OpenStack Keystone Token Validation Multiple Security Bypass Vulnerabilities

Bugtraq ID:	55716
Class:	Design Error
CVE:	CVE-2012-4456 CVE-2012-4457
Remote:	Yes
Local:	No
Published:	Sep 28 2012 12:00AM
Updated:	Apr 13 2015 08:59PM
Credit:	Jason Xu
Vulnerable:
Not Vulnerable:

OpenStack Keystone Token Validation Multiple Security Bypass Vulnerabilities

Keystone is prone to multiple security-bypass vulnerabilities.

Successful exploits may allow authenticated attackers to bypass certain intended security restrictions and perform unauthorized actions which may aid in launching further attacks.

OpenStack Keystone Token Validation Multiple Security Bypass Vulnerabilities

Solution:
Vendor updates are available. Please see the references for more information.

OpenStack Keystone Token Validation Multiple Security Bypass Vulnerabilities

References:

• Admin API /v2.0/tenants/{tenant_id}/users/{user_id}/roles doesn't validate token (Jason Xu)
  
• API(v2.0/OS-KSADM/services,v2.0/OS-KSADM/services/{service_id})doesn't validate (Jason Xu)
  
• OpenStack Keystone Homepage (OpenStack )
  
• Important: openstack-keystone security update (Red Hat)