Stay Secure with the Latest Linux Advisories

security advisorycriticalaccess control

Ubuntu 13.10 USN-2061-1 Critical: Keystone Token Exploitation

Keystone access controls could be circumvented via EC2-style tokens.. =========================================================================Ubuntu Security Notice USN-2061-1 December 19, 2013 keystone vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 13.10 Summary: Keystone access controls could be circumvented via EC2-style tokens. Software Description: - keystone: OpenStack identity service Details: Steven Hardy discovered that Keystone did not properly enforce trusts when using the ec2tokens API. An authenticated attacker could exploit this to retrieve a token not scoped to the trust and elevate privileges to the trustor's roles. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 13.10: python-keystone 1:2013.2-0ubuntu1.2 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-2061-1 CVE-2013-6391 Package Information: https://launchpad.net/ubuntu/+source/keystone/1:2013.2-0ubuntu1.2 . Ubuntu's bypass of Keystone access control influences EC2 token implementations. Immediate patch recommended.. Keystone Exploit, Ubuntu Security Update, Access Control Vulnerability. . Severity: Critical. LinuxSecurity.com Team

Dec 19, 2013 •Critical Ubuntu