Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found -7 articles for you...
172
security advisoryubuntuimpersonationUbuntu 13.04 Security Notice USN-1875-1: Keystone Token Issues
Keystone did not always properly verify expired PKI tokens or properly authenticate users.. =========================================================================Ubuntu Security Notice USN-1875-1 June 14, 2013 keystone vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 13.04 - Ubuntu 12.10 Summary: Keystone did not always properly verify expired PKI tokens or properly authenticate users. Software Description: - keystone: OpenStack identity service Details: Eoghan Glynn and Alex Meade discovered that Keystone did not properly perform expiry checks for the PKI tokens used in Keystone. If Keystone were setup to use PKI tokens, a previously authenticated user could continue to use a PKI token for longer than intended. This issue only affected Ubuntu 12.10 which does not use PKI tokens by default. (CVE-2013-2104) Jose Castro Leon discovered that Keystone did not properly authenticate users when using the LDAP backend. An attacker could obtain valid tokens and impersonate other users by supplying an empty password. By default, Ubuntu does not use the LDAP backend. (CVE-2013-2157) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 13.04: python-keystone 1:2013.1.1-0ubuntu2.1 Ubuntu 12.10: python-keystone 2012.2.4-0ubuntu3.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-1875-1 CVE-2013-2104, CVE-2013-2157 Package Information: https://launchpad.net/ubuntu/+source/keystone/1:2013.1.1-0ubuntu2.1 https://launchpad.net/ubuntu/+source/keystone/2012.2.4-0ubuntu3.1 . Ubuntu 12.10 and 13.04 have critical vulnerabilities in Keystone affecting authentication and access control. Key vulnerabilities and mitigation strategies to consider.. OpenStackKeystone, User Authentication, Token Expiration. . Severity: Important. LinuxSecurity.com Team
Jun 14, 2013
•Important
Ubuntu
172
security advisoryremote accessubuntuUbuntu 12.04 LTS USN-1552-1 Critical: Keystone Admin Access Flaws
Two security issues were fixed in OpenStack Keystone.. =========================================================================Ubuntu Security Notice USN-1552-1 September 03, 2012 keystone vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 12.04 LTS Summary: Two security issues were fixed in OpenStack Keystone. Software Description: - keystone: OpenStack identity service Details: Dolph Mathews discovered that OpenStack Keystone did not properly restrict to administrative users the ability to update users' tenants. A remote attacker that can reach the administrative API can use this to add any user to any tenant. (CVE-2012-3542) Derek Higgins discovered that OpenStack Keystone did not properly implement token expiration. A remote attacker could use this to continue to access an account that has been disabled or has a changed password. (CVE-2012-3426) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 12.04 LTS: keystone 2012.1+stable~20120824-a16a0ab9-0ubuntu2.1 python-keystone 2012.1+stable~20120824-a16a0ab9-0ubuntu2.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-1552-1 CVE-2012-3426, CVE-2012-3542 Package Information: https://launchpad.net/ubuntu/+source/keystone/2012.1+stable~20120824-a16a0ab9-0ubuntu2.1 . Recent vulnerabilities identified in OpenStack Keystone for Ubuntu 12.04 LTS highlight the need for prompt updates to safeguard against potential breaches.. OpenStack Security, Keystone Issues, Ubuntu Security Advisory. . Severity: Critical. LinuxSecurity.com Team
Sep 03, 2012
•Critical
Ubuntu
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!