Lucene search

MitreCVE-2014-0592

HistoryApr 04, 2014 - 2:55 p.m.

CVE-2014-0592

2014-04-0414:55:19

CWE-264

mitre

web.nvd.nist.gov

cve-2014-0592

barclamp

crowbar framework

suse cloud 3

netfilter

security group restrictions

floating ips

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

Confidence

Low

EPSS

0.01

Percentile

83.4%

JSON

Barclamp (aka barclamp-network) 1.7 for the Crowbar Framework, as used in SUSE Cloud 3, does not enable netfilter on bridges when creating new instances, which allows remote attackers to bypass security group restrictions via unspecified vectors, related to floating IPs.

Affected configurations

Nvd

Node

crowbarbarclampMatch1.7

AND

novellsuse_cloudMatch3.0

VendorProductVersionCPE
crowbarbarclamp1.7cpe:2.3:a:crowbar:barclamp:1.7:*:*:*:*:*:*:*
novellsuse_cloud3.0cpe:2.3:a:novell:suse_cloud:3.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
crowbar	barclamp	1.7	cpe:2.3:a:crowbar:barclamp:1.7:::::::*
novell	suse_cloud	3.0	cpe:2.3:a:novell:suse_cloud:3.0:::::::*

References

lists.opensuse.org/opensuse-security-announce/2014-03/msg00025.html

secunia.com/advisories/57509

www.securityfocus.com/bid/66519

bugzilla.novell.com/show_bug.cgi?id=864183

github.com/crowbar/barclamp-network/pull/269

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

Confidence

Low

EPSS

0.01

Percentile

83.4%

JSON

Related for CVE-2014-0592