Risks
Advisories
Browse
or
or
Ubuntu Security Notice - keystone vulnerabilities (USN-1730-1)
==========================================================================
Ubuntu Security Notice USN-1730-1
February 20, 2013

keystone vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.10
- Ubuntu 12.04 LTS

Summary:

Keystone could be made to crash or expose sensitive information over the
network.

Software Description:
- keystone: OpenStack identity service

Details:

Nathanael Burton discovered that Keystone did not properly verify disabled
users. An authenticated but disabled user would continue to have access
rights that were removed. (CVE-2013-0282)

Jonathan Murray discovered that Keystone would allow XML entity processing.
A remote unauthenticated attacker could exploit this to cause a denial of
service via resource exhaustion. Authenticated users could also use this to
view arbitrary files on the Keystone server. (CVE-2013-1664, CVE-2013-1665)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.10:
  python-keystone                 2012.2.1-0ubuntu1.2

Ubuntu 12.04 LTS:
  python-keystone                 2012.1+stable~20120824-a16a0ab9-0ubuntu2.5

In general, a standard system update will make all the necessary changes.

References:
  http://www.ubuntu.com/usn/usn-1730-1
  CVE-2013-0282, CVE-2013-1664, CVE-2013-1665

Package Information:
  https://launchpad.net/ubuntu/+source/keystone/2012.2.1-0ubuntu1.2

https://launchpad.net/ubuntu/+source/keystone/2012.1+stable~20120824-a16a0ab9-0ubuntu
2.5




Spotlight

eBook: Cybersecurity for Dummies

Posted on 16 December 2014.  |  APTs have changed the world of enterprise security and how networks and organizations are attacked. These threats, and the cybercriminals behind them, are experts at remaining hidden from traditional security while exhibiting an intelligence, resiliency, and patience that has never been seen before.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  
DON'T
MISS

Thu, Dec 18th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //