Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found -6 articles for you...
98
security advisoryred hatbug fixRed Hat: RHSA-2014:1781-01 Critical: nova VMware Driver Vulnerabilities
Updated openstack-nova packages that fix two security issues, multiple bugs, and add enhancements are now available for Red Hat Enterprise Linux OpenStack Platform 5.0 for Red Hat Enterprise Linux 6. [More...]. ==================================================================== Red Hat Security Advisory Synopsis: Important: openstack-nova security, bug fix, and enhancement update Advisory ID: RHSA-2014:1781-01 Product: Red Hat Enterprise Linux OpenStack Platform Advisory URL: https://access.redhat.com/errata/RHSA-2014:1781.html Issue date: 2014-11-03 CVE Names: CVE-2014-3608 CVE-2014-8750 ==================================================================== 1. Summary: Updated openstack-nova packages that fix two security issues, multiple bugs, and add enhancements are now available for Red Hat Enterprise Linux OpenStack Platform 5.0 for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux OpenStack Platform 5.0 for RHEL 6 - noarch 3. Description: OpenStack Compute (nova) launches and schedules large networks of virtual machines, creating a redundant and scalable cloud computing platform. Compute provides the software, control panels, and APIs required to orchestrate a cloud, including running virtual machine instances, managing networks, and controlling access through users and projects. A race condition flaw was found in the way the nova VMware driver handled VNC port allocation. An authenticated user could use this flaw to gain unauthorized console access to instances belonging to other tenants by repeatedly spawning new instances. Note that only nova setups using the VMware driver and the VNC proxy service were affected.(CVE-2014-8750) CVE-2014-2573, the fix for which was provided with the initial release of Red Hat Enterprise Linux OpenStack Platform 5.0 for Red Hat Enterprise Linux 6, describes a flaw in the nova VMware driver. An authenticated user could exceed their quota by placing an image into rescue and then deleting it, causing the rescue image to be left behind. It was found that the fix for CVE-2014-2573 was incomplete. A virtual machine could be forced into the ERROR state from rescue by issuing a suspend command. Virtual machines deleted from the ERROR state would still leave the rescue image behind, allowing a user to exceed their quota. Note that only setups using the nova VMware driver were affected. (CVE-2014-3608) The CVE-2014-3608 issue was discovered by Garth Mollett of Red Hat Product Security. The openstack-nova packages have been upgraded to upstream version 2014.1.3, which provides a number of bug fixes and enhancements over the previous version. (BZ#1149749) All openstack-nova users are advised to upgrade to these updated packages, which correct these issues and add these enhancements. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1148253 - CVE-2014-3608 openstack-nova: incomplete fix for CVE-2014-2573, Nova VMware driver still leaks rescued images 1149749 - Rebase openstack-nova to 2014.1.3 1152346 - CVE-2014-8750 openstack-nova: Nova VMware driver may connect VNC to another tenant's console 6. Package List: Red Hat Enterprise Linux OpenStack Platform 5.0 for RHEL6: Source: openstack-nova-2014.1.3-4.el6ost.src.rpm noarch: openstack-nova-2014.1.3-4.el6ost.noarch.rpm openstack-nova-api-2014.1.3-4.el6ost.noarch.rpm openstack-nova-cells-2014.1.3-4.el6ost.noarch.rpm openstack-nova-cert-2014.1.3-4.el6ost.noarch.rpm openstack-nova-common-2014.1.3-4.el6ost.noarch.rpm openstack-nova-compute-2014.1.3-4.el6ost.noarch.rpm openstack-nova-conductor-2014.1.3-4.el6ost.noarch.rpm openstack-nova-console-2014.1.3-4.el6ost.noarch.rpm openstack-nova-doc-2014.1.3-4.el6ost.noarch.rpm openstack-nova-network-2014.1.3-4.el6ost.noarch.rpm openstack-nova-novncproxy-2014.1.3-4.el6ost.noarch.rpm openstack-nova-objectstore-2014.1.3-4.el6ost.noarch.rpm openstack-nova-scheduler-2014.1.3-4.el6ost.noarch.rpm python-nova-2014.1.3-4.el6ost.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2014-3608 https://access.redhat.com/security/cve/CVE-2014-8750 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. . Revised openstack-nova components address vulnerabilities and improve features for Red Hat OpenStack version 5.0.. Red Hat OpenStack, OpenStack Nova, Security Advisory. . Severity: Important. LinuxSecurity.com Team
Nov 03, 2014
•Important
Red Hat
98
security advisoryRed Hatbug fixRed Hat Enterprise: 2014:1689-01 Important OpenStack-Nova Console Risk
Updated openstack-nova packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux OpenStack Platform 4.0. [More...]. ==================================================================== Red Hat Security Advisory Synopsis: Important: openstack-nova security, bug fix, and enhancement update Advisory ID: RHSA-2014:1689-01 Product: Red Hat Enterprise Linux OpenStack Platform Advisory URL: https://access.redhat.com/errata/RHSA-2014:1689.html Issue date: 2014-10-22 CVE Names: CVE-2014-8750 ==================================================================== 1. Summary: Updated openstack-nova packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux OpenStack Platform 4.0. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux OpenStack Platform 4.0 - noarch 3. Description: OpenStack Compute (nova) launches and schedules large networks of virtual machines, creating a redundant and scalable cloud computing platform. Compute provides the software, control panels, and APIs required to orchestrate a cloud, including running virtual machine instances, managing networks, and controlling access through users and projects. A race condition flaw was found in the way the nova VMware driver handled VNC port allocation. An authenticated user could use this flaw to gain unauthorized console access to instances belonging to other tenants by repeatedly spawning new instances. Note that only nova setups using the VMware driver and the VNC proxy service were affected. (CVE-2014-8750) The openstack-nova packages have been upgraded to upstream version 2013.2.4, which provides a number ofbug fixes and enhancements over the previous version. (BZ#1146086) This update also fixes the following bug: * Prior to this update, certain RPC messages were not sending the correct data format when the version cap was set. During a live upgrade from Red Hat Enterprise Linux OpenStack Platform 4.0 to Red Hat Enterprise Linux OpenStack Platform 5.0, when there were Compute nodes running different versions of the code, some operations would fail on the Compute hosts that were not upgraded. With this update, proper version of the data is sent in all cases, and all RPC calls succeed during the live migration. (BZ#1083625) All openstack-nova users are advised to upgrade to these updated packages, which correct these issues and add these enhancements. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1083625 - Some operations broken during live upgrade from Havana to Icehouse 1098312 - FC cinder volumes still show mpath device on nova host after volumes are detached from instance. 1146086 - Rebase openstack-nova to 2013.2.4 1152346 - CVE-2014-8750 openstack-nova: Nova VMware driver may connect VNC to another tenant's console 6. Package List: Red Hat Enterprise Linux OpenStack Platform4.0: Source: openstack-nova-2013.2.4-2.el6ost.src.rpm noarch: openstack-nova-2013.2.4-2.el6ost.noarch.rpm openstack-nova-api-2013.2.4-2.el6ost.noarch.rpm openstack-nova-cells-2013.2.4-2.el6ost.noarch.rpm openstack-nova-cert-2013.2.4-2.el6ost.noarch.rpm openstack-nova-common-2013.2.4-2.el6ost.noarch.rpm openstack-nova-compute-2013.2.4-2.el6ost.noarch.rpm openstack-nova-conductor-2013.2.4-2.el6ost.noarch.rpm openstack-nova-console-2013.2.4-2.el6ost.noarch.rpm openstack-nova-doc-2013.2.4-2.el6ost.noarch.rpm openstack-nova-network-2013.2.4-2.el6ost.noarch.rpm openstack-nova-novncproxy-2013.2.4-2.el6ost.noarch.rpm openstack-nova-objectstore-2013.2.4-2.el6ost.noarch.rpm openstack-nova-scheduler-2013.2.4-2.el6ost.noarch.rpm python-nova-2013.2.4-2.el6ost.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2014-8750 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. . Uncover critical OpenStack notifications for Red Hat Enterprise, concerning vulnerabilities and patches related to openstack-nova.. OpenStack Security, Red Hat Updates, Cloud Vulnerability Management. . Severity: Important. LinuxSecurity.com Team
Oct 22, 2014
•Important
Red Hat
98
security advisoryRed HatcriticalRed Hat Linux 6.x RHSA-2000:044-02 Critical: Remote Access Issue
Workstations running a display manager may potentially allow remote users to access console devices.. ` --------------------------------------------------------------------- Red Hat, Inc. Security Advisory Synopsis: Updated PAM packages are available. Advisory ID: RHSA-2000:044-02 Issue date: 2000-07-21 Updated on: 2000-07-21 Product: Red Hat Linux Keywords: N/A Cross references: N/A --------------------------------------------------------------------- 1. Topic: Updated pam packages are available for Red Hat Linux 6.x. These packages fix a bug that would potentially allow remote users to access console devices and shut down the workstation if the workstation is running a display manager (xdm, gdm, kdm, etc.) with XDMCP enabled. 2. Relevant releases/architectures: Red Hat Linux 6.0 - i386, alpha, sparc Red Hat Linux 6.1 - i386, alpha, sparc Red Hat Linux 6.2 - i386, alpha, sparc 3. Problem description: If a workstation is configured to use a display manager (xdm, gdm, kdm, etc.) AND has XDMCP enabled, it is possible for a user who logs in remotely to use Xnest -query to log in on display :1, which is recognized as the system console. This is the documented behavior for Red Hat Linux 6.0, 6.1, and 6.2. This update disables this feature by default. Users of Red Hat Linux 5.x are not affected because the pam_console.so module was not included in releases prior to 6.0. 4. Solution: For each RPM for your particular architecture, run: rpm -Fvh [filename] where filename is the name of the RPM. 5. Bug IDs fixed ( for more info): 11165 - Gnome panel, ssh can allow remote non-root users to halt,reboot 12417 - man pages not installed properly in pam 12430 - /sbin/{pwdb,unix}_chkpwd not stripped 6. RPMs required: Red Hat Linux 6.2: sparc: alpha: i386: sources: 7. Verification: MD5 sum PackageName -------------------------------------------------------------------------- 1e0f9bd6ac389b40c90daba918c419eb 6.2/SRPMS/pam-0.72-20.src.rpm 8834754c1b0fd31ac4fa8f3e54bb7444 6.2/alpha/pam-0.72-20.alpha.rpm b0376fbeb5fa31b1ac118b1831185959 6.2/i386/pam-0.72-20.i386.rpm be592c19f8742f9dca85d6ef19cbfb80 6.2/sparc/pam-0.72-20.sparc.rpm These packages are GPG signed by Red Hat, Inc. for security. Our key is available at: You can verify each package with the following command: rpm --checksig If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: rpm --checksig --nogpg 8. References: N/A Copyright(c) 2000 Red Hat, Inc. `. PAM packages update mitigates critical remote access risk. Advisory ID: RHSA-2000:044-02 with remote console issue.. Red Hat Linux,PAM packages,remote access,console security,bug fix. . Severity: Critical. LinuxSecurity.com Team
Jul 22, 2000
•Critical
Red Hat
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!