{"id": "CVE-2014-8177", "bulletinFamily": "NVD", "title": "CVE-2014-8177", "description": "The Red Hat gluster-swift package, as used in Red Hat Gluster Storage (formerly Red Hat Storage Server), allows remote authenticated users to bypass the max_meta_count constraint via multiple crafted requests which exceed the limit when combined.", "published": "2016-06-07T14:06:00", "modified": "2019-04-22T17:48:00", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:P/A:N"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8177", "reporter": "secalert@redhat.com", "references": ["http://www.openwall.com/lists/oss-security/2015/08/27/5", "http://rhn.redhat.com/errata/RHSA-2015-1845.html", "http://rhn.redhat.com/errata/RHSA-2015-1846.html", "https://bugzilla.redhat.com/show_bug.cgi?id=1257525"], "cvelist": ["CVE-2014-8177"], "type": "cve", "lastseen": "2021-04-22T23:44:14", "edition": 5, "viewCount": 2, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["REDHAT-RHSA-2015-1845.NASL", "REDHAT-RHSA-2015-1846.NASL"]}, {"type": "redhat", "idList": ["RHSA-2015:1845", "RHSA-2015:1846"]}], "modified": "2021-04-22T23:44:14", "rev": 2}, "score": {"value": 4.7, "vector": "NONE", "modified": "2021-04-22T23:44:14", "rev": 2}, "vulnersScore": 4.7}, "cpe": ["cpe:/a:redhat:gluster_storage_management_console:3.1", "cpe:/a:redhat:storage_native_client:-", "cpe:/a:redhat:gluster_storage_server:3.1"], "affectedSoftware": [{"cpeName": "redhat:gluster_storage_server", "name": "redhat gluster storage server", "operator": "eq", "version": "3.1"}, {"cpeName": "redhat:gluster_storage_server", "name": "redhat gluster storage server", "operator": "eq", "version": "3.1"}, {"cpeName": "redhat:storage_native_client", "name": "redhat storage native client", "operator": "eq", "version": "-"}, {"cpeName": "redhat:gluster_storage_management_console", "name": "redhat gluster storage management console", "operator": "eq", "version": "3.1"}], "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6}, "cpe23": ["cpe:2.3:a:redhat:gluster_storage_server:3.1:*:*:*:*:*:*:*", "cpe:2.3:a:redhat:gluster_storage_management_console:3.1:*:*:*:*:*:*:*", "cpe:2.3:a:redhat:storage_native_client:-:*:*:*:*:*:*:*"], "cwe": ["CWE-284"], "scheme": null, "affectedConfiguration": [{"cpeName": "redhat:enterprise_linux", "name": "redhat enterprise linux", "operator": "eq", "version": "7.0"}, {"cpeName": "redhat:enterprise_linux", "name": "redhat enterprise linux", "operator": "eq", "version": "6.0"}], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"children": [{"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:a:redhat:gluster_storage_server:3.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:redhat:gluster_storage_management_console:3.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}], "operator": "OR"}, {"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}], "operator": "OR"}], "cpe_match": [], "operator": "AND"}, {"children": [{"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}], "operator": "OR"}, {"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:a:redhat:gluster_storage_server:3.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}], "operator": "OR"}], "cpe_match": [], "operator": "AND"}, {"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:a:redhat:storage_native_client:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}], "operator": "OR"}]}, "extraReferences": [{"name": "[oss-security] 20150827 CVE-2014-8177 gluster-swift metadata constraints are not correctly enforced", "refsource": "MLIST", "tags": [], "url": "http://www.openwall.com/lists/oss-security/2015/08/27/5"}, {"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1257525", "refsource": "CONFIRM", "tags": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1257525"}, {"name": "RHSA-2015:1846", "refsource": "REDHAT", "tags": ["Vendor Advisory"], "url": "http://rhn.redhat.com/errata/RHSA-2015-1846.html"}, {"name": "RHSA-2015:1845", "refsource": "REDHAT", "tags": ["Vendor Advisory"], "url": "http://rhn.redhat.com/errata/RHSA-2015-1845.html"}], "immutableFields": []}

{"nessus": [{"lastseen": "2021-05-01T02:47:50", "description": "A flaw exists in Red Hat Gluster Storage's OpenStack Object Storage\n(swiftonfile) due to improper enforcement of metadata constraints. An\nauthenticated, remote attacker can exploit this, via added metadata in\nseveral separate calls, to bypass the max_meta_count restraint and\nstore more metadata than allowed by the configuration, resulting in a\ndenial of service condition.", "edition": 28, "published": "2015-10-07T00:00:00", "title": "RHEL 6 : swiftonfile (RHSA-2015:1845)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-8177"], "modified": "2021-05-02T00:00:00", "cpe": ["p-cpe:/a:redhat:enterprise_linux:swiftonfile", "cpe:/o:redhat:enterprise_linux:6"], "id": "REDHAT-RHSA-2015-1845.NASL", "href": "https://www.tenable.com/plugins/nessus/86306", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(86306);\n script_version(\"2.7\");\n script_cvs_date(\"Date: 2019/10/24 15:35:40\");\n\n script_cve_id(\"CVE-2014-8177\");\n script_bugtraq_id(76979);\n script_xref(name:\"RHSA\", value:\"2015:1845\");\n\n script_name(english:\"RHEL 6 : swiftonfile (RHSA-2015:1845)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"A flaw exists in Red Hat Gluster Storage's OpenStack Object Storage\n(swiftonfile) due to improper enforcement of metadata constraints. An\nauthenticated, remote attacker can exploit this, via added metadata in\nseveral separate calls, to bypass the max_meta_count restraint and\nstore more metadata than allowed by the configuration, resulting in a\ndenial of service condition.