CVE-2013-2296

Walrus in Eucalyptus before 3.2.2 does not verify authorization for the GetBucketLoggingStatus, SetBucketLoggingStatus, and SetBucketVersioningStatus bucket operations, which allows remote authenticated users to bypass intended restrictions on (1) modifying the logging setting, (2) modifying the versioning setting, or (3) accessing activity logs via a request.

CVSS v2.0 5.5 MEDIUM

5.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:N

Exploitability : 8.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://eucalyptus.atlassian.net/browse/EUCA-3074	Vendor Advisory
http://www.eucalyptus.com/resources/security/advisories/esa-10	Vendor Advisory

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:eucalyptus:eucalyptus:1.5.1:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:1.4:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:1.3:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:1.2:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:2.0.3:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:2.0.2:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:2.0.1:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:2.0.0:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:3.1.2:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:3.1.0:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:3.0:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:1.1:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:1.6:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:3.0.1:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:1.5.2:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:3.1.1:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:2.0:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:3.2.0:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:1.0:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus::::::::
	cpe:2.3:a:eucalyptus:eucalyptus:1.6.2:::::::*

Information

Published : 2013-09-17 05:04

Updated : 2013-09-18 12:52

NVD link : CVE-2013-2296

Mitre link : CVE-2013-2296

JSON object : View

CWE

CWE-264

Permissions, Privileges, and Access Controls

Advertisement

Products Affected

eucalyptus

eucalyptus

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://eucalyptus.atlassian.net/browse/EUCA-3074", "name": "https://eucalyptus.atlassian.net/browse/EUCA-3074", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.eucalyptus.com/resources/security/advisories/esa-10", "name": "http://www.eucalyptus.com/resources/security/advisories/esa-10", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Walrus in Eucalyptus before 3.2.2 does not verify authorization for the GetBucketLoggingStatus, SetBucketLoggingStatus, and SetBucketVersioningStatus bucket operations, which allows remote authenticated users to bypass intended restrictions on (1) modifying the logging setting, (2) modifying the versioning setting, or (3) accessing activity logs via a request."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-264"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2013-2296", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 4.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2013-09-17T12:04Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:eucalyptus:eucalyptus:1.5.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:eucalyptus:eucalyptus:1.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:eucalyptus:eucalyptus:1.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:eucalyptus:eucalyptus:1.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:eucalyptus:eucalyptus:2.0.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:eucalyptus:eucalyptus:2.0.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:eucalyptus:eucalyptus:2.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:eucalyptus:eucalyptus:2.0.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:eucalyptus:eucalyptus:3.1.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:eucalyptus:eucalyptus:3.1.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:eucalyptus:eucalyptus:3.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:eucalyptus:eucalyptus:1.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:eucalyptus:eucalyptus:1.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:eucalyptus:eucalyptus:3.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:eucalyptus:eucalyptus:1.5.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:eucalyptus:eucalyptus:3.1.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:eucalyptus:eucalyptus:2.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:eucalyptus:eucalyptus:3.2.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:eucalyptus:eucalyptus:1.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:eucalyptus:eucalyptus:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "3.2.1"}, {"cpe23Uri": "cpe:2.3:a:eucalyptus:eucalyptus:1.6.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2013-09-18T19:52Z"}