Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2014-0592

Barclamp (aka barclamp-network) 1.7 for the Crowbar Framework, as used in SUSE Cloud 3, does not enable netfilter on bridges when creating new instances, which allows remote attackers to bypass security group restrictions via unspecified vectors, related to floating IPs.

Published

2014-04-04T14:55:19.717

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

10.0

Impact Score

6.4

Weaknesses

Type: Primary
CWE-264

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	crowbar	barclamp	1.7	Yes
Application	novell	suse_cloud	3.0	Yes

References

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00025.html Patch, Vendor Advisory ([email protected])
http://secunia.com/advisories/57509 Vendor Advisory ([email protected])
http://www.securityfocus.com/bid/66519 ([email protected])
https://bugzilla.novell.com/show_bug.cgi?id=864183 ([email protected])
https://github.com/crowbar/barclamp-network/pull/269 ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00025.html Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/57509 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/66519 (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.novell.com/show_bug.cgi?id=864183 (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/crowbar/barclamp-network/pull/269 (af854a3a-2127-422b-91ae-364da2661108)