CVE-2013-0208
Published on: 02/13/2013 12:00:00 AM UTC
Last Modified on: 02/13/2023 04:13:25 AM UTC
Certain versions of Ubuntu Linux from Canonical contain the following vulnerability:
The boot-from-volume feature in OpenStack Compute (Nova) Folsom and Essex, when using nova-volumes, allows remote authenticated users to boot from other users' volumes via a volume id in the block_device_mapping parameter.
- CVE-2013-0208 has been assigned by
[email protected] to track the vulnerability
CVSS2 Score: 6.5 - MEDIUM
| Access Vector ⓘ |
Access Complexity |
Authentication |
|---|---|---|
| NETWORK | LOW | SINGLE |
| Confidentiality Impact |
Integrity Impact |
Availability Impact |
| PARTIAL | PARTIAL | PARTIAL |
CVE References
| Description | Tags ⓘ | Link |
|---|---|---|
| disallow boot from volume from specifying arbitrary volumes · openstack/[email protected] · GitHub | github.com text/html |
CONFIRM github.com/openstack/nova/commit/243d516cea9d3caa5a8267b12d2f577dcb24193b |
| Red Hat Customer Portal | web.archive.org text/html Inactive LinkNot Archived |
REDHAT RHSA-2013:0208 |
| No Description Provided | osvdb.org Inactive LinkNot Archived |
OSVDB 89661 |
| OpenStack Compute (Nova) 'nova-volume' Security Bypass Vulnerability | cve.report (archive) text/html |
BID 57613 |
| oss-security - [OSSA 2013-001] Boot from volume allows access to random volumes (CVE-2013-0208) | www.openwall.com text/html |
MLIST [oss-security] 20130129 [OSSA 2013-001] Boot from volume allows access to random volumes (CVE-2013-0208) |
| Security Advisory SA51992 - Ubuntu update for nova - Secunia | Vendor Advisory web.archive.org text/html |
SECUNIA 51992 |
| disallow boot from volume from specifying arbitrary volumes · openstack/[email protected] · GitHub | github.com text/html |
CONFIRM github.com/openstack/nova/commit/317cc0af385536dee43ef2addad50a91357fc1ad |
| USN-1709-1: OpenStack Nova vulnerability | Ubuntu | www.ubuntu.com text/html |
UBUNTU USN-1709-1 |
| Security Advisory SA51963 - OpenStack Compute (Nova) Boot From Volume Arbitrary Volume Booting Vulnerability - Secunia | Vendor Advisory web.archive.org text/html |
SECUNIA 51963 |
| 902629 – (CVE-2013-0208) CVE-2013-0208 openstack-nova: Boot from volume allows access to random volumes | bugzilla.redhat.com text/html |
MISC bugzilla.redhat.com/show_bug.cgi?id=902629 |
| IBM X-Force Exchange | exchange.xforce.ibmcloud.com text/html |
XF nova-volume-security-bypass(81697) |
| Bug #1069904 “[OSSA 2013-001] No authentication on block device ...” : Bugs : OpenStack Compute (nova) | bugs.launchpad.net text/html |
CONFIRM bugs.launchpad.net/nova/+bug/1069904 |
There are currently no QIDs associated with this CVE
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Canonical | Ubuntu Linux | 11.10 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 12.04 | - | lts | All |
| Operating System | Canonical | Ubuntu Linux | 12.10 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 11.10 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 12.04 | - | lts | All |
| Operating System | Canonical | Ubuntu Linux | 12.10 | All | All | All |
| Application | Openstack | Essex | - | All | All | All |
| Application | Openstack | Essex | - | All | All | All |
| Application | Openstack | Folsom | - | All | All | All |
| Application | Openstack | Folsom | - | All | All | All |
- cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*:
- cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*:
- cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*:
- cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*:
- cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*:
- cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*:
- cpe:2.3:a:openstack:essex:-:*:*:*:*:*:*:*:
- cpe:2.3:a:openstack:essex:-:*:*:*:*:*:*:*:
- cpe:2.3:a:openstack:folsom:-:*:*:*:*:*:*:*:
- cpe:2.3:a:openstack:folsom:-:*:*:*:*:*:*:*:
No vendor comments have been submitted for this CVE