drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in OpenStack
Name: |
Mehrere Probleme in OpenStack |
|
ID: |
USN-2323-1 |
|
Distribution: |
Ubuntu |
|
Plattformen: |
Ubuntu 14.04 LTS |
|
Datum: |
Fr, 22. August 2014, 08:43 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3473
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3474
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3475
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3594 |
|
Applikationen: |
OpenStack |
|
Originalnachricht |
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --===============5077270307804653419== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="TAqJdqA2fd4geNs11ELPUSLcNF5uN8K9p"
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --TAqJdqA2fd4geNs11ELPUSLcNF5uN8K9p Content-Type: text/plain; charset=utf- Content-Transfer-Encoding: quoted-printable
========================================================================== Ubuntu Security Notice USN-2323-1 August 21, 2014
horizon vulnerabilities ==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in OpenStack Horizon.
Software Description: - horizon: Web interface for OpenStack cloud infrastructure
Details:
Jason Hullinger discovered that OpenStack Horizon did not properly perform input sanitization on Heat templates. If a user were tricked into using a specially crafted Heat template, an attacker could conduct cross-site scripting attacks. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. (CVE-2014-3473)
Craig Lorentzen discovered that OpenStack Horizon did not properly perform input sanitization when creating networks. If a user were tricked into launching an image using the crafted network name, an attacker could conduct cross-site scripting attacks. (CVE-2014-3474)
Michael Xin discovered that OpenStack Horizon did not properly perform input sanitization when adding users. If an admin user were tricked into viewing the users page containing a crafted email address, an attacker could conduct cross-site scripting attacks. (CVE-2014-3475)
Dennis Felsch and Mario Heiderich discovered that OpenStack Horizon did not properly perform input sanitization when creating host aggregates. If an admin user were tricked into viewing the Host Aggregates page containing a crafted availability zone name, an attacker could conduct cross-site scripting attacks. (CVE-2014-3594)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 14.04 LTS: openstack-dashboard 1:2014.1.2-0ubuntu1.1
In general, a standard system update will make all the necessary changes.
References: http://www.ubuntu.com/usn/usn-2323-1 CVE-2014-3473, CVE-2014-3474, CVE-2014-3475, CVE-2014-3594
Package Information: https://launchpad.net/ubuntu/+source/horizon/1:2014.1.2-0ubuntu1.1
--TAqJdqA2fd4geNs11ELPUSLcNF5uN8K9p Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIcBAEBCgAGBQJT9lxZAAoJEFHb3FjMVZVzCTgP/2/trpfmaQWK6Hui2IId6km4 mFS/towqicmg7EDFo5MtTKsQKeL5RYUadE9Z4APBqLv7RbqAzzZn/CritKT7e3Kt 7oDw1wIPNo2H+ReabmxksifT6HgcJQRyMtA8vQgvptFueIRgJmgnPNhqNgMpIJ1u LFDwUKyVozxjnmVB8XAubz00jzMHxwBl/8V1v3nbgrsnwKSZf4hwYTFbN9NAQdvM 5QcJcK3CDJUePPWYwVJ4zT8TBmqQ5MibDnBVJIFbpulPCgHOV/0YNERII4zuPK9+ 8ioyqf6PF+fggvrwplXnZzSmthlzYY5sqtz0/3/te33YEi39Hn1wUsl58QhjCJOy qmGf2m11KbGIvMYgFO64aDn7LVKCxXkWSrMDNzLtyllhQ3Cf7kxwVD42hmu2K9C8 Ym/dfkLe16RILv75B56nIx7UKc4w5YcF4R0VV+KzYrgbstHF1OBG76iBkkYwNE1n LVziEknlxxgaNR8ZzqDfXxwEYwHzjm+VQNtOVViPVcaaD1wBAbQFMMPYaOphtQOH cWrJMSpcZo87GVeNsnJPoqlxRc8arhzOWI9Ecf2TndEjsHNqva5T9yqAt382ejGo 2mup/9RaZ5DurZ5e1cYYp9OYuIKmcmZLKBQF+bOYFuqr0r3XZ2Dizo4qyKJ+/llV 6hy/gcl1b49jUCgyhego =bFO2 -----END PGP SIGNATURE-----
--TAqJdqA2fd4geNs11ELPUSLcNF5uN8K9p--
--===============5077270307804653419== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline
-- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
--===============5077270307804653419==--
|
|
|
|