CVE-2012-3361

Name of the Vulnerable Software and Affected Versions OpenStack Compute (Nova) versions 2011.3 through 2012.2

Description The issue allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image. This is possible due to a flaw in the virt/disk/api.py module.

Recommendations For OpenStack Compute (Nova) versions 2011.3 through 2012.2, consider restricting access to the virt/disk/api.py module to minimize the risk of exploitation. As a temporary workaround, avoid using the virt/disk/api.py module until a patch is available.