CVE-2014-2573 (GCVE-0-2014-2573)

Vulnerability from cvelistv5 – Published: 2014-03-25 15:00 – Updated: 2024-08-06 10:21
VLAI
Summary
The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by requesting the VM be put into rescue and then deleting the image.
Severity
No CVSS data available.
CWE
  • n/a
Assigner
References
URL Tags
http://www.openwall.com/lists/oss-security/2014/03/21/2 mailing-listx_refsource_MLIST
http://secunia.com/advisories/57498 third-party-advisoryx_refsource_SECUNIA
https://bugs.launchpad.net/nova/+bug/1269418 x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2014/03/21/1 mailing-listx_refsource_MLIST
Date Public
2014-03-21 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T10:21:35.993Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[oss-security] 20140321 Re: CVE request for vulnerability in OpenStack Nova",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2014/03/21/2"
          },
          {
            "name": "57498",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/57498"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugs.launchpad.net/nova/+bug/1269418"
          },
          {
            "name": "[oss-security] 20140321 CVE request for vulnerability in OpenStack Nova",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2014/03/21/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-03-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by requesting the VM be put into rescue and then deleting the image."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-03-25T14:57:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[oss-security] 20140321 Re: CVE request for vulnerability in OpenStack Nova",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2014/03/21/2"
        },
        {
          "name": "57498",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/57498"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugs.launchpad.net/nova/+bug/1269418"
        },
        {
          "name": "[oss-security] 20140321 CVE request for vulnerability in OpenStack Nova",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2014/03/21/1"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-2573",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by requesting the VM be put into rescue and then deleting the image."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[oss-security] 20140321 Re: CVE request for vulnerability in OpenStack Nova",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2014/03/21/2"
            },
            {
              "name": "57498",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/57498"
            },
            {
              "name": "https://bugs.launchpad.net/nova/+bug/1269418",
              "refsource": "CONFIRM",
              "url": "https://bugs.launchpad.net/nova/+bug/1269418"
            },
            {
              "name": "[oss-security] 20140321 CVE request for vulnerability in OpenStack Nova",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2014/03/21/1"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-2573",
    "datePublished": "2014-03-25T15:00:00.000Z",
    "dateReserved": "2014-03-21T00:00:00.000Z",
    "dateUpdated": "2024-08-06T10:21:35.993Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2014-2573",
      "date": "2026-06-01",
      "epss": "0.00106",
      "percentile": "0.28265"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:openstack:compute:2013.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"ABDB4817-2E89-48AF-AA9E-C92966A7100F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:openstack:compute:2013.2.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5778F972-FB4B-49D1-8EE0-5E8B7AE74D38\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:openstack:compute:2013.2.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D43CFCC4-8A0A-4B8D-847E-0CD092B684E7\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by requesting the VM be put into rescue and then deleting the image.\"}, {\"lang\": \"es\", \"value\": \"El controlador VMWare en OpenStack Compute (Nova) 2013.2 hasta 2013.2.2 no coloca debidamente las VMs en estado de rescate, lo que permite a usuarios remotos autenticados evadir el l\\u00edmite de cuota y causar una denegaci\\u00f3n de servicio (consumo de recursos) solicitando que la VM sea colocada en rescate y posteriormente eliminando la imagen.\"}]",
      "id": "CVE-2014-2573",
      "lastModified": "2024-11-21T02:06:33.303",
      "metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:A/AC:M/Au:S/C:N/I:N/A:P\", \"baseScore\": 2.3, \"accessVector\": \"ADJACENT_NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 4.4, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2014-03-25T16:55:28.677",
      "references": "[{\"url\": \"http://secunia.com/advisories/57498\", \"source\": \"cve@mitre.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2014/03/21/1\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2014/03/21/2\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://bugs.launchpad.net/nova/+bug/1269418\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://secunia.com/advisories/57498\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2014/03/21/1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2014/03/21/2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://bugs.launchpad.net/nova/+bug/1269418\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-264\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2014-2573\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2014-03-25T16:55:28.677\",\"lastModified\":\"2026-05-06T22:30:45.220\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by requesting the VM be put into rescue and then deleting the image.\"},{\"lang\":\"es\",\"value\":\"El controlador VMWare en OpenStack Compute (Nova) 2013.2 hasta 2013.2.2 no coloca debidamente las VMs en estado de rescate, lo que permite a usuarios remotos autenticados evadir el l\u00edmite de cuota y causar una denegaci\u00f3n de servicio (consumo de recursos) solicitando que la VM sea colocada en rescate y posteriormente eliminando la imagen.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:A/AC:M/Au:S/C:N/I:N/A:P\",\"baseScore\":2.3,\"accessVector\":\"ADJACENT_NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":4.4,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-264\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openstack:compute:2013.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ABDB4817-2E89-48AF-AA9E-C92966A7100F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openstack:compute:2013.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5778F972-FB4B-49D1-8EE0-5E8B7AE74D38\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openstack:compute:2013.2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D43CFCC4-8A0A-4B8D-847E-0CD092B684E7\"}]}]}],\"references\":[{\"url\":\"http://secunia.com/advisories/57498\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2014/03/21/1\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2014/03/21/2\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://bugs.launchpad.net/nova/+bug/1269418\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/57498\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2014/03/21/1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2014/03/21/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://bugs.launchpad.net/nova/+bug/1269418\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.