Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 542
Alerts This Week
Warning Icon 1 542

Ubuntu 13.04 Security Notice USN-1875-1: Keystone Token Issues

ubuntu
Calendar Grey June 14, 2013
Scroller Ubuntu
Ubuntu 12.10 and 13.04 have critical vulnerabilities in Keystone affecting authentication and access control. Key vulnerabilities and mitigation strategies to consider.
Keystone did not always properly verify expired PKI tokens or properly authenticate users.

Summary

Keystone did not always properly verify expired PKI tokens or properly

authenticate users.

Software Description:

- keystone: OpenStack identity service

Details:

Eoghan Glynn and Alex Meade discovered that Keystone did not properly

perform expiry checks for the PKI tokens used in Keystone. If Keystone were

setup to use PKI tokens, a previously authenticated user could continue to

use a PKI token for longer than intended. This issue only affected Ubuntu

12.10 which does not use PKI tokens by default. (CVE-2013-2104)

Jose Castro Leon discovered that Keystone did not properly authenticate

users when using the LDAP backend. An attacker could obtain valid tokens

and impersonate other users by supplying an empty password. By default,

Ubuntu does not use the LDAP backend. (CVE-2013-2157)

Topics%20covered

Topics Covered

security advisory ubuntu impersonation keystone token expiration

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.04:
  python-keystone                 1:2013.1.1-0ubuntu2.1

Ubuntu 12.10:
  python-keystone                 2012.2.4-0ubuntu3.1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-1875-1

CVE-2013-2104, CVE-2013-2157

Severity
important
Lowest
Low
Medium
High
Critical

=========================================================================Ubuntu Security Notice USN-1875-1

Topics%20covered

Topics Covered

security advisory ubuntu impersonation keystone token expiration

Package Information

https://launchpad.net/ubuntu/+source/keystone/1:2013.1.1-0ubuntu2.1
https://launchpad.net/ubuntu/+source/keystone/2012.2.4-0ubuntu3.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.