WINDOWS CENTER: August 2014

Friday, August 29, 2014

ubuntu-security-announce Digest, Vol 119, Issue 17

Thursday, August 28, 2014

ubuntu-security-announce Digest, Vol 119, Issue 16

Tuesday, August 26, 2014

ubuntu-security-announce Digest, Vol 119, Issue 15

Thursday, August 21, 2014

ubuntu-security-announce Digest, Vol 119, Issue 14

Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com

To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com

You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com

When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."

Today's Topics:

1. [USN-2311-2] OpenStack Ceilometer vulnerability (Jamie Strandboge)
2. [USN-2321-1] OpenStack Neutron vulnerabilities (Jamie Strandboge)
3. [USN-2322-1] OpenStack Glance vulnerability (Jamie Strandboge)
4. [USN-2323-1] OpenStack Horizon vulnerabilities (Jamie Strandboge)
5. [USN-2324-1] OpenStack Keystone vulnerabilities (Jamie Strandboge)
6. [USN-2325-1] OpenStack Nova vulnerability (Jamie Strandboge)

----------------------------------------------------------------------

Message: 1
Date: Thu, 21 Aug 2014 15:03:21 -0500
From: Jamie Strandboge <jamie@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2311-2] OpenStack Ceilometer vulnerability
Message-ID: <53F65089.7050305@canonical.com>
Content-Type: text/plain; charset="utf-8"

==========================================================================
Ubuntu Security Notice USN-2311-2
August 21, 2014

ceilometer vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 LTS

Summary:

OpenStack Ceilometer could be made to expose sensitive information.

Software Description:
- ceilometer: OpenStack Telemetry service

Details:

USN-2311-1 fixed vulnerabilities in pyCADF. This update provides the
corresponding updates for OpenStack Ceilometer.

Original advisory details:

Zhi Kun Liu discovered that pyCADF incorrectly filtered certain tokens.
An attacker could possibly use this issue to obtain authentication tokens
used in REST requests.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
ceilometer-common 2014.1.2-0ubuntu1.1

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2311-2
http://www.ubuntu.com/usn/usn-2311-1
CVE-2014-4615

Package Information:
https://launchpad.net/ubuntu/+source/ceilometer/2014.1.2-0ubuntu1.1

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140821/d6619224/attachment-0001.pgp>

------------------------------

Message: 2
Date: Thu, 21 Aug 2014 15:20:09 -0500
From: Jamie Strandboge <jamie@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2321-1] OpenStack Neutron vulnerabilities
Message-ID: <53F65479.1070801@canonical.com>
Content-Type: text/plain; charset="utf-8"

==========================================================================
Ubuntu Security Notice USN-2321-1
August 21, 2014

neutron vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 LTS

Summary:

OpenStack Neutron could be made to expose sensitive information or crash.

Software Description:
- neutron: OpenStack Virtual Network Service

Details:

Liping Mao discovered that OpenStack Neutron did not properly handle
requests for a large number of allowed address pairs. A remote
authenticated attacker could exploit this to cause a denial of service.
(CVE-2014-3555)

Zhi Kun Liu discovered that OpenStack Neutron incorrectly filtered certain
tokens. An attacker could possibly use this issue to obtain authentication
tokens used in REST requests. (CVE-2014-4615)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
neutron-common 1:2014.1.2-0ubuntu1.1

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2321-1
CVE-2014-3555, CVE-2014-4615

Package Information:
https://launchpad.net/ubuntu/+source/neutron/1:2014.1.2-0ubuntu1.1

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140821/10ee5c54/attachment-0001.pgp>

------------------------------

Message: 3
Date: Thu, 21 Aug 2014 15:31:44 -0500
From: Jamie Strandboge <jamie@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2322-1] OpenStack Glance vulnerability
Message-ID: <53F65730.1040404@canonical.com>
Content-Type: text/plain; charset="utf-8"

==========================================================================
Ubuntu Security Notice USN-2322-1
August 21, 2014

glance vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 LTS

Summary:

OpenStack Glance could be made to stop serving requests.

Software Description:
- glance: OpenStack Image Registry and Delivery Service

Details:

Thomas Leaman and Stuart McLaren discovered that OpenStack Glance did not
properly honor the image_size_cap configuration option. A remote
authenticated attacker could exploit this to cause a denial of service via
disk consumption.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
glance-common 1:2014.1.2-0ubuntu1.1

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2322-1
CVE-2014-5356

Package Information:
https://launchpad.net/ubuntu/+source/glance/1:2014.1.2-0ubuntu1.1

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140821/c738c41c/attachment-0001.pgp>

------------------------------

Message: 4
Date: Thu, 21 Aug 2014 15:53:45 -0500
From: Jamie Strandboge <jamie@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2323-1] OpenStack Horizon vulnerabilities
Message-ID: <53F65C59.4070603@canonical.com>
Content-Type: text/plain; charset="utf-8"

==========================================================================
Ubuntu Security Notice USN-2323-1
August 21, 2014

horizon vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in OpenStack Horizon.

