ESB-2017.2123 - [UNIX/Linux][Debian] aodh: Unauthorised access - Existing account 2017-08-24

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2017.2123
                           aodh security update
                              24 August 2017

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           aodh
Publisher:         Debian
Operating System:  Debian GNU/Linux 9
                   UNIX variants (UNIX, Linux, OSX)
Impact/Access:     Unauthorised Access -- Existing Account
Resolution:        Patch/Upgrade
CVE Names:         CVE-2017-12440  

Original Bulletin: 
   http://www.debian.org/security/2017/dsa-3953

Comment: This advisory references vulnerabilities in products which run on 
         platforms other than Debian. It is recommended that administrators 
         running aodh check for an updated version of the software for their
         operating system.

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- - -------------------------------------------------------------------------
Debian Security Advisory DSA-3953-1                   security@debian.org
https://www.debian.org/security/                            Luciano Bello
August 23, 2017                       https://www.debian.org/security/faq
- - -------------------------------------------------------------------------

Package        : aodh
CVE ID         : CVE-2017-12440
Debian Bug     : 872605

Zane Bitter from Red Hat discovered a vulnerability in Aodh, the alarm
engine for OpenStack. Aodh does not verify that the user creating the
alarm is the trustor or has the same rights as the trustor, nor that the
trust is for the same project as the alarm. The bug allows that an
authenticated users without a Keystone token with knowledge of trust IDs
to perform unspecified authenticated actions by adding alarm actions.

For the stable distribution (stretch), this problem has been fixed in
version 3.0.0-4+deb9u1.

We recommend that you upgrade your aodh packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEayzFlnvRveqeWJspbsLe9o/+N3QFAlmd3fYACgkQbsLe9o/+
N3Se8xAAimg7Xo4NfIIGKBctTpzCv5cmxC49w4NqeC37a2uaLPOA3DLU/WV30S13
st+NelwaFHrhE/hXgiWgoGi1p2b2v4Gs/C//NO70qNoXIRePs76+ic7RWAAB9ddI
J7n1CiTUtNisILP6EmhEoOd6kSReCc34jUc7s2YPr0DS0ziEcOJrR8X2SfK621zs
nfxPGMUMBE5+Fk9gOrXz1zCJguGvIQBRnSNQjLf8eFZvva0e2nAulIvq6buvKW2B
9ZftuNHQnpW3/k+1kDZ7FqMTvFsC5gQdEF9c+qmZd54lyb5qWgds9W2Xh3meQZDM
oq64lGSozMcFIfeLLFfCktQfpmxInIHsjT+DK8FnAr3UgGD6zhCJMTNIxP6p+3xB
2Y2z+PUFMumpWNOtb3o/9DEauL1v5BxCTRLr7C0sr0MLdypm6JmH+ASv5FaKN8o4
i9mgabqext57ejKVqOhDGTcZJJB3uN6N8WeOTt/E3bU22kSN9H8BeBX9RHsgVnsF
wehYkH1qEynb+E6dA6o0epMX/Of926PTeUsu+3ipPZWALM/dSvjkwdr+LRjDt8w4
sd5k//1SH9SnUQTiPDrEk2hu/HEj01HGrhh8eJNn9+2Zq7+ZmFUgiPduyFWlEoBk
Ky5zI5NtuTvgW1OjH+GX1tZNc8EPzPDlapB1I+RvCUITQWVtDlQ=
=OTsW
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWZ4PbIx+lLeg9Ub1AQjXcQ//WuF3sSFywOMaOyLiT/rAvKQ1LfVr7T/j
CHUjCSUIemmhlFQJ5cj79ZJTK1Wm5XQjmn6blljitqqrd5owkiMluA9d8NtGyQHf
n5KAjnKXr/pZS2MXx8gi7GYFllcvDe2YEPSBuIJjmEXXARK0PKYWryIdSYZM/flT
ZzdygmihjnLRFPdU8S0X1qXg4Pchc4TUeH7iarpOagZC3sJmRhGI3e4t1K1QTTOx
xVHVanraKLa0ulxORKlu8iOKME73Wce388e6/IvahHo+tng3iwVT3uCk7fOX8J52
6YhM/mrex2+a83Gx4r+javXPeO1T0Yd1o6Bgud3S3p5Mwb6JAAly7gTteAqQQ+Dn
d0Z/UyqHlWjE8CfgYeqB4CJY5QVZkGy9EhWF2+YlEo+Dm1nk7+EIwN0LcyFCafft
FZc3RpSnR12bxFAREhug7oG8d5N/crbxpGfPgoYnaq5TXJbY36ERn3IOwCPVCHcH
Rs+v8gFASnZBPIfM/rby1Mfy7tZr0P8F8HNa1/nyPK+SHW6xiM4ipdpTabba8LUl
bxDrsCpIFVpH1UGdyrl/Yk922hvvPZCV1rPYg/wST2Uwq0GmD5Yumca3plLn7MwX
++BptQxlYqUuKT4MQTAYhj220rhw++WLRGw3YS4soJqFoItvYjwYoheEnfB3xVna
oBwqrsw1yg0=
=JhBT
-----END PGP SIGNATURE-----

« Back to bulletins