Red Hat Ceph Storage 3 update for ceph
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2018-10861 CVE-2018-1128 CVE-2018-1129 |
| CWE-ID | CWE-20 CWE-264 |
| Exploitation vector | Local network |
| Public exploit | N/A |
| Vulnerable software |
Red Hat Ceph Storage Server applications / File servers (FTP/HTTP) Ceph Server applications / Other server solutions nfs-ganesha (Red Hat package) Operating systems & Components / Operating system package or component cephmetrics (Red Hat package) Operating systems & Components / Operating system package or component ceph-ansible (Red Hat package) Operating systems & Components / Operating system package or component |
| Vendor | Red Hat Inc. |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Security restrictions bypass
EUVDB-ID: #VU14329
Risk: Low
CVSSv4.0: 1.2 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2018-10861
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows an adjacent authenticated attacker to bypass security restrictions on the target system.
The vulnerability exists in ceph branches master, mimic, luminous and jewel due to improper handling of user-supplied requests by ceph mon. An adjacent attacker with read access to ceph can delete, create ceph storage pools and corrupt snapshot images.
MitigationInstall updates from vendor's website.
Red Hat Ceph Storage: 3
Ceph: before 12.2.4-30.el7cp
nfs-ganesha (Red Hat package): before 2.5.5-6.el7cp
cephmetrics (Red Hat package): before 1.0.1-1.el7cp
ceph-ansible (Red Hat package): before 3.0.39-1.el7cp
CPE2.3- cpe:2.3:a:red_hat:red_hat_ceph_storage:3:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:ceph:*:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:nfs-ganesha_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:cephmetrics_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:ceph-ansible_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2018:2177
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Security restrictions bypass
EUVDB-ID: #VU14542
Risk: Low
CVSSv4.0: 0.6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2018-1128
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows an adjacent attacker to conduct replay attack on the target system.
The vulnerability exists in ceph branches master, mimic, luminous and jewel due to cephx authentication protocol did not verify ceph clients correctly. An adjacent attacker with access to ceph cluster network who is able to sniff packets on network can authenticate with ceph service, perform actions allowed by ceph service, conduct replay attack and bypass security restrictions.
MitigationInstall updates from vendor's website.
Red Hat Ceph Storage: 3
Ceph: before 12.2.4-30.el7cp
nfs-ganesha (Red Hat package): before 2.5.5-6.el7cp
cephmetrics (Red Hat package): before 1.0.1-1.el7cp
ceph-ansible (Red Hat package): before 3.0.39-1.el7cp
CPE2.3- cpe:2.3:a:red_hat:red_hat_ceph_storage:3:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:ceph:*:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:nfs-ganesha_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:cephmetrics_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:ceph-ansible_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2018:2177
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Security restrictions bypass
EUVDB-ID: #VU14543
Risk: Low
CVSSv4.0: 0.6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2018-1129
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows an adjacent attacker to bypass security restrictions on the target system.
The vulnerability exists in ceph branches master, mimic, luminous and jewel due to improper handling of signature calculation by cephx authentication protocol. An adjacent attacker with access to ceph cluster network who is able to alter the message payload can bypass signature checks done by cephx protocol to conduct further attacks.
MitigationInstall updates from vendor's website.
Red Hat Ceph Storage: 3
Ceph: before 12.2.4-30.el7cp
nfs-ganesha (Red Hat package): before 2.5.5-6.el7cp
cephmetrics (Red Hat package): before 1.0.1-1.el7cp
ceph-ansible (Red Hat package): before 3.0.39-1.el7cp
CPE2.3- cpe:2.3:a:red_hat:red_hat_ceph_storage:3:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:ceph:*:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:nfs-ganesha_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:cephmetrics_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:ceph-ansible_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2018:2177
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
