CVE-2014-3703 Security feature bypass in n/a
Remote attackers can bypass access restrictions because the firewall is disabled when the OVS monolithic plug-in is not used.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-3703?
CVE-2014-3703 is a medium-severity vulnerability in n/a, published on 2 Dec 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenStack PackStack 2012.2.1, when the Open vSwitch (OVS) monolithic plug-in is not used, does not properly set the libvirt_vif_driver configuration option when generating the nova.conf configuration, which causes the firewall to be disabled and allows remote attackers to bypass intended access restrictions.
Weakness: CWE-264
Which versions are affected by CVE-2014-3703?
It affects 1 product.
Linux distribution packages (3)
openstack-packstack Red Hat:openstack:4::el6 | All versions | 0:2013.2.1-0.33.dev1048.el6ost |
openstack-packstack-doc Red Hat:openstack:4::el6 | All versions | 0:2013.2.1-0.33.dev1048.el6ost |
openstack-packstack-puppet Red Hat:openstack:4::el6 | All versions | 0:2013.2.1-0.33.dev1048.el6ost |
Products include Redhat Packstack.
How do I fix CVE-2014-3703?
Apply the vendor's patch.
Is CVE-2014-3703 being exploited?
There is no known exploitation of CVE-2014-3703 in the wild and no public exploit code.
Sources
Also known as GHSA-47pg-jr9r-j5r6, RHSA-2014:1691.