Test ID:	1.3.6.1.4.1.25623.1.0.841662
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-2061-1)
Summary:	The remote host is missing an update for the 'keystone' package(s) announced via the USN-2061-1 advisory.
Description:	Summary: The remote host is missing an update for the 'keystone' package(s) announced via the USN-2061-1 advisory. Vulnerability Insight: Steven Hardy discovered that Keystone did not properly enforce trusts when using the ec2tokens API. An authenticated attacker could exploit this to retrieve a token not scoped to the trust and elevate privileges to the trustor's roles. Affected Software/OS: 'keystone' package(s) on Ubuntu 13.10. Solution: Please install the updated package(s). CVSS Score: 5.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2013-6391 56079 http://secunia.com/advisories/56079 56154 http://secunia.com/advisories/56154 64253 http://www.securityfocus.com/bid/64253 RHSA-2014:0089 http://rhn.redhat.com/errata/RHSA-2014-0089.html USN-2061-1 http://www.ubuntu.com/usn/USN-2061-1 [oss-security] 20131211 [OSSA 2013-032] Keystone trust circumvention through EC2-style tokens (CVE-2013-6391) http://www.openwall.com/lists/oss-security/2013/12/11/7 https://bugs.launchpad.net/keystone/+bug/1242597 keystone-cve20136391-sec-bypass(89657) https://exchange.xforce.ibmcloud.com/vulnerabilities/89657
Copyright	Copyright (C) 2013 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.