CVE-2013-0208 Missing authorization in n/a

Medium 6.5 Published 13 Feb 2013 Updated 6 Aug 2024

Authenticated users can access other users' volumes by manipulating volume IDs, leading to unauthorized data access and modification.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2013-0208?

CVE-2013-0208 is a medium-severity missing authorization vulnerability in Canonical Ubuntu Linux, published on 13 Feb 2013. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The boot-from-volume feature in OpenStack Compute (Nova) Folsom and Essex, when using nova-volumes, allows remote authenticated users to boot from other users' volumes via a volume id in the block_device_mapping parameter.

Weakness: CWE-264

Which versions are affected by CVE-2013-0208?

It affects 3 products.

Linux distribution packages (12)

`openstack-nova` Red Hat:openstack:2::el6	All versions	`0:2012.2.2-8.el6ost`
`openstack-nova-api` Red Hat:openstack:2::el6	All versions	`0:2012.2.2-8.el6ost`
`openstack-nova-cert` Red Hat:openstack:2::el6	All versions	`0:2012.2.2-8.el6ost`
`openstack-nova-common` Red Hat:openstack:2::el6	All versions	`0:2012.2.2-8.el6ost`
`openstack-nova-compute` Red Hat:openstack:2::el6	All versions	`0:2012.2.2-8.el6ost`
`openstack-nova-console` Red Hat:openstack:2::el6	All versions	`0:2012.2.2-8.el6ost`
`openstack-nova-doc` Red Hat:openstack:2::el6	All versions	`0:2012.2.2-8.el6ost`
`openstack-nova-network` Red Hat:openstack:2::el6	All versions	`0:2012.2.2-8.el6ost`
`openstack-nova-objectstore` Red Hat:openstack:2::el6	All versions	`0:2012.2.2-8.el6ost`
`openstack-nova-scheduler` Red Hat:openstack:2::el6	All versions	`0:2012.2.2-8.el6ost`
`openstack-nova-volume` Red Hat:openstack:2::el6	All versions	`0:2012.2.2-8.el6ost`
`python-nova` Red Hat:openstack:2::el6	All versions	`0:2012.2.2-8.el6ost`

Products include Canonical Ubuntu Linux, Openstack Essex, Openstack Folsom.

How do I fix CVE-2013-0208?

Apply the vendor's patch.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2013-0208 being exploited?

There is no known exploitation of CVE-2013-0208 in the wild and no public exploit code.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2013-0208, GHSA-rr64-vh7q-pgrf, RHSA-2013:0208.