Eucalyptus CVE-2014-5038 Multiple Local Information Disclosure Vulnerabilities

Bugtraq ID:	71355
Class:	Design Error
CVE:	CVE-2014-5038
Remote:	No
Local:	Yes
Published:	Nov 07 2014 12:00AM
Updated:	Mar 19 2015 08:20AM
Credit:	The vendor reported these issues.
Vulnerable:	Eucalyptus Eucalyptus 4.0.1 Eucalyptus Eucalyptus 4.0 Eucalyptus Eucalyptus 3.4.3 Eucalyptus Eucalyptus 3.4.2 Eucalyptus Eucalyptus 3.4.1 Eucalyptus Eucalyptus 3.3.2 Eucalyptus Eucalyptus 3.3.1 Eucalyptus Eucalyptus 3.3 Eucalyptus Eucalyptus 3.2.2 Eucalyptus Eucalyptus 3.2.1 Eucalyptus Eucalyptus 3.2 Eucalyptus Eucalyptus 3.1.2 Eucalyptus Eucalyptus 3.1.1 Eucalyptus Eucalyptus 3.1 Eucalyptus Eucalyptus 3.0.1 Eucalyptus Eucalyptus 3.4.0
Not Vulnerable:	Eucalyptus Eucalyptus 4.0.2

Eucalyptus CVE-2014-5038 Multiple Local Information Disclosure Vulnerabilities

Eucalyptus is prone to multiple local information-disclosure vulnerabilities.

Local attackers can exploit these issues to gain access to cloud log file that contains sensitive information; this may aid in further attacks.

Eucalyptus 3.0.0 through 4.0.1 are vulnerable.

Eucalyptus CVE-2014-5038 Multiple Local Information Disclosure Vulnerabilities

Attackers can use standard, readily available tools to exploit these issues.

Eucalyptus CVE-2014-5038 Multiple Local Information Disclosure Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.