Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 507
Alerts This Week
Warning Icon 1 507

Ubuntu 12.10 USN-1626-2 Moderate: Glance Image Deletion Threat

ubuntu
Calendar Grey November 9, 2012
Scroller Ubuntu
Ubuntu USN-1626-2 details a critical bug in Glance that could let unauthorized users remove images.
Glance could be made to delete arbitrary images.

Summary

Glance could be made to delete arbitrary images.

Software Description:

- glance: OpenStack Image Registry and Delivery Service

Details:

USN-1626-1 fixed vulnerabilities in the v1 API of Glance. This update

provides the corresponding updates for the v2 API.

Original advisory details:

Gabe Westmaas discovered that Glance did not always properly enforce access

controls when deleting images. An authenticated user could delete arbitrary

images by using the v1 API under certain circumstances.

Topics%20covered

Topics Covered

security advisory moderate access control Ubuntu glance image deletion

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.10:
  python-glance                   2012.2-0ubuntu2.3

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-1626-2

https://ubuntu.com/security/notices/USN-1626-1

CVE-2012-4573

Severity
important
Lowest
Low
Medium
High
Critical

=========================================================================Ubuntu Security Notice USN-1626-2

Topics%20covered

Topics Covered

security advisory moderate access control Ubuntu glance image deletion

Package Information

https://launchpad.net/ubuntu/+source/glance/2012.2-0ubuntu2.3

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.