CVE-2015-5295

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2015-5295
The template-validate command in OpenStack Orchestration API (Heat) before 2015.1.3 (kilo) and 5.0.x before 5.0.1 (liberty) allows remote authenticated users to cause a denial of service (memory consumption) or determine the existence of local files via the resource type in a template, as demonstrated by file:///dev/zero.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector : AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

5.5 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:P

Exploitability : 8.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176700.html Mailing List Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-0266.html Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html Third Party Advisory
http://www.securityfocus.com/bid/81438 Third Party Advisory VDB Entry
https://bugs.launchpad.net/heat/+bug/1496277 Patch Third Party Advisory
https://security.openstack.org/ossa/OSSA-2016-003.html Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:openstack:orchestration_api:*:*:*:*:*:*:*:*
cpe:2.3:a:openstack:orchestration_api:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:redhat:openstack:7.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*
cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*
History

13 Feb 2023, 00:53

Type Values Removed Values Added
References
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1298295', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1298295', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2016:0266', 'name': 'https://access.redhat.com/errata/RHSA-2016:0266', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2016:0440', 'name': 'https://access.redhat.com/errata/RHSA-2016:0440', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2016:0442', 'name': 'https://access.redhat.com/errata/RHSA-2016:0442', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2015-5295', 'name': 'https://access.redhat.com/security/cve/CVE-2015-5295', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2016:0441', 'name': 'https://access.redhat.com/errata/RHSA-2016:0441', 'tags': [], 'refsource': 'MISC'}
Summary A vulnerability was discovered in the OpenStack Orchestration service (heat), where a specially formatted template could be used to trick the heat-engine service into opening a local file. Although the file contents are never disclosed to the end user, an OpenStack-authenticated attacker could use this flaw to cause a denial of service or determine whether a given file name is present on the server. The template-validate command in OpenStack Orchestration API (Heat) before 2015.1.3 (kilo) and 5.0.x before 5.0.1 (liberty) allows remote authenticated users to cause a denial of service (memory consumption) or determine the existence of local files via the resource type in a template, as demonstrated by file:///dev/zero.

02 Feb 2023, 21:15

Type Values Removed Values Added
Summary The template-validate command in OpenStack Orchestration API (Heat) before 2015.1.3 (kilo) and 5.0.x before 5.0.1 (liberty) allows remote authenticated users to cause a denial of service (memory consumption) or determine the existence of local files via the resource type in a template, as demonstrated by file:///dev/zero. A vulnerability was discovered in the OpenStack Orchestration service (heat), where a specially formatted template could be used to trick the heat-engine service into opening a local file. Although the file contents are never disclosed to the end user, an OpenStack-authenticated attacker could use this flaw to cause a denial of service or determine whether a given file name is present on the server.
References
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1298295 -
  • (MISC) https://access.redhat.com/errata/RHSA-2016:0266 -
  • (MISC) https://access.redhat.com/errata/RHSA-2016:0440 -
  • (MISC) https://access.redhat.com/errata/RHSA-2016:0442 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2015-5295 -
  • (MISC) https://access.redhat.com/errata/RHSA-2016:0441 -
Information

Published : 2016-01-20 16:59

Updated : 2023-12-10 11:46

NVD link : CVE-2015-5295

Mitre link : CVE-2015-5295

CVE.ORG link : CVE-2015-5295

JSON object : View

Products Affected

redhat

  • openstack

oracle

  • solaris

openstack

  • orchestration_api

fedoraproject

  • fedora
CWE
CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer