CVE-2018-1128

It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.

CVSS v3.0 7.5 HIGH
CVSS v2.0 5.4 MEDIUM

7.5^/10

CVSS v3.0 : HIGH

V3 Legend

Vector : AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.6 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

5.4^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:A/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 5.5 / Impact : 6.4

Access Vector ADJACENT_NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/ceph/ceph/commit/5ead97120e07054d80623dada90a5cc764c28468	Patch Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1575866	Issue Tracking Patch Third Party Advisory
http://tracker.ceph.com/issues/24836	Issue Tracking Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2179	Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2177	Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2274	Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2261	Third Party Advisory
https://www.debian.org/security/2018/dsa-4339	Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html	Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.html	Third Party Advisory
http://www.openwall.com/lists/oss-security/2020/11/17/3
http://www.openwall.com/lists/oss-security/2020/11/17/4

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:redhat:ceph_storage_mon:2:::::::*
	cpe:2.3:a:redhat:ceph_storage_osd:2:::::::*
	cpe:2.3:a:redhat:ceph_storage_osd:3:::::::*
	cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*
	cpe:2.3:a:redhat:ceph_storage:3:::::::*
	cpe:2.3:a:redhat:ceph_storage_mon:3:::::::*

Configuration 2 (hide)

cpe:2.3:a:redhat:ceph:*:*:*:*:*:*:*:*

Configuration 3 (hide)

OR	cpe:2.3:o:debian:debian_linux:9.0:::::::*
	cpe:2.3:o:debian:debian_linux:8.0:::::::*

Configuration 4 (hide)

cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*

Information

Published : 2018-07-10 07:29

Updated : 2020-11-17 11:15

NVD link : CVE-2018-1128

Mitre link : CVE-2018-1128

JSON object : View

CWE

CWE-287

Improper Authentication

Products Affected

redhat

enterprise_linux_desktop
enterprise_linux
enterprise_linux_workstation
ceph
ceph_storage_osd
ceph_storage_mon
ceph_storage
enterprise_linux_server

opensuse

leap

debian

debian_linux

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/ceph/ceph/commit/5ead97120e07054d80623dada90a5cc764c28468", "name": "https://github.com/ceph/ceph/commit/5ead97120e07054d80623dada90a5cc764c28468", "tags": ["Patch", "Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1575866", "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1575866", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "http://tracker.ceph.com/issues/24836", "name": "http://tracker.ceph.com/issues/24836", "tags": ["Issue Tracking", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "https://access.redhat.com/errata/RHSA-2018:2179", "name": "RHSA-2018:2179", "tags": ["Third Party Advisory"], "refsource": "REDHAT"}, {"url": "https://access.redhat.com/errata/RHSA-2018:2177", "name": "RHSA-2018:2177", "tags": ["Third Party Advisory"], "refsource": "REDHAT"}, {"url": "https://access.redhat.com/errata/RHSA-2018:2274", "name": "RHSA-2018:2274", "tags": ["Third Party Advisory"], "refsource": "REDHAT"}, {"url": "https://access.redhat.com/errata/RHSA-2018:2261", "name": "RHSA-2018:2261", "tags": ["Third Party Advisory"], "refsource": "REDHAT"}, {"url": "https://www.debian.org/security/2018/dsa-4339", "name": "DSA-4339", "tags": ["Third Party Advisory"], "refsource": "DEBIAN"}, {"url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html", "name": "[debian-lts-announce] 20190315 [SECURITY] [DLA 1715-1] linux-4.9 security update", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MLIST"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.html", "name": "openSUSE-SU-2019:1284", "tags": ["Third Party Advisory"], "refsource": "SUSE"}, {"url": "http://www.openwall.com/lists/oss-security/2020/11/17/3", "name": "[oss-security] 20201117 CVE-2020-25677 ceph: CEPHX_V2 replay attack protection lost", "tags": [], "refsource": "MLIST"}, {"url": "http://www.openwall.com/lists/oss-security/2020/11/17/4", "name": "[oss-security] 20201117 Re: CVE-2020-25677 ceph: CEPHX_V2 replay attack protection lost", "tags": [], "refsource": "MLIST"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-287"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2018-1128", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.4, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "acInsufInfo": false, "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 5.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}}, "publishedDate": "2018-07-10T14:29Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:redhat:ceph_storage_mon:2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:redhat:ceph_storage_osd:2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:redhat:ceph_storage_osd:3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:redhat:ceph_storage:3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:redhat:ceph_storage_mon:3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:redhat:ceph:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "13.2.1", "versionStartIncluding": "10.2.0"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2020-11-17T19:15Z"}

7.5 /10