CVE-2015-3156

Name of the Vulnerable Software and Affected Versions Openstack DBaaS (aka Trove) versions prior to 2015.1.0 (aka Kilo)

Description The issue allows local users to write to configuration files via a symlink attack on a temporary file. This is due to vulnerabilities in several functions, including write config, reset configuration, write config, write mycnf, InnoBackupEx:: run prepare, InnoBackupEx::cmd, MySQLDump::cmd, InnoBackupExIncremental::cmd, get actual db status, and multiple class CbBackup methods.

Recommendations For versions prior to 2015.1.0 (aka Kilo), update to version 2015.1.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable functions and classes until a patch is available. Avoid using the affected functions and classes in the trove/guestagent/datastore/experimental and trove/guestagent/strategies/backup modules to minimize the risk of exploitation.