==========================================================================
Ubuntu Security Notice USN-2194-1
May 05, 2014

neutron vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 13.10

Summary:

OpenStack Neutron would allow unintended access to other tenant networks.

Software Description:
– neutron: Openstack Virtual Network Service

Details:

Aaron Rosen discovered that OpenStack Neutron did not properly perform
authorization checks when creating ports when using plugins relying on the
l3-agent. A remote authenticated attacker could exploit this to access the
network of other tenants.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.10:
python-neutron 1:2013.2.3-0ubuntu1.1

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2194-1
CVE-2014-0056

Package Information:
https://launchpad.net/ubuntu/+source/neutron/1:2013.2.3-0ubuntu1.1

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird – http://www.enigmail.net/

iQIcBAEBCgAGBQJTaARyAAoJEFHb3FjMVZVzNi4P/2tCfzK8bXIUjdXBVW5KApTw
1PTM3SLau9pIIOXhm1IkSD/lvtIi9yWxti9gO6PCXsqUgWipwosZrsRVnwbqpCX4
ztKDKiRd1D0YU5/Ib7FJcRCVO9Y/qGMY4YmXZSji/w+8W6kI9E1O4ZedcGE7Wg87
fGGyorPJKlBnBwPZjA465d39CgmIJGSWDoHjSeTMLf8fuQiDhgcfJkajdv8hbwbV
jTNxucF5BnZhkCbPbUV+pJFViYxniBuzdO7n/JBxQhGgnY70nffdHFwa560dOnl+
h94oD+/BnHOtfjIdXOEBG/SOVeTwAj4k7+sDxl5iUnplNu3F5kphEViMq4KVpbY+
5goEtU0NrRFXomeHG8NbEBDu+gbsAaAsMKJcQh7+uFkuN0B+6v/NbO8DmcnFQ//4
Rr0HGVBo44MuC5pdRkTarDzEATRPAm8b9LinXWAw/q4zNOmmJz12Ypr5szVzQoUZ
OwHViROYICS0bHLUIJaQ0Vq4Yi/xkoRL7GsOnqXcsjWnzBnODSbMBk/lNROldEOI
OCN8UOqnp8wVXeUPVIhb97mi8A6aqPvGIZrRoWEg1NLsyQN7tG8pAFcWd6SuCwyS
/IJw3yK4hl0qbaTQ3mNmXGAZbp1QpJ9tpvgpnRekg9vNQ7ypf7VOEGzXjU4DeJJs
PVB4gCPGkBpZsYMvViFL
=O/tS
—–END PGP SIGNATURE—–
—