Ubuntu 13.04 USN-1831-1 High: nova Denial Of Service Threat

ubuntu

May 16, 2013

Nova could be made to crash the system if instances used a specially crafted image.

Summary

Nova could be made to crash the system if instances used a specially

crafted image.

Software Description:

- nova: OpenStack Compute cloud infrastructure

Details:

Loganathan Parthipan discovered that Nova did not verify the size of QCOW2

instance storage. An authenticated attacker could exploit this to cause a

denial of service by creating an image with a large virtual size with

little data, then filling the virtual disk.

Topics Covered

security advisory denial of service high ubuntu nova

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.04:
  python-nova                     1:2013.1-0ubuntu2.1

Ubuntu 12.10:
  python-nova                     2012.2.3-0ubuntu2.1

Ubuntu 12.04 LTS:
  python-nova
2012.1.3+stable-20130423-e52e6912-0ubuntu1.1

In general, a standard system update will make all the necessary changes.