--===============5069767994994833294==
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature";
 boundary="4Ckj6UjgE2iN1+kY"
Content-Disposition: inline


--4Ckj6UjgE2iN1+kY
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inlin
Content-Transfer-Encoding: quoted-printable

==========================================================================
Ubuntu Security Notice USN-1497-1
July 03, 2012

nova vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.04 LTS
- Ubuntu 11.10

Summary:

Nova could be made to overwrite or corrupt arbitrary files in the
compute host file system.

Software Description:
- nova: OpenStack Compute cloud infrastructure

Details:

Matthias Weckbecker discovered that, when using the OpenStack API to
setup libvirt-based hypervisors, an authenticated user could inject
files in arbitrary locations on the file system of the host running
Nova. A remote attacker could use this to gain root privileges. This
issue only affects Ubuntu 12.04 LTS. (CVE-2012-3360)

Pádraig Brady discovered that an authenticated user could corrupt
arbitrary files of the host running Nova. A remote attacker could
use this to cause a denial of service or possibly gain privileges.
(CVE-2012-3361)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  python-nova                     2012.1+stable~20120612-3ee026e-0ubuntu1.1

Ubuntu 11.10:
  python-nova                     2011.3-0ubuntu6.9

In general, a standard system update will make all the necessary changes.

References:
  http://www.ubuntu.com/usn/usn-1497-1
  CVE-2012-3360, CVE-2012-3361

Package Information:
  https://launchpad.net/ubuntu/+source/nova/2012.1+stable~20120612-3ee026e-0ubuntu1.1
  https://launchpad.net/ubuntu/+source/nova/2011.3-0ubuntu6.9


--4Ckj6UjgE2iN1+kY
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBCgAGBQJP8yLmAAoJEC8Jno0AXoH0yGEP/1andVO4Pg4HvYky9uKpMqUr
GugdNCIqedkTV1oo0GYh4TwgOSG1pkpson6gYvUA/8caGhv0zhTI9LYW14md6ZXS
jYy+lC4ftrZjq8/QK9Ok4ne0Ujs1EVfGJoJVgaKxmRk8lKKqvjDOjuBSKOaWJEzV
kMYS+j94v7uO3a3W3kWBHHycEj1rGQbJI+iaCSw4gBO+286chsyczqbBm6YDiYIl
ApSDnmFWPV0ATSrXiW5gVFvQkuqs1ht2wP92LB1kFAkFK8F26bI4VI+PmKXEelbE
Zfsa6KxqmCVHC04psW6kFqLpRleadtzVbZYkNJ/ZQ5SrHSFpEnbb+W6LiVQauQRz
VQVtC7wyM/b3Z63moeB/FngT0vRB6lCPmZGuDy6+5cNafttTrR1Ig6a1+CIAM+Z0
OGmP2CFmgyKfpPjGs5vqylznXPjaN8e7JVP0T+ylem86zjpMbdSJP9NXk4Z5eaEm
yLsesL1VJX3hIrVR6HhdhQnY5qUMW6FwxOa+szccm6UKok4BeYRPwS0rJsv18mty
jiJXkcQGyXKJ7h/e1a9WawwetW+EZCu6dQ1JBXingHm5511iKMHj+ds2WJeayfmk
Ja/b+8yUmQqkcV8VG7WjnddTkae16sTR8GNTppxO6pwj90HXmhoGECEZ6UBNfVX4
yUOF6wGMnvuOUzZPFH+j
=c7LG
-----END PGP SIGNATURE-----

--4Ckj6UjgE2iN1+kY--


--===============5069767994994833294==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-- 
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

--===============5069767994994833294==--