==========================================================================
Ubuntu Security Notice USN-2321-1
August 21, 2014
neutron vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
– Ubuntu 14.04 LTS
Summary:
OpenStack Neutron could be made to expose sensitive information or crash.
Software Description:
– neutron: OpenStack Virtual Network Service
Details:
Liping Mao discovered that OpenStack Neutron did not properly handle
requests for a large number of allowed address pairs. A remote
authenticated attacker could exploit this to cause a denial of service.
(CVE-2014-3555)
Zhi Kun Liu discovered that OpenStack Neutron incorrectly filtered certain
tokens. An attacker could possibly use this issue to obtain authentication
tokens used in REST requests. (CVE-2014-4615)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
neutron-common 1:2014.1.2-0ubuntu1.1
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2321-1
CVE-2014-3555, CVE-2014-4615
Package Information:
https://launchpad.net/ubuntu/+source/neutron/1:2014.1.2-0ubuntu1.1
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIcBAEBCgAGBQJT9lR5AAoJEFHb3FjMVZVzF7IP+gNBOCB47MYSHWnZKsfwwl8l
qGwZTeeGnz9xAz89EuxlMwxvpvEekoa19vnMXnyU/oV9isdSpudfe1GXGHmJMtJV
yLJnMaatuQQSLAmVCT32tiUTUdKj7Vx+klVQNyLm0uQJAaNUDNy4cBbJ/Xl8Anm0
wvtE5x0p9qHQOK7k5d8GZTLiFggc4lS1pzPC8T6/8UJATSliwer55juCwc01jS4E
uOMyxMBwvR/lxRk6QfYL1allHJzjwec6ZlqPtBSnnyzSmBS8pU8Nm2/pyH6HlxWc
j5eQGtyBLSM2ZNKXr2jiu+GPbBNIRBDujaPn52oMM577biNZMqNH/qYQGkHB+/Fo
pmoEDj1OxfVxCZwwhzFe8YIzCb7zGwWadccr0/VuLM+1lIEIWWtL5c3pqYtu2hRQ
G2b4mIh9CB2DvcM53JZk4cRgMv/lKiHjldGImuPUnFfWOZHh1t0WLlY26V6SxtIk
rXZMRqwZyt7VhsZLuE+3QCfE3BTAJDtyqBkpm+OvhedrOSDWvcmbS4x2u1NA45Yv
5UxYMtLC8sxYtqkoRnV6sILxFu4Da3mHmSkewNSYofDwShnkfCwNOybtT2F2gaam
CNGEfxIWdR21K1rU4kAGPo9gL3mt8yEelV5/Sv6MGzotHCDynXj2Cg63F2wISkYo
9KfOrFvLeGdSW2Wo4Iu1
=N/nc
—–END PGP SIGNATURE—–
—
