Vulnerability Bulletins |
Vulnerabilidad en Citrix Cloud.com CloudStack, y Apache CloudStack |
|
Vulnerability classification |
|
| Property | Value |
| Confidence level | Oficial |
| Impact | Obtener acceso |
| Dificulty | Avanzado |
| Required attacker level | Acceso remoto sin cuenta a un servicio estandar |
System information |
|
| Property | Value |
| Affected manufacturer | Comercial Software |
| Affected software |
Citrix Cloudstack Apache Cloudstack - Prerelease |
Description |
|
| Citrix Cloud.com CloudStack, y Apache CloudStack pre-release, permite a atacantes remotos a realizar llamadas a la API aprovechando la cuenta system, como se demostró mediante llamadas a la API para eliminar VMs. | |
Solution |
|
| Adquirir una versión de la rama estable o en su defecto desactivar el usuario “system”. | |
Standar resources |
|
| Property | Value |
| CVE | CVE-2012-4501 |
| BID | |
Other resources |
|
|
[CVE-2012-4501] CloudStack configuration vulnerability http://archives.neohapsis.com/archives/bugtraq/2012-10/0062.html [VE-2012-4501] CloudStack security announcement http://markmail.org/thread/yfuxgymdqwg3kcg4 |
|
Version history |
||
| Version | Comments | Date |
| 1.0 | Aviso emitido | 2012-10-28 |