Stay Secure with the Latest Linux Advisories

security advisoryremote attackmoderate severity

Ubuntu 11.04: USN-1137-1 Moderate: Eucalyptus Command Injection

An attacker could send crafted input to Eucalyptus to run commands as a valid user.. =========================================================================Ubuntu Security Notice USN-1137-1 May 26, 2011 eucalyptus, rampart vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 11.04 - Ubuntu 10.10 - Ubuntu 10.04 LTS Summary: An attacker could send crafted input to Eucalyptus to run commands as a valid user. Software Description: - eucalyptus: Elastic Utility Computing Architecture - rampart: Apache web services security engine Details: Juraj Somorovsky, Jorg Schwenk, Meiko Jensen and Xiaofeng Lou discovered that Eucalyptus did not properly validate SOAP requests. An unauthenticated remote attacker could exploit this to submit arbitrary commands to the Eucalyptus SOAP interface in the context of an authenticated user. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 11.04: eucalyptus-cloud 2.0.1+bzr1256-0ubuntu4.1 librampart0 1.3.0-1ubuntu2.1 Ubuntu 10.10: eucalyptus-cloud 2.0+bzr1241-0ubuntu4.2 librampart0 1.3.0-1ubuntu1.1 Ubuntu 10.04 LTS: eucalyptus-cloud 1.6.2-0ubuntu30.5 librampart0 1.3.0-0ubuntu7.1 In general, a standard system update will make all the necessary changes. References: CVE-2011-0730 Package Information: https://launchpad.net/ubuntu/+source/eucalyptus/2.0.1+bzr1256-0ubuntu4.1 https://launchpad.net/ubuntu/+source/rampart/1.3.0-1ubuntu2.1 https://launchpad.net/ubuntu/+source/eucalyptus/2.0+bzr1241-0ubuntu4.2 https://launchpad.net/ubuntu/+source/rampart/1.3.0-1ubuntu1.1 https://launchpad.net/ubuntu/+source/eucalyptus/1.6.2-0ubuntu30.5 https://launchpad.net/ubuntu/+source/rampart/1.3.0-0ubuntu7.1 . Thisannouncement addresses a vulnerability in Eucalyptus on Ubuntu platforms that permits remote attackers to execute commands.. Eucalyptus Vulnerability, Remote Command Injection, Ubuntu Security Advisory. . LinuxSecurity.com Team

May 26, 2011 Ubuntu