NVD Vulnerability Detail

CVE-2011-0730

Summary	Eucalyptus before 2.0.3 and Eucalyptus EE before 2.0.2, as used in Ubuntu Enterprise Cloud (UEC) and other products, do not properly interpret signed elements in SOAP requests, which allows man-in-the-middle attackers to execute arbitrary commands by modifying a request, related to an "XML Signature Element Wrapping" or a "SOAP signature replay" issue.
Publication Date	June 3, 2011, 4:55 a.m.
Registration Date	Jan. 28, 2021, 4:37 p.m.
Last Update	Nov. 21, 2024, 10:24 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:eucalyptus:eucalyptus::::::::				2.0.3
cpe:2.3:a:eucalyptus:eucalyptus:::::enterprise:::*				2.0.2

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:10.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:11.04:::::::*
cpe:2.3:o:canonical:ubuntu_linux:10.04::::lts:::

Related information, measures and tools

No	URL	タグ
1	http://launchpadlibrarian.net/72472626/eucalyptus_2.0.1%2Bbzr1256-0ubuntu5_2.0.1%2Bbzr1256-0ubuntu6.diff.gz	Patch Third Party Advisory
2	http://open.eucalyptus.com/wiki/esa-02	Vendor Advisory
3	http://secunia.com/advisories/44705	Third Party Advisory
4	http://www.securityfocus.com/bid/48000	Third Party Advisory VDB Entry
5	http://www.ubuntu.com/usn/USN-1137-1	Third Party Advisory
6	https://bugs.launchpad.net/bugs/746101	Third Party Advisory
7	https://exchange.xforce.ibmcloud.com/vulnerabilities/67670	Third Party Advisory VDB Entry
8	https://launchpad.net/ubuntu/+source/eucalyptus/+changelog	Patch Third Party Advisory
9	http://launchpadlibrarian.net/72472626/eucalyptus_2.0.1%2Bbzr1256-0ubuntu5_2.0.1%2Bbzr1256-0ubuntu6.diff.gz	Patch Third Party Advisory
10	https://launchpad.net/ubuntu/+source/eucalyptus/+changelog	Patch Third Party Advisory
11	https://exchange.xforce.ibmcloud.com/vulnerabilities/67670	Third Party Advisory VDB Entry
12	https://bugs.launchpad.net/bugs/746101	Third Party Advisory
13	http://www.ubuntu.com/usn/USN-1137-1	Third Party Advisory
14	http://www.securityfocus.com/bid/48000	Third Party Advisory VDB Entry
15	http://secunia.com/advisories/44705	Third Party Advisory
16	http://open.eucalyptus.com/wiki/esa-02	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html

JVN Vulnerability Information

UEC などで使用される Eucalyptus における任意のコマンドを実行される脆弱性

Title	UEC などで使用される Eucalyptus における任意のコマンドを実行される脆弱性
Summary	Ubuntu Enterprise Cloud (UEC) などで使用される Eucalyptus および Eucalyptus EE には、SOAP リクエスト内の署名された要素を適切に解釈しないため、任意のコマンドを実行される脆弱性が存在します。
Possible impacts	中間者攻撃 (man-in-the-middle attack) により、「 XML Signature Element Wrapping 」または「 SOAP signature replay 」問題に関連するリクエストを変更されることで、任意のコマンドを実行される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	June 2, 2011, midnight
Registration Date	March 27, 2012, 6:43 p.m.
Last Update	March 27, 2012, 6:43 p.m.

Affected System

Canonical

Ubuntu Enterprise Cloud

Eucalyptus Systems

Eucalyptus 2.0.3 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2011-0730	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0730
National Vulnerability Database (NVD)
2	CVE-2011-0730	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0730

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
Eucalyptus
1	ESA-02	http://open.eucalyptus.com/wiki/esa-02
Ubuntu Security Notice
2	USN-1137-1	http://www.ubuntu.com/usn/USN-1137-1/

Change Log

No	Changed Details	Date of change
0	[2012年03月27日] 掲載	Feb. 17, 2018, 10:37 a.m.