#VU14543 Security restrictions bypass in Ceph - CVE-2018-1129
Published: August 28, 2018
Vulnerability identifier: #VU14543
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2018-1129
CWE-ID: CWE-264
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerable software:
Ceph
Ceph
Software vendor:
Red Hat Inc.
Red Hat Inc.
Description
The vulnerability allows an adjacent attacker to bypass security restrictions on the target system.
The vulnerability exists in ceph branches master, mimic, luminous and jewel due to improper handling of signature calculation by cephx authentication protocol. An adjacent attacker with access to ceph cluster network who is able to alter the message payload can bypass signature checks done by cephx protocol to conduct further attacks.
Remediation
Install update from vendor's website.