Vulnerability   
Search   
    Search 191973 CVE descriptions
and 86218 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.702737
Category:Debian Local Security Checks
Title:Debian Security Advisory DSA 2737-1 (swift - several vulnerabilities)
Summary:Several vulnerabilities have been discovered in Swift, the Openstack;object storage. The Common Vulnerabilities and Exposures project;identifies the following problems:;;CVE-2013-2161;Alex Gaynor from Rackspace reported a vulnerability in XML;handling within Swift account servers. Account strings were;unescaped in xml listings, and an attacker could potentially;generate unparsable or arbitrary XML responses which may be;used to leverage other vulnerabilities in the calling software.;;CVE-2013-4155;Peter Portante from Red Hat reported a vulnerability in Swift.;By issuing requests with an old X-Timestamp value, an;authenticated attacker can fill an object server with superfluous;object tombstones, which may significantly slow down subsequent;requests to that object server, facilitating a Denial of Service;attack against Swift clusters.
Description:Summary:
Several vulnerabilities have been discovered in Swift, the Openstack
object storage. The Common Vulnerabilities and Exposures project
identifies the following problems:

CVE-2013-2161
Alex Gaynor from Rackspace reported a vulnerability in XML
handling within Swift account servers. Account strings were
unescaped in xml listings, and an attacker could potentially
generate unparsable or arbitrary XML responses which may be
used to leverage other vulnerabilities in the calling software.

CVE-2013-4155
Peter Portante from Red Hat reported a vulnerability in Swift.
By issuing requests with an old X-Timestamp value, an
authenticated attacker can fill an object server with superfluous
object tombstones, which may significantly slow down subsequent
requests to that object server, facilitating a Denial of Service
attack against Swift clusters.

Affected Software/OS:
swift on Debian Linux

Solution:
For the stable distribution (wheezy), these problems have been fixed in
version 1.4.8-2+deb7u1.

For the unstable distribution (sid), these problems have been fixed in
version 1.8.0-6.

We recommend that you upgrade your swift packages.

CVSS Score:
7.5

CVSS Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2013-2161
Debian Security Information: DSA-2737 (Google Search)
http://www.debian.org/security/2012/dsa-2737
http://www.openwall.com/lists/oss-security/2013/06/13/4
RedHat Security Advisories: RHSA-2013:0993
http://rhn.redhat.com/errata/RHSA-2013-0993.html
SuSE Security Announcement: openSUSE-SU-2013:1146 (Google Search)
http://lists.opensuse.org/opensuse-updates/2013-07/msg00021.html
Common Vulnerability Exposure (CVE) ID: CVE-2013-4155
https://review.openstack.org/#/c/40643/
https://review.openstack.org/#/c/40645/
https://review.openstack.org/#/c/40646/
http://www.openwall.com/lists/oss-security/2013/08/07/6
RedHat Security Advisories: RHSA-2013:1197
http://rhn.redhat.com/errata/RHSA-2013-1197.html
http://www.ubuntu.com/usn/USN-2001-1
CopyrightCopyright (C) 2013 Greenbone Networks GmbH http://greenbone.net

This is only one of 86218 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2020 E-Soft Inc. All rights reserved.