Security Bulletin: IBM PowerVC is impacted by OpenStack Nova information disclosure vulnerabilities (CVE-2015-1850, CVE-2015-7548)

Summary

IBM PowerVC is impacted by OpenStack Nova information disclosure vulnerailities (CVE-2015-1850, CVE-2015-7548)

Vulnerability Details

CVEID:CVE-2015-1850
**DESCRIPTION:**OpenStack Nova could allow a local attacker to obtain sensitive information, caused by the failure to provide input format to several calls of ““qemu-img convert””. By overwriting an image convert using a qcow2 backing file, an attacker could exploit this vulnerability to read arbitrary files from the host.

CVSS Base Score: 4.9
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/103849&gt; for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:L/Au:N/C:C/I:N/A:N)

CVEID:CVE-2015-7548
**DESCRIPTION:**OpenStack Nova could allow a local authenticated attacker to obtain sensitive information, caused by an error in instance snapshot. By overwriting the disk inside an instance using a malformed image and requesting a snapshot, an attacker could exploit this vulnerability to read arbitrary files from the host.

CVSS Base Score: 5.500
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/109474&gt; for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

PowerVC Standard Edition 1.2.3.0 through 1.2.3.3
PowerVC Standard Edition 1.3.0.0 through 1.3.0.1

Remediation/Fixes

For PowerVC 1.2.3, update to 1.2.3 FP3 and then apply the IT16325 interim fix from FixCentral:
http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FPowerVC&fixids=Security-Fix-1.2.3.3-PowerVC-RHEL-NOARCH-APAR-IT16325&source=SAR
For PowerVC 1.3.0, apply PowerVC 1.3.0 FP2 or later:
https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~Other%2Bsoftware&product=ibm/Other+software/PowerVC&release=1.3.0.0&platform=All&function=all&source=fc

Workarounds and Mitigations

None