OpenStack Neutron Multiple Security Bypass Vulnerabilities

Bugtraq ID:	71798
Class:	Race Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 18 2014 12:00AM
Updated:	Nov 18 2014 12:00AM
Credit:	Brian Haley
Vulnerable:	OpenStack neutron 0
Not Vulnerable:

OpenStack Neutron Multiple Security Bypass Vulnerabilities

Neutron is prone to multiple security-bypass vulnerabilities.

An attacker may exploit these issues to bypass certain security restrictions and perform unauthorized actions. This may lead to further attacks.

OpenStack Neutron Multiple Security Bypass Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

OpenStack Neutron Multiple Security Bypass Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

OpenStack Neutron Multiple Security Bypass Vulnerabilities

References:

• Fix a race condition adding a security group rule (Brian Haley)
  
• OpenStack Homepage (OpenStack)
  
• OpenStack Neutron HomePage (OpenStack)
  
• Race condition adding a security group rule when another is in-progress (Brian Haley)