Apache Libcloud Digital Ocean API Local Information Disclosure Vulnerability
BID:64617
Info
Apache Libcloud Digital Ocean API Local Information Disclosure Vulnerability
| Bugtraq ID: | 64617 |
| Class: | Design Error |
| CVE: |
CVE-2013-6480 |
| Remote: | No |
| Local: | Yes |
| Published: | Jan 01 2014 12:00AM |
| Updated: | Apr 13 2015 09:33PM |
| Credit: | The vendor reported this issue. |
| Vulnerable: |
Apache Apache Libcloud 0.13.2 Apache Apache Libcloud 0.12.3 |
| Not Vulnerable: |
Apache Apache Libcloud 0.13.3 |
Discussion
Apache Libcloud Digital Ocean API Local Information Disclosure Vulnerability
Apache Libcloud is prone to a local information-disclosure vulnerability.
Local attackers can exploit this issue to obtain sensitive information. Information obtained may lead to further attacks.
Apache Libcloud versions 0.12.3 through 0.13.2 are vulnerable.
Apache Libcloud is prone to a local information-disclosure vulnerability.
Local attackers can exploit this issue to obtain sensitive information. Information obtained may lead to further attacks.
Apache Libcloud versions 0.12.3 through 0.13.2 are vulnerable.
Exploit / POC
Apache Libcloud Digital Ocean API Local Information Disclosure Vulnerability
Attackers can use standard commands to exploit this issue.
The following example command is available:
dd if=/dev/vda bs=1M | strings -n 100 > out.txt
Attackers can use standard commands to exploit this issue.
The following example command is available:
dd if=/dev/vda bs=1M | strings -n 100 > out.txt
Solution / Fix
Apache Libcloud Digital Ocean API Local Information Disclosure Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Apache Libcloud Digital Ocean API Local Information Disclosure Vulnerability
References:
References:
- Apache Libcloud Homepage (Apache Software Foundation)
- Digital Ocean API is not told to scrub (securely delete) VM on destroy (Apache Software Foundation)
- Libcloud Vulnerabilities (Apache Software Foundation)
- Transparency Regarding Data Security (DigitalOcean)