Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Ubuntu 2003-1: Glance Service Information Exposure Threat

ubuntu
Calendar Grey October 23, 2013
Scroller Ubuntu
Ubuntu USN-2003-2 reveals a vulnerability that could lead to information leakage through network channels. It is advised to implement updates for improved security.
Glance could be made to expose sensitive information over the network under certain circumstances.

Summary

Glance could be made to expose sensitive information over the network

under certain circumstances.

Software Description:

- glance: OpenStack Image Registry and Delivery Service

Details:

Stuart McLaren discovered that Glance did not properly enforce the

'download_image' policy for cached images. An authenticated user could

exploit this to obtain sensitive information in an image protected by this

setting.

Topics%20covered

Topics Covered

security advisory information exposure ubuntu network threat glance

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.04:
  python-glance                   1:2013.1.3-0ubuntu1.1

Ubuntu 12.10:
  python-glance                   2012.2.4-0ubuntu1.1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2003-1

CVE-2013-4428

Severity
important
Lowest
Low
Medium
High
Critical

=========================================================================Ubuntu Security Notice USN-2003-1

Topics%20covered

Topics Covered

security advisory information exposure ubuntu network threat glance

Package Information

https://launchpad.net/ubuntu/+source/glance/1:2013.1.3-0ubuntu1.1
https://launchpad.net/ubuntu/+source/glance/2012.2.4-0ubuntu1.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.