| Vulnerability Name: | CVE-2014-0592 (CCN-92210) | ||||||||
| Assigned: | 2013-12-28 | ||||||||
| Published: | 2014-03-26 | ||||||||
| Updated: | 2014-04-04 | ||||||||
| Summary: | Barclamp (aka barclamp-network) 1.7 for the Crowbar Framework, as used in SUSE Cloud 3, does not enable netfilter on bridges when creating new instances, which allows remote attackers to bypass security group restrictions via unspecified vectors, related to floating IPs. | ||||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
| ||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P) 5.5 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-264 | ||||||||
| Vulnerability Consequences: | Bypass Security | ||||||||
| References: | Source: MITRE Type: CNA CVE-2014-0592 Source: SUSE Type: Patch, Vendor Advisory SUSE-SU-2014:0452 Source: SECUNIA Type: Vendor Advisory 57509 Source: BID Type: UNKNOWN 66519 Source: CCN Type: BID-66519 SUSE Cloud Security Group Handling Security Bypass Vulnerability Source: CCN Type: Novell Bugzilla Bug #864183 CVE-2014-0592: crowbar-barclamp-network: SUSE Cloud 3 doesn't enforce security groups Source: CONFIRM Type: UNKNOWN https://bugzilla.novell.com/show_bug.cgi?id=864183 Source: XF Type: UNKNOWN suse-cloud-cve20140592-sec-bypass(92210) Source: CONFIRM Type: UNKNOWN https://github.com/crowbar/barclamp-network/pull/269 Source: CCN Type: SUSE-SU-2014:0452-1 SUSE Security Update: Security update for crowbar-barclamp-network | ||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||
| BACK | |||||||||