Test ID:	1.3.6.1.4.1.25623.1.0.841635
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-2034-1)
Summary:	The remote host is missing an update for the 'keystone' package(s) announced via the USN-2034-1 advisory.
Description:	Summary: The remote host is missing an update for the 'keystone' package(s) announced via the USN-2034-1 advisory. Vulnerability Insight: Brant Knudson discovered a logic error in the LDAP backend in Keystone where removing a role on a tenant for a user who does not have that role would instead add the role to the user. An authenticated user could use this to gain privileges. Ubuntu is not configured to use the LDAP Keystone backend by default. Affected Software/OS: 'keystone' package(s) on Ubuntu 12.10, Ubuntu 13.04, Ubuntu 13.10. Solution: Please install the updated package(s). CVSS Score: 3.3 CVSS Vector: AV:L/AC:M/Au:N/C:P/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2013-4477 RHSA-2014:0113 http://rhn.redhat.com/errata/RHSA-2014-0113.html USN-2034-1 http://www.ubuntu.com/usn/USN-2034-1 [oss-security] 20131030 [OSSA 2013-028] Unintentional role granting with Keystone LDAP backend (CVE-2013-4477) http://www.openwall.com/lists/oss-security/2013/10/30/6 https://bugs.launchpad.net/keystone/+bug/1242855
Copyright	Copyright (C) 2013 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.