.1
- version/eucalyptus/1.5.2
- version/eucalyptus/1.6
- version/eucalyptus/1.6.2
- version/eucalyptus/2.0
- version/eucalyptus/2.0.0
- version/eucalyptus/2.0.1
- version/eucalyptus/2.0.2
- version/eucalyptus/2.0.3
- version/eucalyptus/3.0
- version/eucalyptus/3.0.1
- version/eucalyptus/3.1.0
- version/eucalyptus/3.1.1
- version/eucalyptus/3.1.2
- version/eucalyptus/3.2.0