Compute CVE-2014-2573

LOW

Permissions, Privileges, and Access Controls (CWE-264)

2014-03-25 cve@mitre.org

Denial Of Service Privilege Escalation VMware Compute

2.3

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

2.3 LOW

AV:A/AC:M/Au:S/C:N/I:N/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:A/AC:M/Au:S/C:N/I:N/A:P

Attack Vector

Adjacent

Attack Complexity

M

Confidentiality

None

Integrity

None

Availability

P

Lifecycle Timeline

1

CVE Published

Mar 25, 2014 - 16:55 cve.org

LOW 2.3

DescriptionCVE.org

The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by requesting the VM be put into rescue and then deleting the image.

AnalysisAI

The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote authenticated users to bypass the quota limit and cause a. Rated low severity (CVSS 2.3).

Technical ContextAI

This vulnerability is classified under CWE-264. The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by requesting the VM be put into rescue and then deleting the image. Affected products include: Openstack Compute. Version information: through 2013.2.2.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Compute

View all

CVE-2012-2654 MEDIUM This Month POC

The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not prop

CVE-2013-4179 MEDIUM This Month POC

The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows re

CVE-2013-4185 MEDIUM This Month POC

Algorithmic complexity vulnerability in OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-3 does not pro

CVE-2012-3371 LOW Monitor POC

The Nova scheduler in OpenStack Compute (Nova) Folsom (2012.2) and Essex (2012.1), when DifferentHostFilter or SameHostF

CVE-2013-7130 HIGH This Week

The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver in OpenStack Compute (Nova) Gri

CVE-2014-0167 MEDIUM This Month

The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before ic

CVE-2015-2687 MEDIUM This Month

OpenStack Compute (nova) Icehouse, Juno and Havana when live migration fails allows local users to access VM volumes tha

CVE-2014-0134 LOW Monitor

The instance rescue mode in OpenStack Compute (Nova) 2013.2 before 2013.2.3 and Icehouse before 2014.1, when using libvi

CVE-2013-4278 LOW Monitor

The "create an instance" API in OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly enforce the os-fl

CVE-2013-2030 LOW Monitor

keystone/middleware/auth_token.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for

Same weakness CWE-264 – Permissions, Privileges, and Access Controls

View all

CVE-2013-0422 CRITICAL POC

CVE-2016-10372 CRITICAL POC

CVE-2014-9583 CRITICAL POC

CVE-2012-0297 CRITICAL POC

CVE-2015-7709 CRITICAL POC

CVE-2014-0514 CRITICAL POC

CVE-2013-6955 CRITICAL POC

CVE-2012-0299 CRITICAL POC

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2011-0611 HIGH POC

CVE-2012-1889 HIGH POC

CVE-2012-0507 CRITICAL POC

CVE-2014-1761 HIGH POC

CVE-2015-5122 CRITICAL POC

CVE-2011-0609 HIGH POC

Share

CVE-2014-2573 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy