OpenStack Nova CVE-2012-3360 Remote Code Injection Vulnerability

Bugtraq ID:	54277
Class:	Input Validation Error
CVE:	CVE-2012-3360
Remote:	Yes
Local:	No
Published:	Jul 03 2012 12:00AM
Updated:	Apr 13 2015 09:36PM
Credit:	Matthias Weckbecker
Vulnerable:	Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 11.10 i386 Ubuntu Ubuntu Linux 11.10 amd64 OpenStack Dashboard (Horizon) 2012.1
Not Vulnerable:

OpenStack Nova CVE-2012-3360 Remote Code Injection Vulnerability

OpenStack Nova is prone to a remote code-injection vulnerability.

An attacker can exploit this issue to inject and execute arbitrary code with root privileges. Successful exploits will completely compromise affected computers.

OpenStack Nova CVE-2012-3360 Remote Code Injection Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

OpenStack Nova CVE-2012-3360 Remote Code Injection Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.

OpenStack Nova CVE-2012-3360 Remote Code Injection Vulnerability

References:

• Fix bug 1015531 : Prevent file injection writing to host filesystem. (Thierry Carrez)
  
• OpenStack Homepage (OpenStack)
  
• Remote arbitrary file corruption / creation flaw via injected files (Thierry Carrez)