PT-2014-5460

CVE-2014-3703

·

Published

2014-12-02

·

Updated

2014-12-05

Description by

CVSS 2.0
5.0
Medium
MetricsAV:N/AC:L/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions OpenStack PackStack version 2012.2.1
Description The issue arises when the Open vSwitch (OVS) monolithic plug-in is not used, leading to improper setting of the libvirt vif driver configuration option in the nova.conf configuration. This results in the firewall being disabled, allowing remote attackers to bypass intended access restrictions.
Recommendations For OpenStack PackStack version 2012.2.1, ensure the libvirt vif driver configuration option is properly set in the nova.conf configuration to enable the firewall and prevent access restriction bypass.
Exploitability
Fix
Vendors
Affected products
Weakness enumeration
CWE-264
Related identifiers
CVE-2014-3703
RHSA-2014:1691
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com