OpenStack Cinder And Nova Information Disclosure Vulnerability

Bugtraq ID:	75192
Class:	Design Error
CVE:	CVE-2015-1850 CVE-2015-1851
Remote:	Yes
Local:	No
Published:	Jun 13 2015 12:00AM
Updated:	Aug 10 2016 03:01PM
Credit:	Bastian Blank
Vulnerable:	Ubuntu Ubuntu Linux 15.04 Redhat OpenStack 6.0 for RHEL 7 Redhat OpenStack 5.0 for RHEL 7 Redhat OpenStack 5.0 for RHEL 6 OpenStack Nova 0 OpenStack Cinder 2015.1 OpenStack Cinder 2014.2.3 OpenStack Cinder 2014.2.1 OpenStack Cinder 2014.1.4 OpenStack Cinder 2014.1.3 IBM SmartCloud Entry 3.2 IBM SmartCloud Entry 3.1 IBM PowerVC Standard Edition 1.3.0.1 IBM PowerVC Standard Edition 1.3.0.0 IBM PowerVC Standard Edition 1.2.3.3 IBM PowerVC Standard Edition 1.2.3.2 IBM PowerVC Standard Edition 1.2.3.1 IBM PowerVC Standard Edition 1.2.3.0 IBM Cloud Manager with Openstack 4.3 IBM Cloud Manager with Openstack 4.2 IBM Cloud Manager with Openstack 4.1 IBM Cloud Manager with Openstack 4.3.0.6 IBM Cloud Manager with Openstack 4.3.0.4 IBM Cloud Manager with Openstack 4.3.0.3 IBM Cloud Manager with Openstack 4.3.0.2 IBM Cloud Manager with Openstack 4.3.0.1 IBM Cloud Manager with Openstack 4.2.0.3 Interix Fix IBM Cloud Manager with Openstack 4.2.0.3 Interix Fix IBM Cloud Manager with Openstack 4.2.0.3 Interim Fix IBM Cloud Manager with Openstack 4.2.0.3 IBM Cloud Manager with Openstack 4.2.0.2 IBM Cloud Manager with Openstack 4.2.0.1 IBM Cloud Manager with Openstack 4.1.0.5 Interim Fix IBM Cloud Manager with Openstack 4.1.0.5 IBM Cloud Manager with Openstack 4.1.0.4 IBM Cloud Manager with Openstack 4.1.0.3 IBM Cloud Manager with Openstack 4.1.0.2 IBM Cloud Manager with Openstack 4.1.0.1 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

OpenStack Cinder And Nova Information Disclosure Vulnerability

Cinder and Nova are prone to an information-disclosure vulnerability.

Attackers can exploit this issue to obtain potentially sensitive information. This may lead to further attacks.

OpenStack Cinder And Nova Information Disclosure Vulnerability

Attackers can use standard, readily available tools to exploit this issue.

OpenStack Cinder And Nova Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

OpenStack Cinder And Nova Information Disclosure Vulnerability

References:

• Cinder Homepage (OpenStack)
  
• [OSSA 2015-011.1] Cinder host file disclosure through qcow2 backing file (CVE-20 (Seclists.org)
  
• CVE-2015-1850: OpenStack Cinder/Nova: Format-guessing and file disclosure in ima (Seclists.org)
  
• Format-guessing and file disclosure in image convert (CVE-2015-1850) (launchpad)
  
• isg3T1023865:OpenStack vulnerabilities affect IBM SmartCloud Entry(CVE-2015-7548 (IBM)
  
• isg3T1024106:OpenStack vulnerabilities affect IBM Cloud Manager with Openstack ( (IBM)
  
• nas8N1021457:IBM PowerVC is impacted by OpenStack Nova information disclosure vu (IBM)
  
• openstack-cinder security and bug fix update (Red Hat)
  
• openstack-nova: Host file disclosure through qcow2 backing file (Bugzilla)