Software Description:
- horizon: Web interface for OpenStack cloud infrastructure

Details:

Jason Hullinger discovered that OpenStack Horizon did not properly perform
input sanitization on Heat templates. If a user were tricked into using a
specially crafted Heat template, an attacker could conduct cross-site
scripting attacks. With cross-site scripting vulnerabilities, if a user
were tricked into viewing server output during a crafted server request, a
remote attacker could exploit this to modify the contents, or steal
confidential data, within the same domain. (CVE-2014-3473)

Craig Lorentzen discovered that OpenStack Horizon did not properly perform
input sanitization when creating networks. If a user were tricked into
launching an image using the crafted network name, an attacker could
conduct cross-site scripting attacks. (CVE-2014-3474)

Michael Xin discovered that OpenStack Horizon did not properly perform
input sanitization when adding users. If an admin user were tricked into
viewing the users page containing a crafted email address, an attacker
could conduct cross-site scripting attacks. (CVE-2014-3475)

Dennis Felsch and Mario Heiderich discovered that OpenStack Horizon did not
properly perform input sanitization when creating host aggregates. If an
admin user were tricked into viewing the Host Aggregates page containing a
crafted availability zone name, an attacker could conduct cross-site
scripting attacks. (CVE-2014-3594)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
openstack-dashboard 1:2014.1.2-0ubuntu1.1

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2323-1
CVE-2014-3473, CVE-2014-3474, CVE-2014-3475, CVE-2014-3594

Package Information:
https://launchpad.net/ubuntu/+source/horizon/1:2014.1.2-0ubuntu1.1

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140821/7b608be0/attachment-0001.pgp>

------------------------------

Message: 5
Date: Thu, 21 Aug 2014 16:11:25 -0500
From: Jamie Strandboge <jamie@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2324-1] OpenStack Keystone vulnerabilities
Message-ID: <53F6607D.8000209@canonical.com>
Content-Type: text/plain; charset="utf-8"

==========================================================================
Ubuntu Security Notice USN-2324-1
August 21, 2014

keystone vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in OpenStack Keystone.

Software Description:
- keystone: OpenStack identity service

Details:

Steven Hardy discovered that OpenStack Keystone did not properly handle
chained delegation. A remove authenticated attacker could use this to
gain privileges by creating a new token with additional roles.
(CVE-2014-3476)

Jamie Lennox discovered that OpenStack Keystone did not properly validate
the project id. A remote authenticated attacker may be able to use this to
access other projects. (CVE-2014-3520)

Brant Knudson and Lance Bragstad discovered that OpenStack Keystone would
not always revoke tokens correctly. If Keystone were configured to use
revocation events, a remote authenticated attacker could continue to have
access to resources. (CVE-2014-5251, CVE-2014-5252, CVE-2014-5253)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
python-keystone 1:2014.1.2.1-0ubuntu1.1

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2324-1
CVE-2014-3476, CVE-2014-3520, CVE-2014-5251, CVE-2014-5252,
CVE-2014-5253

Package Information:
https://launchpad.net/ubuntu/+source/keystone/1:2014.1.2.1-0ubuntu1.1

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140821/c8491c9b/attachment-0001.pgp>

------------------------------

Message: 6
Date: Thu, 21 Aug 2014 16:22:10 -0500
From: Jamie Strandboge <jamie@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2325-1] OpenStack Nova vulnerability
Message-ID: <53F66302.2090104@canonical.com>
Content-Type: text/plain; charset="utf-8"

==========================================================================
Ubuntu Security Notice USN-2325-1
August 21, 2014

nova vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 LTS

Summary:

OpenStack Nova could be made to expose sensitive information over the
network.

Software Description:
- nova: OpenStack Compute cloud infrastructure

Details:

Alex Gaynor discovered that OpenStack Nova would sometimes respond with
variable times when comparing authentication tokens. If nova were
configured to proxy metadata requests via Neutron, a remote authenticated
attacker could exploit this to conduct timing attacks and ascertain
configuration details of another instance.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
python-nova 1:2014.1.2-0ubuntu1.1

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2325-1
CVE-2014-3517

Package Information:
https://launchpad.net/ubuntu/+source/nova/1:2014.1.2-0ubuntu1.1

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140821/0d7619b2/attachment.pgp>

------------------------------

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

End of ubuntu-security-announce Digest, Vol 119, Issue 14
*********************************************************

ubuntu-security-announce Digest, Vol 119, Issue 13

Wednesday, August 20, 2014

ubuntu-security-announce Digest, Vol 119, Issue 12

Tuesday, August 19, 2014

ubuntu-security-announce Digest, Vol 119, Issue 11

Monday, August 18, 2014

ubuntu-security-announce Digest, Vol 119, Issue 10

Friday, August 15, 2014

ubuntu-security-announce Digest, Vol 119, Issue 9

Wednesday, August 13, 2014

ubuntu-security-announce Digest, Vol 119, Issue 8

Tuesday, August 12, 2014

ubuntu-security-announce Digest, Vol 119, Issue 7

Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com

To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com

You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com

When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."

