Vulnerability Name:

CVE-2014-0187 (CCN-92729)

Assigned:2013-12-03
Published:2014-04-22
Updated:2018-10-30
Summary:The openvswitch-agent process in OpenStack Neutron 2013.1 before 2013.2.4 and 2014.1 before 2014.1.1 allows remote authenticated users to bypass security group restrictions via an invalid CIDR in a security group rule, which prevents further rules from being applied.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:9.0 High (CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C)
6.7 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-264
Vulnerability Consequences:Bypass Security
References:Source: MITRE
Type: CNA
CVE-2014-0187

Source: SUSE
Type: UNKNOWN
openSUSE-SU-2014:1051

Source: CCN
Type: oss-security Mailing List, Tue 22 Apr 2014
[OSSA 2014-014] Neutron security groups bypass through invalid CIDR (CVE-2014-0187)

Source: CCN
Type: SA58228
OpenStack Neutron CIDR openvswitch-agent Security Bypass Security Issue

Source: SECUNIA
Type: UNKNOWN
59533

Source: MLIST
Type: UNKNOWN
[oss-security] 20140422 [OSSA 2014-014] Neutron security groups bypass through invalid CIDR (CVE-2014-0187)

Source: CCN
Type: BID-67012
OpenStack Neutron CVE-2014-0187 CIDR Security Bypass Vulnerability

Source: UBUNTU
Type: UNKNOWN
USN-2255-1

Source: CCN
Type: OSSA 2014-014
neutron allows security group rules with invalid cidrs, resulting in broken iptables rules (breaking iptables-restore) (CVE-2014-0187)

Source: CONFIRM
Type: Vendor Advisory
https://bugs.launchpad.net/neutron/+bug/1300785

Source: XF
Type: UNKNOWN
neutron-cve20140187-sec-bypass(92729)

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2014-0187

Vulnerable Configuration:Configuration 1:
  • cpe:/a:openstack:neutron:2013.1:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:neutron:2013.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:neutron:2013.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:neutron:2013.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:neutron:2013.1.4:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:neutron:2013.1.5:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:neutron:2013.2:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:neutron:2013.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:neutron:2013.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:neutron:2013.2.3:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:neutron:2014.1:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
  • OR cpe:/o:opensuse:opensuse:13.1:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:openstack:neutron:2013.1:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:neutron:2013.2.3:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:neutron:2014.1:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:24192
    P
    		USN-2255-1 -- neutron vulnerabilities
    2014-08-11
    oval:com.ubuntu.trusty:def:20140187000
    V
    		CVE-2014-0187 on Ubuntu 14.04 LTS (trusty) - medium.
    2014-04-28
    BACK
    openstack neutron 2013.1
    openstack neutron 2013.1.1
    openstack neutron 2013.1.2
    openstack neutron 2013.1.3
    openstack neutron 2013.1.4
    openstack neutron 2013.1.5
    openstack neutron 2013.2
    openstack neutron 2013.2.1
    openstack neutron 2013.2.2
    openstack neutron 2013.2.3
    openstack neutron 2014.1
    canonical ubuntu linux 13.04
    canonical ubuntu linux 14.04
    opensuse opensuse 13.1
    openstack neutron 2013.1
    openstack neutron 2013.2.3
    openstack neutron 2014.1