Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 542
Alerts This Week
Warning Icon 1 542

Ubuntu 12.10 USN-1831-2 Moderate: OpenStack Nova Denial of Service

ubuntu
Calendar Grey May 29, 2013
Scroller Ubuntu
OpenStack Nova vulnerability resolved in USN-1831-2. Update implemented to rectify denial of service problems arising from a prior update.
USN-1831-1 introduced a regression in OpenStack Nova.

Summary

USN-1831-1 introduced a regression in OpenStack Nova.

Software Description:

- nova: OpenStack Compute cloud infrastructure

Details:

USN-1831-1 fixed a vulnerability in OpenStack Nova. The upstream fix

introduced a regression where instances using uncached QCOW2 images would

fail to start. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Loganathan Parthipan discovered that Nova did not verify the size of QCOW2

instance storage. An authenticated attacker could exploit this to cause a

denial of service by creating an image with a large virtual size with

little data, then filling the virtual disk.

Topics%20covered

Topics Covered

security advisory denial of service ubuntu regression fix nova

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.10:
  python-nova                     2012.2.3-0ubuntu2.2

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-1831-2

https://ubuntu.com/security/notices/USN-1831-1

https://bugs.launchpad.net/nova/+bug/1183606

=========================================================================Ubuntu Security Notice USN-1831-2

Topics%20covered

Topics Covered

security advisory denial of service ubuntu regression fix nova

Package Information

https://launchpad.net/ubuntu/+source/nova/2012.2.3-0ubuntu2.2

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.