oss-security - RCE vulnerability in Openstack Murano using insecure YAML tags (CVE-2016-4972)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-id: <etPan.576c1f7b.5aae323e.126b@me.com>
Date: Thu, 23 Jun 2016 20:42:13 +0300
From: Kirill Zaitsev <k.zaitsev@...com>
To: oss-security@...ts.openwall.com
Subject: RCE vulnerability in Openstack Murano using insecure YAML tags
 (CVE-2016-4972)

==============================================================
RCE vulnerability in Openstack Murano using insecure YAML tags
==============================================================

:Date: June 23, 2016
:CVE: CVE-2016-4972


Affects
~~~~~~~
- Murano: <=2015.1.1; <=1.0.2; ==2.0.0
- Murano-dashboard: <=2015.1.1; <=1.0.2; ==2.0.0
- Python-muranoclient: <=0.7.2; >=0.8.0<=0.8.4


Description
~~~~~~~~~~~
Kirill Zaitsev from Mirantis reported a vulnerability in OpenStack
Murano applications processing. Using extended YAML tags in Murano
application YAML files, an attacker can perform a Remote Code
Execution attack.

Vulnerability has been verified in all currently supported branches.
Further examination of code suggest, that it is also present in kilo and
juno versions of murano.

Patches
~~~~~~~
- https://review.openstack.org/#/c/333444/ (Liberty)
- https://review.openstack.org/#/c/333425/ (Liberty)
- https://review.openstack.org/#/c/333432/ (Liberty)
- https://review.openstack.org/#/c/333443/ (Mitaka)
- https://review.openstack.org/#/c/333424/ (Mitaka)
- https://review.openstack.org/#/c/333439/ (Mitaka)
- https://review.openstack.org/#/c/333423/ (Newton)
- https://review.openstack.org/#/c/333440/ (Newton)
- https://review.openstack.org/#/c/333428/ (Newton)


Credits
~~~~~~~
- Kirill Zaitsev from Mirantis (CVE-2016-4972)


References
~~~~~~~~~~
- https://bugs.launchpad.net/python-muranoclient/+bug/1586078
- https://bugs.launchpad.net/murano/+bug/1586079
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4972

Notes
~~~~~
- Fixes for this bug are going to be included in the upcoming releases
  of murano 1.0.3(liberty), 2.0.1(mitaka), 3.0.0(newton) and 
  python-muranoclient 0.7.3(liberty), 0.8.5(mitaka), 0.9.0(newton)


-- 
Kirill Zaitsev
Murano Project Technical Lead
Content of type "text/html" skipped

Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.