NVD Vulnerability Detail

CVE-2012-5563

Summary	OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. NOTE: this issue exists because of a CVE-2012-3426 regression.
Publication Date	Dec. 18, 2012, 10:55 a.m.
Registration Date	Jan. 28, 2021, 3:06 p.m.
Last Update	Nov. 21, 2024, 10:44 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:openstack:folsom:2012.2:::::::*

Related information, measures and tools

No	URL	タグ
1	http://rhn.redhat.com/errata/RHSA-2012-1557.html
2	http://rhn.redhat.com/errata/RHSA-2012-1557.html
3	http://secunia.com/advisories/51423	Vendor Advisory
4	http://secunia.com/advisories/51423	Vendor Advisory
5	http://secunia.com/advisories/51436	Vendor Advisory
6	http://secunia.com/advisories/51436	Vendor Advisory
7	http://www.openwall.com/lists/oss-security/2012/11/28/5	Patch
8	http://www.openwall.com/lists/oss-security/2012/11/28/5	Patch
9	http://www.openwall.com/lists/oss-security/2012/11/28/6	Patch
10	http://www.openwall.com/lists/oss-security/2012/11/28/6	Patch
11	http://www.securityfocus.com/bid/56727
12	http://www.securityfocus.com/bid/56727
13	http://www.ubuntu.com/usn/USN-1641-1
14	http://www.ubuntu.com/usn/USN-1641-1
15	https://bugs.launchpad.net/keystone/+bug/1079216
16	https://bugs.launchpad.net/keystone/+bug/1079216
17	https://exchange.xforce.ibmcloud.com/vulnerabilities/80370
18	https://exchange.xforce.ibmcloud.com/vulnerabilities/80370
19	https://github.com/openstack/keystone/commit/38c7e46a640a94da4da89a39a5a1ea9c081f1eb5
20	https://github.com/openstack/keystone/commit/38c7e46a640a94da4da89a39a5a1ea9c081f1eb5
21	https://github.com/openstack/keystone/commit/f9d4766249a72d8f88d75dcf1575b28dd3496681
22	https://github.com/openstack/keystone/commit/f9d4766249a72d8f88d75dcf1575b28dd3496681

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-255	証明書・パスワード管理	https://cwe.mitre.org/data/definitions/255.html

JVN Vulnerability Information

OpenStack Keystone における承認の制限を回避される脆弱性

Title	OpenStack Keystone における承認の制限を回避される脆弱性
Summary	OpenStack Folsom で使用される OpenStack Keystone は、トークンの有効期限切れに関する実装が適切でないため、承認の制限を回避される脆弱性が存在します。本脆弱性は、CVE-2012-3426 のリグレッションに起因した脆弱性です。
Possible impacts	リモート認証されたユーザにより、トークンの連鎖 (chaining) を介して新しいトークンを生成されることで、承認の制限を回避される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Nov. 28, 2012, midnight
Registration Date	Dec. 19, 2012, 2:52 p.m.
Last Update	Dec. 19, 2012, 2:52 p.m.

Affected System

OpenStack

OpenStack Compute Folsom 2012.2

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2012-5563	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5563
National Vulnerability Database (NVD)
2	CVE-2012-5563	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5563

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-255	https://jvndb.jvn.jp/ja/cwe/CWE-255.html

ベンダー情報

No	Name	URL
GitHub
1	Ensure token expiration is maintained	https://github.com/openstack/keystone/commit/f9d4766249a72d8f88d75dcf1575b28dd3496681
2	Ensure token expiration is maintained (bug 1079216)	https://github.com/openstack/keystone/commit/38c7e46a640a94da4da89a39a5a1ea9c081f1eb5
Launchpad
3	token expires time incorrect for auth by one token	https://bugs.launchpad.net/keystone/+bug/1079216
OpenStack
4	2012-019	http://lists.openstack.org/pipermail/openstack-announce/2012-November/000056.html
5	Folsom Security Advisories	http://wiki.openstack.org/SecurityAdvisories/Folsom
Ubuntu Security Notice
6	USN-1641-1	http://www.ubuntu.com/usn/USN-1641-1

Change Log

No	Changed Details	Date of change
0	[2012年12月19日] 掲載	Feb. 17, 2018, 10:37 a.m.