CVE-2012-4066

The internal message protocol for Walrus in Eucalyptus 3.2.0 and earlier does not require signatures for unspecified request headers, which allows attackers to (1) delete or (2) upload snapshots.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.eucalyptus.com/eucalyptus-cloud/security/esa-08	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:eucalyptus:eucalyptus::::::::
	cpe:2.3:a:eucalyptus:eucalyptus:1.0:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:1.1:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:1.2:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:1.3:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:1.4:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:1.5.1:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:1.5.2:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:1.6:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:1.6.2:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:2.0:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:2.0.0:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:2.0.1:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:2.0.2:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:2.0.3:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:3.0:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:3.0.1:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:3.1.0:::::::*

History

No history.

Information

Published : 2013-03-08 18:55

Updated : 2023-12-10 11:16

NVD link : CVE-2012-4066

Mitre link : CVE-2012-4066

CVE.ORG link : CVE-2012-4066

JSON object : View

Products Affected

eucalyptus

eucalyptus

CWE

CWE-287

Improper Authentication

{"id": "CVE-2012-4066", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-03-08T18:55:01.500", "references": [{"url": "http://www.eucalyptus.com/eucalyptus-cloud/security/esa-08", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "The internal message protocol for Walrus in Eucalyptus 3.2.0 and earlier does not require signatures for unspecified request headers, which allows attackers to (1) delete or (2) upload snapshots."}, {"lang": "es", "value": "El protocolo de mensaje interno para Walrus en Eucalyptus v3.2.0 y versiones anteriores no requiere de firmas para cabeceras de peticiones no especificadas, lo que permite a los atacantes (1) borrar o (2) subir capturas."}], "lastModified": "2013-03-18T04:00:00.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "055CF9FA-B0AE-4F32-982A-8D7B21B5D70F", "versionEndIncluding": "3.2.0"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "91027387-6A15-4EF3-AA31-AE39A49505F0"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0A143205-6B95-410D-8500-1916DD4F3F3B"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EFAF37FF-B306-4231-8DDA-95EC16935C06"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:1.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "53689262-6D98-443A-883F-12D9812F4140"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:1.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "323791A0-35CA-49D2-B68F-F1FE30B66248"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:1.5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2677F0C3-7016-4379-B495-5301A5893322"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:1.5.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "55C87A95-CE7E-44A4-BE64-407CC94AB16E"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:1.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D2E86109-062F-4BCD-96EC-242F87DC63AF"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:1.6.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "11B0C518-C019-48CD-ABAC-B2F433CC0C9D"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EC2B60FE-42EE-4F71-B73D-67FF1FD0CD29"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:2.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E8974798-2246-4C12-A0A2-ADDB10563E58"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:2.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0C98920E-5369-4690-885A-BEE737F029C3"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:2.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F548349B-ADC1-48A5-A5FA-2C1B6B3CC553"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:2.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "91D1B66B-8605-46F5-8290-8A8DA5412546"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AB322B1B-8FE8-4CEF-A7F4-B86F131F9116"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:3.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2ECBDD1A-8E7A-48C0-B638-815DDC3A3A4B"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:3.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "043A9574-806B-429F-9878-AFEEC2334AF6"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}