Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 514
Alerts This Week
Warning Icon 1 514

Ubuntu 12.04 LTS: USN-1626-1 moderate: Glance Image Deletion Risk

ubuntu
Calendar Grey November 8, 2012
Scroller Ubuntu
Ubuntu Security Notice USN-1627-1 highlights a significant vulnerability within Nova that permits unauthorized instance termination without adequate safeguards.
Glance could be made to delete arbitrary images.

Summary

Glance could be made to delete arbitrary images.

Software Description:

- glance: OpenStack Image Registry and Delivery Service

Details:

Gabe Westmaas discovered that Glance did not always properly enforce access

controls when deleting images. An authenticated user could delete arbitrary

images by using the v1 API under certain circumstances.

Topics%20covered

Topics Covered

security advisory access control ubuntu glance image deletion

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.10:
  python-glance                   2012.2-0ubuntu2.2

Ubuntu 12.04 LTS:
  python-glance                   2012.1.3+stable~20120821-120fcf-0ubuntu1.2

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-1626-1

CVE-2012-4573

Severity
important
Lowest
Low
Medium
High
Critical

=========================================================================Ubuntu Security Notice USN-1626-1

Topics%20covered

Topics Covered

security advisory access control ubuntu glance image deletion

Package Information

https://launchpad.net/ubuntu/+source/glance/2012.2-0ubuntu2.2
https://launchpad.net/ubuntu/+source/glance/2012.1.3+stable~20120821-120fcf-0ubuntu1.2

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.