Today's Topics:

1. [USN-2309-1] Libav vulnerabilities (Marc Deslauriers)
2. [USN-2310-1] Kerberos vulnerabilities (Marc Deslauriers)
3. [USN-2311-1] pyCADF vulnerability (Marc Deslauriers)

----------------------------------------------------------------------

Message: 1
Date: Mon, 11 Aug 2014 08:02:40 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2309-1] Libav vulnerabilities
Message-ID: <53E8B0E0.7060407@canonical.com>
Content-Type: text/plain; charset="utf-8"

==========================================================================
Ubuntu Security Notice USN-2309-1
August 11, 2014

libav vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.04 LTS

Summary:

Libav could be made to crash or run programs as your login if it opened a
specially crafted file.

Software Description:
- libav: Multimedia player, server, encoder and transcoder

Details:

It was discovered that Libav incorrectly handled certain malformed media
files. If a user were tricked into opening a crafted media file, an
attacker could cause a denial of service via application crash, or possibly
execute arbitrary code with the privileges of the user invoking the
program.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
libavcodec53 4:0.8.15-0ubuntu0.12.04.1
libavformat53 4:0.8.15-0ubuntu0.12.04.1

This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.

References:
http://www.ubuntu.com/usn/usn-2309-1
https://launchpad.net/bugs/1354755

Package Information:
https://launchpad.net/ubuntu/+source/libav/4:0.8.15-0ubuntu0.12.04.1

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140811/1991333c/attachment-0001.pgp>

------------------------------

Message: 2
Date: Mon, 11 Aug 2014 09:37:40 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2310-1] Kerberos vulnerabilities
Message-ID: <53E8C724.7040006@canonical.com>
Content-Type: text/plain; charset="utf-8"

==========================================================================
Ubuntu Security Notice USN-2310-1
August 11, 2014

krb5 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS

Summary:

Several security issues were fixed in Kerberos.

Software Description:
- krb5: MIT Kerberos Network Authentication Protocol

Details:

It was discovered that Kerberos incorrectly handled certain crafted Draft 9
requests. A remote attacker could use this issue to cause the daemon to
crash, resulting in a denial of service. This issue only affected Ubuntu
12.04 LTS. (CVE-2012-1016)

It was discovered that Kerberos incorrectly handled certain malformed
KRB5_PADATA_PK_AS_REQ AS-REQ requests. A remote attacker could use this
issue to cause the daemon to crash, resulting in a denial of service. This
issue only affected Ubuntu 10.04 LTS and Ubuntu 12.04 LTS. (CVE-2013-1415)

It was discovered that Kerberos incorrectly handled certain crafted TGS-REQ
requests. A remote authenticated attacker could use this issue to cause the
daemon to crash, resulting in a denial of service. This issue only affected
Ubuntu 10.04 LTS and Ubuntu 12.04 LTS. (CVE-2013-1416)

It was discovered that Kerberos incorrectly handled certain crafted
requests when multiple realms were configured. A remote attacker could use
this issue to cause the daemon to crash, resulting in a denial of service.
This issue only affected Ubuntu 10.04 LTS and Ubuntu 12.04 LTS.
(CVE-2013-1418, CVE-2013-6800)

It was discovered that Kerberos incorrectly handled certain invalid tokens.
If a remote attacker were able to perform a man-in-the-middle attack, this
flaw could be used to cause the daemon to crash, resulting in a denial of
service. (CVE-2014-4341, CVE-2014-4342)

It was discovered that Kerberos incorrectly handled certain mechanisms when
used with SPNEGO. If a remote attacker were able to perform a
man-in-the-middle attack, this flaw could be used to cause clients to
crash, resulting in a denial of service. (CVE-2014-4343)

It was discovered that Kerberos incorrectly handled certain continuation
tokens during SPNEGO negotiations. A remote attacker could use this issue
to cause the daemon to crash, resulting in a denial of service.
(CVE-2014-4344)

