Ubuntu: 1709-1 Moderate: Nova Access Control Breach - Data Exposure

ubuntu

January 29, 2013

Nova volume could be made to expose volumes from other users.

Summary

Nova volume could be made to expose volumes from other users.

Software Description:

- nova: OpenStack Compute cloud infrastructure

Details:

Phil Day discovered that nova-volume did not validate access to volumes. An

authenticated attacker could exploit this to bypass intended access

controls and boot from arbitrary volumes.

Topics Covered

security advisory access control authentication issue ubuntu data exposure openstack nova

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.10:
  nova-volume
2012.2.1+stable-20121212-a99a802e-0ubuntu1.1
  python-nova
2012.2.1+stable-20121212-a99a802e-0ubuntu1.1

Ubuntu 12.04 LTS:
  nova-volume
2012.1.3+stable-20120827-4d2a4afe-0ubuntu1.1
  python-nova
2012.1.3+stable-20120827-4d2a4afe-0ubuntu1.1

Ubuntu 11.10:
  nova-volume                     2011.3-0ubuntu6.11
  python-nova                     2011.3-0ubuntu6.11

In general, a standard system update will make all the necessary changes.