FKIE_CVE-2015-2687

Vulnerability from fkie_nvd - Published: 2017-08-09 18:29 - Updated: 2025-04-20 01:37
Severity ?
4.7 (Medium) - CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
OpenStack Compute (nova) Icehouse, Juno and Havana when live migration fails allows local users to access VM volumes that they would normally not have permissions for.
References
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2015/03/24/10Mailing List, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2015/03/25/3Mailing List, Third Party Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/77505Third Party Advisory, VDB Entry
cve@mitre.orghttps://bugs.launchpad.net/nova/+bug/1419577Issue Tracking, Third Party Advisory, VDB Entry
cve@mitre.orghttps://bugzilla.redhat.com/show_bug.cgi?id=1205313Issue Tracking, Third Party Advisory, VDB Entry
cve@mitre.orghttps://review.openstack.org/#/c/338929/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2015/03/24/10Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2015/03/25/3Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/77505Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://bugs.launchpad.net/nova/+bug/1419577Issue Tracking, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=1205313Issue Tracking, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://review.openstack.org/#/c/338929/Third Party Advisory
Impacted products
Vendor Product Version
openstack compute 2013.2
openstack compute 2013.2.1
openstack compute 2013.2.2
openstack compute 2013.2.3
openstack compute 2013.2.4
openstack compute 2014.1
openstack compute 2014.1.1
openstack compute 2014.1.2
openstack compute 2014.1.3
openstack compute 2014.1.4
openstack compute 2014.1.5
openstack compute 2014.2
openstack compute 2014.2.1
openstack compute 2014.2.2
openstack compute 2014.2.3
openstack compute 2014.2.4
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openstack:compute:2013.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "ABDB4817-2E89-48AF-AA9E-C92966A7100F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openstack:compute:2013.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "5778F972-FB4B-49D1-8EE0-5E8B7AE74D38",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openstack:compute:2013.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "D43CFCC4-8A0A-4B8D-847E-0CD092B684E7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openstack:compute:2013.2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "76E07164-57B7-4B0A-994E-3431FD8CF7F2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openstack:compute:2013.2.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "3B4036C5-677A-43D4-945F-30F24E318C80",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openstack:compute:2014.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F52A2DB6-98A1-4A95-BA81-F2F01160F5E0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openstack:compute:2014.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "D2836E5B-26A6-436F-86C0-5FF09D5EB8B8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openstack:compute:2014.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "16034155-9C19-431B-883E-A33D261A66FC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openstack:compute:2014.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "70C60DC5-1D6B-447C-95BE-6ACC99815E41",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openstack:compute:2014.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "58D1ABEA-E5EA-4CA7-B38A-9E6856DF7276",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openstack:compute:2014.1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "50A52648-5D4D-48D1-B901-60BEA4403104",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openstack:compute:2014.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "2B002A32-4776-488B-B64F-9B692B291E08",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openstack:compute:2014.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "6E0122E7-B95C-4A4E-B072-41DACB1630AB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openstack:compute:2014.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "D586C76A-0D32-42B9-A981-DD6838B6D682",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openstack:compute:2014.2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "2C06721C-BC0E-41DA-B672-84A7C4EF78C2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openstack:compute:2014.2.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "414A9CBC-596C-46B1-8B82-9865FD070A27",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenStack Compute (nova) Icehouse, Juno and Havana when live migration fails allows local users to access VM volumes that they would normally not have permissions for."
    },
    {
      "lang": "es",
      "value": "OpenStack Compute (nova) Icehouse, Juno y Havana, cuando la migraci\u00f3n en vivo fracasa, permiten que usuarios locales accedan a vol\u00famenes de la m\u00e1quina virtual a los que normalmente no habr\u00edan tenido permiso para hacerlo."
    }
  ],
  "id": "CVE-2015-2687",
  "lastModified": "2025-04-20T01:37:25.860",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 1.9,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 3.4,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 4.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-08-09T18:29:01.183",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2015/03/24/10"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2015/03/25/3"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/77505"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://bugs.launchpad.net/nova/+bug/1419577"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205313"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://review.openstack.org/#/c/338929/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2015/03/24/10"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2015/03/25/3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/77505"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://bugs.launchpad.net/nova/+bug/1419577"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205313"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://review.openstack.org/#/c/338929/"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.