==========================================================================
Ubuntu Security Notice USN-2323-1
August 21, 2014

horizon vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in OpenStack Horizon.

Software Description:
– horizon: Web interface for OpenStack cloud infrastructure

Details:

Jason Hullinger discovered that OpenStack Horizon did not properly perform
input sanitization on Heat templates. If a user were tricked into using a
specially crafted Heat template, an attacker could conduct cross-site
scripting attacks. With cross-site scripting vulnerabilities, if a user
were tricked into viewing server output during a crafted server request, a
remote attacker could exploit this to modify the contents, or steal
confidential data, within the same domain. (CVE-2014-3473)

Craig Lorentzen discovered that OpenStack Horizon did not properly perform
input sanitization when creating networks. If a user were tricked into
launching an image using the crafted network name, an attacker could
conduct cross-site scripting attacks. (CVE-2014-3474)

Michael Xin discovered that OpenStack Horizon did not properly perform
input sanitization when adding users. If an admin user were tricked into
viewing the users page containing a crafted email address, an attacker
could conduct cross-site scripting attacks. (CVE-2014-3475)

Dennis Felsch and Mario Heiderich discovered that OpenStack Horizon did not
properly perform input sanitization when creating host aggregates. If an
admin user were tricked into viewing the Host Aggregates page containing a
crafted availability zone name, an attacker could conduct cross-site
scripting attacks. (CVE-2014-3594)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
openstack-dashboard 1:2014.1.2-0ubuntu1.1

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2323-1
CVE-2014-3473, CVE-2014-3474, CVE-2014-3475, CVE-2014-3594

Package Information:
https://launchpad.net/ubuntu/+source/horizon/1:2014.1.2-0ubuntu1.1

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIcBAEBCgAGBQJT9lxZAAoJEFHb3FjMVZVzCTgP/2/trpfmaQWK6Hui2IId6km4
mFS/towqicmg7EDFo5MtTKsQKeL5RYUadE9Z4APBqLv7RbqAzzZn/CritKT7e3Kt
7oDw1wIPNo2H+ReabmxksifT6HgcJQRyMtA8vQgvptFueIRgJmgnPNhqNgMpIJ1u
LFDwUKyVozxjnmVB8XAubz00jzMHxwBl/8V1v3nbgrsnwKSZf4hwYTFbN9NAQdvM
5QcJcK3CDJUePPWYwVJ4zT8TBmqQ5MibDnBVJIFbpulPCgHOV/0YNERII4zuPK9+
8ioyqf6PF+fggvrwplXnZzSmthlzYY5sqtz0/3/te33YEi39Hn1wUsl58QhjCJOy
qmGf2m11KbGIvMYgFO64aDn7LVKCxXkWSrMDNzLtyllhQ3Cf7kxwVD42hmu2K9C8
Ym/dfkLe16RILv75B56nIx7UKc4w5YcF4R0VV+KzYrgbstHF1OBG76iBkkYwNE1n
LVziEknlxxgaNR8ZzqDfXxwEYwHzjm+VQNtOVViPVcaaD1wBAbQFMMPYaOphtQOH
cWrJMSpcZo87GVeNsnJPoqlxRc8arhzOWI9Ecf2TndEjsHNqva5T9yqAt382ejGo
2mup/9RaZ5DurZ5e1cYYp9OYuIKmcmZLKBQF+bOYFuqr0r3XZ2Dizo4qyKJ+/llV
6hy/gcl1b49jUCgyhego
=bFO2
—–END PGP SIGNATURE—–
—