CVE-2012-3542 OpenStack Keystone Allows Remote User Account Creation

What is CVE-2012-3542?

CVE-2012-3542 is a medium-severity missing authorization vulnerability in n/a, published on 5 Sep 2012. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API. NOTE: this identifier was originally incorrectly assigned to an open redirect issue, but the correct identifier for that issue is CVE-2012-3540.

Weakness: CWE-264

Which versions are affected by CVE-2012-3542?

3 open source packages ship an affected version, including keystone. It affects 2 products.

Products include Openstack Essex, Openstack Horizon.

How do I fix CVE-2012-3542?

Upgrade keystone to 2012.1 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2012-3542 being exploited?

There is no known exploitation of CVE-2012-3542 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2013-0261 Packstack: packstack: arbitrary file overwrite via symlink attack High 8.8
• CVE-2013-0266 Information disclosure in Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse) Medium 5.5
• CVE-2012-4573 OpenStack Glance arbitrary deletion of non-protected images Medium 5.5
• CVE-2012-5482 OpenStack Glance arbitrary deletion of non-protected images Medium 5.5
• CVE-2012-3360 OpenStack Nova Directory traversal vulnerability Medium 5.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2012-3542, GHSA-gf2q-j2qq-pjf2, PYSEC-2012-19.