OpenStack Glance CVE-2013-0212 Security Bypass Vulnerability

Bugtraq ID:	57612
Class:	Design Error
CVE:	CVE-2013-0212
Remote:	Yes
Local:	No
Published:	Jan 12 2013 12:00AM
Updated:	May 07 2015 05:07PM
Credit:	Dan Prince of Red Hat
Vulnerable:	Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64
Not Vulnerable:

OpenStack Glance CVE-2013-0212 Security Bypass Vulnerability

Glance is prone to a security-bypass vulnerability.

Successful exploits may allow an attacker to bypass certain security restrictions to perform unauthorized actions. This may aid in further attacks.

OpenStack Glance CVE-2013-0212 Security Bypass Vulnerability

Attackers can exploit this issue with a browser.

OpenStack Glance CVE-2013-0212 Security Bypass Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.

OpenStack Glance CVE-2013-0212 Security Bypass Vulnerability

References:

• [OSSA 2013-002] Backend password leak in Glance error message (CVE-2013-0212) (SecLists.Org)
  
• Glance Commit (Dan Prince)
  
• Glance Homepage (OpenStack )
  
• glance image-download can display backend Swift password (Dan Prince)
  
• USN-1710-1: OpenStack Glance vulnerability (Canonical )
  
• RHSA-2013:0209 openstack-glance security update (Red Hat)