\");\n script_set_attribute(attribute:\"see_also\", value:\"http://rhn.redhat.com/errata/RHSA-2015-1845.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.redhat.com/security/data/cve/CVE-2014-8177.html\");\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/08/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/10/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/10/07\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:swiftonfile\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2015-2019 Tenable Network Security, Inc.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat Enterprise Linux\");\nos_ver = eregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat Enterprise Linux\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^6([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat Enterprise Linux 6.x\", \"Red Hat Enterprise Linux \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat Enterprise Linux\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"RHEL6\", reference:\"swiftonfile-1.13.1-5.el6\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"swiftonfile\");\n}\n", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2021-05-01T02:47:51", "description": "A flaw exists in Red Hat Gluster Storage's OpenStack Object Storage\n(swiftonfile) due to improper enforcement of metadata constraints. An\nauthenticated, remote attacker can exploit this, via added metadata in\nseveral separate calls, to bypass the max_meta_count restraint and\nstore more metadata than allowed by the configuration, resulting in a\ndenial of service condition.", "edition": 28, "published": "2015-11-11T00:00:00", "title": "RHEL 7 : swiftonfile (RHSA-2015:1846)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-8177"], "modified": "2021-05-02T00:00:00", "cpe": ["p-cpe:/a:redhat:enterprise_linux:swiftonfile", "cpe:/o:redhat:enterprise_linux:7"], "id": "REDHAT-RHSA-2015-1846.NASL", "href": "https://www.tenable.com/plugins/nessus/86844", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(86844);\n script_version(\"2.6\");\n script_cvs_date(\"Date: 2019/10/24 15:35:40\");\n\n script_cve_id(\"CVE-2014-8177\");\n script_bugtraq_id(76979);\n script_xref(name:\"RHSA\", value:\"2015:1846\");\n\n script_name(english:\"RHEL 7 : swiftonfile (RHSA-2015:1846)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"A flaw exists in Red Hat Gluster Storage's OpenStack Object Storage\n(swiftonfile) due to improper enforcement of metadata constraints. An\nauthenticated, remote attacker can exploit this, via added metadata in\nseveral separate calls, to bypass the max_meta_count restraint and\nstore more metadata than allowed by the configuration, resulting in a\ndenial of service condition.\");\n script_set_attribute(attribute:\"see_also\", value:\"http://rhn.redhat.com/errata/RHSA-2015-1846.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.redhat.com/security/data/cve/CVE-2014-8177.html\");\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/08/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/10/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/11/11\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:swiftonfile\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2015-2019 Tenable Network Security, Inc.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat Enterprise Linux\");\nos_ver = eregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat Enterprise Linux\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat Enterprise Linux 7.x\", \"Red Hat Enterprise Linux \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat Enterprise Linux\", cpu);\nif (\"x86_64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"swiftonfile-1.13.1-5.el7\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"swiftonfile\");\n}\n", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}], "redhat": [{"lastseen": "2019-12-11T13:32:03", "bulletinFamily": "unix", "cvelist": ["CVE-2014-8177", "CVE-2015-1856"], "description": "Red Hat Gluster Storage is a software only scale-out storage solution that\nprovides flexible and affordable unstructured data storage. It unifies data\nstorage and infrastructure, increases performance, and improves\navailability and manageability to meet enterprise-level storage challenges.\n\nRed Hat Gluster Storage's Unified File and Object Storage is built on\nOpenStack's Object Storage (swift).\n\nA flaw was found in the metadata constraints in Red Hat Gluster Storage's\nOpenStack Object Storage (swiftonfile). By adding metadata in several\nseparate calls, a malicious user could bypass the max_meta_count\nconstraint, and store more metadata than allowed by the configuration.