CVE-2012-3361

Published: Jul 22, 2012Modified: Apr 29, 2026

5.5

Vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Exploitability: 8.0 / Impact: 4.9

Source: NVD

Description

virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image.

Affected (3)

Products: Openstack: Diablo, Essex, Folsom

3 products

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Openstack Diablo	Version 2011.3
Openstack Essex	Version 2012.1
Openstack Folsom	Version 2012.2

Related CWEs

CWE-264

References (22)

http://lists.fedoraproject.org/pipermail/package-announce/2012-July/083969.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2012-July/083984.html

Source: secalert@redhat.com

http://secunia.com/advisories/49763

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/49802

Source: secalert@redhat.com

Vendor Advisory

http://www.securityfocus.com/bid/54278

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-1497-1

Source: secalert@redhat.com

https://bugs.launchpad.net/nova/+bug/1015531

Source: secalert@redhat.com

https://github.com/openstack/nova/commit/2427d4a99bed35baefd8f17ba422cb7aae8dcca7

Source: secalert@redhat.com

ExploitPatch

https://github.com/openstack/nova/commit/b0feaffdb2b1c51182b8dce41b367f3449af5dd9

Source: secalert@redhat.com

ExploitPatch

https://lists.launchpad.net/openstack/msg14089.html

Source: secalert@redhat.com

https://review.openstack.org/#/c/9268/

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2012-July/083969.html