Test ID:	1.3.6.1.4.1.25623.1.0.842033
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-2405-1)
Summary:	The remote host is missing an update for the 'cinder' package(s) announced via the USN-2405-1 advisory.
Description:	Summary: The remote host is missing an update for the 'cinder' package(s) announced via the USN-2405-1 advisory. Vulnerability Insight: Duncan Thomas discovered that OpenStack Cinder did not properly track the file format when using the GlusterFS of Smbfs drivers. A remote authenticated user could exploit this to potentially obtain file contents from the compute host. (CVE-2014-3641) Amrith Kumar discovered that OpenStack Cinder did not properly sanitize log message contents. Under certain circumstances, a local attacker with read access to Cinder log files could obtain access to sensitive information. (CVE-2014-7230) Affected Software/OS: 'cinder' package(s) on Ubuntu 14.04. Solution: Please install the updated package(s). CVSS Score: 4.0 CVSS Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2014-3641 70221 http://www.securityfocus.com/bid/70221 RHSA-2014:1787 http://rhn.redhat.com/errata/RHSA-2014-1787.html RHSA-2014:1788 http://rhn.redhat.com/errata/RHSA-2014-1788.html USN-2405-1 http://www.ubuntu.com/usn/USN-2405-1 [oss-security] 20141002 [OSSA 2014-033] Cinder-volume host data leak to vm instance (CVE-2014-3641) http://seclists.org/oss-sec/2014/q4/78 https://bugs.launchpad.net/cinder/+bug/1350504 Common Vulnerability Exposure (CVE) ID: CVE-2014-7230 BugTraq ID: 70185 http://www.securityfocus.com/bid/70185 http://seclists.org/oss-sec/2014/q3/853 RedHat Security Advisories: RHSA-2014:1939 http://rhn.redhat.com/errata/RHSA-2014-1939.html XForce ISS Database: openstack-cinder-cve20147230-info-disc(96725) https://exchange.xforce.ibmcloud.com/vulnerabilities/96725
Copyright	Copyright (C) 2014 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.