CVE - CVE-2012-3360

CVE-ID
CVE-2012-3360	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Directory traversal vulnerability in virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2) and Essex (2012.1), when used over libvirt-based hypervisors, allows remote authenticated users to write arbitrary files to the disk image via a .. (dot dot) in the path attribute of a file element.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:49763 URL:http://secunia.com/advisories/49763 MISC:49802 URL:http://secunia.com/advisories/49802 MISC:54277 URL:http://www.securityfocus.com/bid/54277 MISC:FEDORA-2012-10420 URL:http://lists.fedoraproject.org/pipermail/package-announce/2012-July/083984.html MISC:USN-1497-1 URL:http://www.ubuntu.com/usn/USN-1497-1 MISC:[openstack] 20120603 [OSSA 2012-008] Arbitrary file injection/corruption through directory traversal issues (CVE-2012-3360, CVE-2012-3361) URL:https://lists.launchpad.net/openstack/msg14089.html MISC:https://bugs.launchpad.net/nova/+bug/1015531 URL:https://bugs.launchpad.net/nova/+bug/1015531 MISC:https://github.com/openstack/nova/commit/2427d4a99bed35baefd8f17ba422cb7aae8dcca7 URL:https://github.com/openstack/nova/commit/2427d4a99bed35baefd8f17ba422cb7aae8dcca7 MISC:https://github.com/openstack/nova/commit/b0feaffdb2b1c51182b8dce41b367f3449af5dd9 URL:https://github.com/openstack/nova/commit/b0feaffdb2b1c51182b8dce41b367f3449af5dd9
Assigning CNA
Red Hat, Inc.
Date Record Created
20120614	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20120614)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)