Information disclosure in Cinder



Published: 2014-10-08 | Updated: 2020-08-10
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2014-3641
CWE-ID CWE-200
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		Cinder
Server applications / Other server solutions

Vendor Openstack

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Information disclosure

EUVDB-ID: #VU41231

Risk: Low

CVSSv3.1: 1.3 [CVSS:3.1/AV:N/AC:L/PR:/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2014-3641

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote #AU# to gain access to sensitive information.

The (1) GlusterFS and (2) Linux Smbfs drivers in OpenStack Cinder before 2014.1.3 allows remote authenticated users to obtain file data from the Cinder-volume host by cloning and attaching a volume with a crafted qcow2 header.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Cinder: 2014.1.1

CPE2.3 External links

http://rhn.redhat.com/errata/RHSA-2014-1787.html
http://rhn.redhat.com/errata/RHSA-2014-1788.html
http://seclists.org/oss-sec/2014/q4/78
http://www.securityfocus.com/bid/70221
http://www.ubuntu.com/usn/USN-2405-1
http://bugs.launchpad.net/cinder/+bug/1350504


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###