Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 542
Alerts This Week
Warning Icon 1 542

Ubuntu 13.10 USN-2061-1 Critical: Keystone Token Exploitation

ubuntu
Calendar Grey December 19, 2013
Scroller Ubuntu
Ubuntu's bypass of Keystone access control influences EC2 token implementations. Immediate patch recommended.
Keystone access controls could be circumvented via EC2-style tokens.

Summary

Keystone access controls could be circumvented via EC2-style tokens.

Software Description:

- keystone: OpenStack identity service

Details:

Steven Hardy discovered that Keystone did not properly enforce trusts when

using the ec2tokens API. An authenticated attacker could exploit this to

retrieve a token not scoped to the trust and elevate privileges to the

trustor's roles.

Topics%20covered

Topics Covered

security advisory critical access control ubuntu keystone token exploitation

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.10:
  python-keystone                 1:2013.2-0ubuntu1.2

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2061-1

CVE-2013-6391

Severity
critical
Lowest
Low
Medium
High
Critical

=========================================================================Ubuntu Security Notice USN-2061-1

Topics%20covered

Topics Covered

security advisory critical access control ubuntu keystone token exploitation

Package Information

https://launchpad.net/ubuntu/+source/keystone/1:2013.2-0ubuntu1.2

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.