CVE-2013-2758: Medium severity Apache CloudStack vulnerability

Published May 23, 2014

Updated

Apache CloudStack 4.0.0 before 4.0.2 and Citrix CloudPlatform (formerly Citrix CloudStack) 3.0.x before 3.0.6 Patch C uses a hash of a predictable sequence, which makes it easier for remote attackers to guess the console access URL via a brute force attack.

Affected Software

8 affected components

Apache CloudStack=4.0.0-incubating

Apache CloudStack=4.0.1

Apache CloudStack=4.0.2

Citrix CloudPlatform=3.0

Citrix CloudPlatform=3.0.3

Citrix CloudPlatform=3.0.4

Citrix CloudPlatform=3.0.5

Citrix CloudPlatform=3.0.6

Remediation

Patch Available

http://support.citrix.com/article/CTX135815

Event History

May 23, 2014

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Data Sourced

via NVD·02:55 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2013-2758?

CVE-2013-2758 is considered a medium severity vulnerability due to its ability to allow remote attackers to exploit predictable sequence hashes.

How do I fix CVE-2013-2758?

To fix CVE-2013-2758, upgrade to Apache CloudStack version 4.0.2 or Citrix CloudPlatform version 3.0.6 or later.

What systems are affected by CVE-2013-2758?

CVE-2013-2758 affects Apache CloudStack versions 4.0.0 to 4.0.1 and Citrix CloudPlatform versions 3.0 to 3.0.5.

What attackers can do with CVE-2013-2758?

Attackers can use CVE-2013-2758 to perform brute force attacks to guess the console access URL.

Is there a workaround for CVE-2013-2758?

There are no known workarounds for CVE-2013-2758; upgrading to the patched versions is recommended.