Tomas Kuthan and Greg Hudson discovered that the Kerberos kadmind daemon
incorrectly handled buffers when used with the LDAP backend. A remote
attacker could use this issue to cause the daemon to crash, resulting in a
denial of service, or possibly execute arbitrary code. (CVE-2014-4345)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
krb5-admin-server 1.12+dfsg-2ubuntu4.2
krb5-kdc 1.12+dfsg-2ubuntu4.2
krb5-kdc-ldap 1.12+dfsg-2ubuntu4.2
krb5-otp 1.12+dfsg-2ubuntu4.2
krb5-pkinit 1.12+dfsg-2ubuntu4.2
krb5-user 1.12+dfsg-2ubuntu4.2
libgssapi-krb5-2 1.12+dfsg-2ubuntu4.2
libgssrpc4 1.12+dfsg-2ubuntu4.2
libk5crypto3 1.12+dfsg-2ubuntu4.2
libkadm5clnt-mit9 1.12+dfsg-2ubuntu4.2
libkadm5srv-mit9 1.12+dfsg-2ubuntu4.2
libkdb5-7 1.12+dfsg-2ubuntu4.2
libkrad0 1.12+dfsg-2ubuntu4.2
libkrb5-3 1.12+dfsg-2ubuntu4.2
libkrb5support0 1.12+dfsg-2ubuntu4.2

Ubuntu 12.04 LTS:
krb5-admin-server 1.10+dfsg~beta1-2ubuntu0.5
krb5-kdc 1.10+dfsg~beta1-2ubuntu0.5
krb5-kdc-ldap 1.10+dfsg~beta1-2ubuntu0.5
krb5-pkinit 1.10+dfsg~beta1-2ubuntu0.5
krb5-user 1.10+dfsg~beta1-2ubuntu0.5
libgssapi-krb5-2 1.10+dfsg~beta1-2ubuntu0.5
libgssrpc4 1.10+dfsg~beta1-2ubuntu0.5
libk5crypto3 1.10+dfsg~beta1-2ubuntu0.5
libkadm5clnt-mit8 1.10+dfsg~beta1-2ubuntu0.5
libkadm5srv-mit8 1.10+dfsg~beta1-2ubuntu0.5
libkdb5-6 1.10+dfsg~beta1-2ubuntu0.5
libkrb5-3 1.10+dfsg~beta1-2ubuntu0.5
libkrb5support0 1.10+dfsg~beta1-2ubuntu0.5

Ubuntu 10.04 LTS:
krb5-admin-server 1.8.1+dfsg-2ubuntu0.13
krb5-kdc 1.8.1+dfsg-2ubuntu0.13
krb5-kdc-ldap 1.8.1+dfsg-2ubuntu0.13
krb5-pkinit 1.8.1+dfsg-2ubuntu0.13
krb5-user 1.8.1+dfsg-2ubuntu0.13
libgssapi-krb5-2 1.8.1+dfsg-2ubuntu0.13
libgssrpc4 1.8.1+dfsg-2ubuntu0.13
libk5crypto3 1.8.1+dfsg-2ubuntu0.13
libkadm5clnt-mit7 1.8.1+dfsg-2ubuntu0.13
libkadm5srv-mit7 1.8.1+dfsg-2ubuntu0.13
libkdb5-4 1.8.1+dfsg-2ubuntu0.13
libkrb5-3 1.8.1+dfsg-2ubuntu0.13
libkrb5support0 1.8.1+dfsg-2ubuntu0.13

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2310-1
CVE-2012-1016, CVE-2013-1415, CVE-2013-1416, CVE-2013-1418,
CVE-2013-6800, CVE-2014-4341, CVE-2014-4342, CVE-2014-4343,
CVE-2014-4344, CVE-2014-4345

Package Information:
https://launchpad.net/ubuntu/+source/krb5/1.12+dfsg-2ubuntu4.2
https://launchpad.net/ubuntu/+source/krb5/1.10+dfsg~beta1-2ubuntu0.5
https://launchpad.net/ubuntu/+source/krb5/1.8.1+dfsg-2ubuntu0.13

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140811/f03e386c/attachment-0001.pgp>

------------------------------

Message: 3
Date: Mon, 11 Aug 2014 13:26:20 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2311-1] pyCADF vulnerability
Message-ID: <53E8FCBC.7000808@canonical.com>
Content-Type: text/plain; charset="utf-8"

==========================================================================
Ubuntu Security Notice USN-2311-1
August 11, 2014

python-pycadf vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 LTS

Summary:

pyCADF could be made to expose sensitive information.

Software Description:
- python-pycadf: implementation of DMTF Cloud Audit (CADF) data model

Details:

Zhi Kun Liu discovered that pyCADF incorrectly filtered certain tokens.
An attacker could possibly use this issue to obtain authentication tokens
used in REST requests.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
python-pycadf 0.4.1-0ubuntu1.1

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2311-1
CVE-2014-4615

Package Information:
https://launchpad.net/ubuntu/+source/python-pycadf/0.4.1-0ubuntu1.1

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140811/967c6daf/attachment-0001.pgp>

------------------------------

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

End of ubuntu-security-announce Digest, Vol 119, Issue 7
********************************************************

News