CVE-2013-6419 OpenStack Nova Router metadata queries are not restricted by tenant
Remote tenants can obtain sensitive metadata by spoofing device IDs due to missing instance ID validation in OpenStack Nova and Neutron.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-6419?
CVE-2013-6419 is a medium-severity vulnerability in n/a, published on 7 Jan 2014. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant making a request, which allows remote tenants to obtain sensitive metadata by spoofing the device ID that is bound to a port, which is not properly handled by (1) api/metadata/handler.py in Nova and (2) the neutron-metadata-agent (agent/metadata/agent.py) in Neutron.
Weakness: CWE-200
Which versions are affected by CVE-2013-6419?
3 open source packages ship an affected version, including nova. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nova PyPI | All versions | 12.0.0a0 |
nova PyPI | All versions | 12.0.0a0 |
nova PyPI | All versions | 12.0.0a0 |
Linux distribution packages (18)
openstack-neutron Red Hat:openstack:4::el6 | All versions | 0:2013.2.1-4.el6ost |
openstack-neutron-bigswitch Red Hat:openstack:4::el6 | All versions | 0:2013.2.1-4.el6ost |
openstack-neutron-brocade Red Hat:openstack:4::el6 | All versions | 0:2013.2.1-4.el6ost |
openstack-neutron-cisco Red Hat:openstack:4::el6 | All versions | 0:2013.2.1-4.el6ost |
openstack-neutron-hyperv Red Hat:openstack:4::el6 | All versions | 0:2013.2.1-4.el6ost |
openstack-neutron-linuxbridge Red Hat:openstack:4::el6 | All versions | 0:2013.2.1-4.el6ost |
openstack-neutron-mellanox Red Hat:openstack:4::el6 | All versions | 0:2013.2.1-4.el6ost |
openstack-neutron-metaplugin Red Hat:openstack:4::el6 | All versions | 0:2013.2.1-4.el6ost |
openstack-neutron-metering-agent Red Hat:openstack:4::el6 | All versions | 0:2013.2.1-4.el6ost |
openstack-neutron-midonet Red Hat:openstack:4::el6 | All versions | 0:2013.2.1-4.el6ost |
openstack-neutron-ml2 Red Hat:openstack:4::el6 | All versions | 0:2013.2.1-4.el6ost |
openstack-neutron-nec Red Hat:openstack:4::el6 | All versions | 0:2013.2.1-4.el6ost |
openstack-neutron-nicira Red Hat:openstack:4::el6 | All versions | 0:2013.2.1-4.el6ost |
openstack-neutron-openvswitch Red Hat:openstack:4::el6 | All versions | 0:2013.2.1-4.el6ost |
openstack-neutron-plumgrid Red Hat:openstack:4::el6 | All versions | 0:2013.2.1-4.el6ost |
openstack-neutron-ryu Red Hat:openstack:4::el6 | All versions | 0:2013.2.1-4.el6ost |
openstack-neutron-vpn-agent Red Hat:openstack:4::el6 | All versions | 0:2013.2.1-4.el6ost |
python-neutron Red Hat:openstack:4::el6 | All versions | 0:2013.2.1-4.el6ost |
Products include Openstack Havana.
How do I fix CVE-2013-6419?
Upgrade nova to 12.0.0a0 or later.
Is CVE-2013-6419 being exploited?
There is no known exploitation of CVE-2013-6419 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2013-6419, GHSA-22w9-j288-8p9w, PYSEC-2026-858, RHSA-2014:0091.