PT-2013-3500

CVE-2013-1977

Published

2013-05-21

Updated

2013-05-22

Description by

CVSS 2.0

2.1

Low

MetricsAV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenStack devstack (affected versions not specified)

Description The issue allows local users to obtain sensitive information, including the LDAP password and admin token secret, by reading the keystone.conf file due to its world-readable permissions.

Recommendations For devstack, consider changing the permissions of the keystone.conf file to restrict read access to authorized users only, until a more permanent fix is available.

Exploitability

Exploit

Fix

Researchers

Vendors

Affected products

Weakness enumeration

CWE-264