Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 525
Alerts This Week
Warning Icon 1 525

Ubuntu 14.04 LTS USN-2321-1 Moderate: OpenStack Neutron DoS Risk

ubuntu
Calendar Grey August 21, 2014
Scroller Ubuntu
Ubuntu 14.04 LTS faces information leakage and denial of service threats due to OpenStack Neutron security flaws.
OpenStack Neutron could be made to expose sensitive information or crash.

Summary

OpenStack Neutron could be made to expose sensitive information or crash.

Software Description:

- neutron: OpenStack Virtual Network Service

Details:

Liping Mao discovered that OpenStack Neutron did not properly handle

requests for a large number of allowed address pairs. A remote

authenticated attacker could exploit this to cause a denial of service.

(CVE-2014-3555)

Zhi Kun Liu discovered that OpenStack Neutron incorrectly filtered certain

tokens. An attacker could possibly use this issue to obtain authentication

tokens used in REST requests. (CVE-2014-4615)

Topics%20covered

Topics Covered

security advisory moderate DoS Ubuntu information exposure OpenStack

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
  neutron-common                  1:2014.1.2-0ubuntu1.1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2321-1

CVE-2014-3555, CVE-2014-4615

=========================================================================Ubuntu Security Notice USN-2321-1

Topics%20covered

Topics Covered

security advisory moderate DoS Ubuntu information exposure OpenStack

Package Information

https://launchpad.net/ubuntu/+source/neutron/1:2014.1.2-0ubuntu1.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.