CVE-2016-5363 OpenStack Neutron Intended MAC-spoofing protection mechanism bypass

What is CVE-2016-5363?

CVE-2016-5363 is a high-severity vulnerability in n/a, published on 17 Jun 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended MAC-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via (1) a crafted DHCP discovery message or (2) crafted non-IP traffic.

Weakness: CWE-254

Which versions are affected by CVE-2016-5363?

5 open source packages ship an affected version, including neutron. It affects 1 product.

Products include Openstack Neutron.

How do I fix CVE-2016-5363?

Upgrade neutron to a fixed version for your release line: 7.1.0 or 8.1.0.

Is CVE-2016-5363 being exploited?

There is no known exploitation of CVE-2016-5363 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2021-38598 OpenStack Neutron vulnerable to hardware address impersonation Critical 9.1
• CVE-2015-8914 OpenStack Neutron allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism Critical 9.1
• CVE-2016-5362 OpenStack Neutron allows remote attackers to bypass an intended DHCP-spoofing protection mechanism High 8.2
• CVE-2014-3632 Privilege escalation in n/a High 7.6
• CVE-2021-20267 Openstack Neutron has Insufficient Verification of IPv6 addresses High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2016-5363, GHSA-9pp3-cvmq-9p22, PYSEC-2026-852.