DiroProgrammer 2013-06-19
发布日期:2013-06-14
更新日期:2013-06-19
受影响系统:
openstack Keystone 2013.x
openstack Keystone 2012.x
描述:
--------------------------------------------------------------------------------
CVE(CAN) ID: CVE-2013-2157
OpenStack Keystone为OpenStack系列计划提供身份、令牌、目录和策略服务的项目。
OpenStack Keystone Folsom (2012.2)、Grizzly (2013.1)通过LDAP后端处理身份验证时存在错误,提供空密码会执行匿名LDAP绑定,即可登录为任意用户。仅使用LDAP身份验证后端的Keystone会受到此漏洞的影响。
<*来源:Jose Castro Leon
链接:http://secunia.com/advisories/53769/
http://www.openwall.com/lists/oss-security/2013/06/13/3
*>
建议:
--------------------------------------------------------------------------------
厂商补丁:
openstack
---------
目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载:
http://lists.openstack.org/pipermail/openstack-announce/
Havana (development branch) fix:
https://review.openstack.org/#/c/32896/
Grizzly fix:
https://review.openstack.org/#/c/32895/
Folsom fix:
https://review.openstack.org/#/c/32894/
参考:
https://bugs.launchpad.net/keystone/+bug/1187305
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2157