\n(CVE-2014-8177)\n\nThis update also fixes numerous bugs and adds various enhancements. Space\nprecludes documenting all of these changes in this advisory. Users are\ndirected to the Red Hat Gluster Storage 3.1 Technical Notes, linked to in\nthe References section, for information on the most significant of these\nchanges.\n\nThis advisory introduces the following new features:\n\n* Gdeploy is a tool which automates the process of creating, formatting,\nand mounting bricks. When setting up a fresh cluster, gdeploy could be the\npreferred choice of cluster set up, as manually executing numerous commands\ncan be error prone. The advantages of using gdeploy includes automated\nbrick creation, flexibility in choosing the drives to configure (sd, vd,\netc.), and flexibility in naming the logical volumes (LV) and volume groups\n(VG). (BZ#1248899)\n\n* The gstatus command is now fully supported. The gstatus command provides\nan easy-to-use, high-level view of the health of a trusted storage pool\nwith a single command. It gathers information about the health of a Red Hat\nGluster Storage trusted storage pool for distributed, replicated,\ndistributed-replicated, dispersed, and distributed-dispersed volumes.\n(BZ#1250453)\n\n* You can now recover a bad file detected by BitRot from a replicated\nvolume. The information about the bad file will be logged in the scrubber\nlog file located at /var/log/glusterfs/scrub.log. (BZ#1238171)\n\n* Two tailored tuned profiles are introduced to improve the performance for\nspecific Red Hat Gluster Storage workloads. They are: rhgs-sequential-io,\nwhich improves performance of large files with sequential I/O workloads,\nand rhgs-random-io, which improves performance of small files with random\nI/O workloads (BZ# 1251360)\n\nAll users of Red Hat Gluster Storage are advised to apply this update.\n", "modified": "2018-06-13T01:28:29", "published": "2015-10-05T04:00:00", "id": "RHSA-2015:1845", "href": "https://access.redhat.com/errata/RHSA-2015:1845", "type": "redhat", "title": "(RHSA-2015:1845) Moderate: Red Hat Gluster Storage 3.1 update", "cvss": {"score": 5.5, "vector": "AV:N/AC:L/Au:S/C:N/I:P/A:P"}}, {"lastseen": "2019-12-11T13:32:00", "bulletinFamily": "unix", "cvelist": ["CVE-2014-8177", "CVE-2015-1856"], "description": "Red Hat Gluster Storage is a software only scale-out storage solution that\nprovides flexible and affordable unstructured data storage. It unifies data\nstorage and infrastructure, increases performance, and improves\navailability and manageability to meet enterprise-level storage challenges.\n\nRed Hat Gluster Storage's Unified File and Object Storage is built on\nOpenStack's Object Storage (swift).\n\nA flaw was found in the metadata constraints in Red Hat Gluster Storage's\nOpenStack Object Storage (swiftonfile). By adding metadata in several\nseparate calls, a malicious user could bypass the max_meta_count\nconstraint, and store more metadata than allowed by the configuration.\n(CVE-2014-8177)\n\nThis update also fixes numerous bugs and adds various enhancements. Space\nprecludes documenting all of these changes in this advisory. Users are\ndirected to the Red Hat Gluster Storage 3.1 Technical Notes, linked to in\nthe References section, for information on the most significant of these\nchanges.\n\nThis advisory introduces the following new features:\n\n* Gdeploy is a tool which automates the process of creating, formatting,\nand mounting bricks. When setting up a fresh cluster, gdeploy could be the\npreferred choice of cluster set up, as manually executing numerous commands\ncan be error prone. The advantages of using gdeploy includes automated\nbrick creation, flexibility in choosing the drives to configure (sd, vd,\netc.), and flexibility in naming the logical volumes (LV) and volume groups\n(VG). (BZ#1248899)\n\n* The gstatus command is now fully supported. The gstatus command provides\nan easy-to-use, high-level view of the health of a trusted storage pool\nwith a single command. It gathers information about the health of a Red Hat\nGluster Storage trusted storage pool for distributed, replicated,\ndistributed-replicated, dispersed, and distributed-dispersed volumes.\n(BZ#1250453)\n\n* You can now recover a bad file detected by BitRot from a replicated\nvolume. The information about the bad file will be logged in the scrubber\nlog file located at /var/log/glusterfs/scrub.log. (BZ#1238171)\n\n* Two tailored tuned profiles are introduced to improve the performance for\nspecific Red Hat Gluster Storage workloads. They are: rhgs-sequential-io,\nwhich improves performance of large files with sequential I/O workloads,\nand rhgs-random-io, which improves performance of small files with random\nI/O workloads (BZ# 1251360)\n\nAll users of Red Hat Gluster Storage are advised to apply this update.", "modified": "2018-03-19T16:14:22", "published": "2015-10-05T10:48:27", "id": "RHSA-2015:1846", "href": "https://access.redhat.com/errata/RHSA-2015:1846", "type": "redhat", "title": "(RHSA-2015:1846) Moderate: Red Hat Gluster Storage 3.1 update", "cvss": {"score": 5.5, "vector": "AV:N/AC:L/Au:S/C:N/I:P/A:P"}}]}