SB2021012849 - Ubuntu update for ceph

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2021012849

SB2021012849 - Ubuntu update for ceph

Published: January 28, 2021

Security Bulletin ID SB2021012849
Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 75% Low 25%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 secuirty vulnerabilities.


1) Security restrictions bypass (CVE-ID: CVE-2018-1128)

The vulnerability allows an adjacent attacker to conduct replay attack on the target system.

The vulnerability exists in ceph branches master, mimic, luminous and jewel due to cephx authentication protocol did not verify ceph clients correctly. An adjacent attacker with access to ceph cluster network who is able to sniff packets on network can authenticate with ceph service, perform actions allowed by ceph service, conduct replay attack and bypass security restrictions.


2) Improper Authorization (CVE-ID: CVE-2020-10736)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to improper authorization, related to mons & mgrs. A remote attacker can pass specially crafted data to the application and bypass implemented security restrictions.


3) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: CVE-2020-10753)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. Ceph versions 3.x and 4.x are vulnerable to this issue.


4) Authentication bypass using an alternate path or channel (CVE-ID: CVE-2020-25660)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists with in the implementation of the Cephx authentication protocol. A remote attacker with access to the Ceph cluster network can intercept authentication packets and perform  replay attacks in Nautilus.

The vulnerability affects msgr2 protocol only and is basically a reintroduction of previously patched vulnerability #VU14542.


Remediation

Install update from vendor's website.

References