ceph: Object Gateway server DoS by sending invalid cross-origin HTTP request

A flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the CORS policy was set to allow origin on a bucket. A remote unauthenticated attacker could use this flaw to cause denial of service by sending a specially-crafted cross-origin HTTP request...

Legal Robot: S3 ACL misconfiguration

Summary: Legal Robot's s3 bucket legalrobot.com is misconfigured. The ACL allows me to access and copy all files. This means that I could go through and copy all the media files on the s3 bucket. I did not attempt to delete any files as I did not want to go too far and affect your operations. Ste...

Moderate: Red Hat Security Advisory: Red Hat Ceph Storage 1.3 security, bug fix, and enhancement update

An update is now available for Red Hat Ceph Storage 1.3. This erratum is applicable for Red Hat Ceph Storage that runs on Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, whic...

DEBIAN-CVE-2016-7031

The RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket, allows remote attackers to list the bucket contents via a URL...

CVE-2016-7031

The RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket, allows remote attackers to list the bucket contents via a URL...

CVE-2016-7031

The RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket, allows remote attackers to list the bucket contents via a URL...

Code injection

The RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket, allows remote attackers to list the bucket contents via a URL...

CVE-2016-7031

Ceph RGW vulnerability CVE-2016-7031 affects Ceph before 10.0.1: when an authenticated-read ACL is applied to a bucket, an attacker can list bucket contents via a URL. Mitigation observed in connected advisories: Red Hat Ceph Storage 1.3.3 (RHSA-2016:1972) fixes this issue; Ubuntu USN-3452-1 list...

CVE-2016-7031

The RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket, allows remote attackers to list the bucket contents via a URL...

CVE-2016-7031

The RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket, allows remote attackers to list the bucket contents via a URL...

UBUNTU-CVE-2016-7031

The RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket, allows remote attackers to list the bucket contents via a URL...

WebSummit: Full Sub Domain Takeover at s3.websummit.net

Hey The sub domain at s3.websummit.net is pointing to dws-content.s3-website-eu-west-1.amazonaws.com. http://s3.websummit.net/ 404 Not Found Code: NoSuchBucket Message: The specified bucket does not exist BucketName: s3.websummit.net RequestId: DB4C92F0D805D3F3 HostId:...

ceph: RGW permits bucket listing when authenticated_users=read

A flaw was found in Ceph RGW code which allows an anonymous user to list contents of RGW bucket by bypassing ACL which should only allow authenticated users to list contents of bucket...

Moderate: Red Hat Security Advisory: Red Hat Ceph Storage 1.3.3 security, bug fix, and enhancement update

Red Hat Ceph Storage 1.3.3 that fixes one security issue, multiple bugs, and adds various enhancements is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score,...

ceph: RGW permits bucket listing when authenticated_users=read

A flaw was found in Ceph RGW code which allows an anonymous user to list contents of RGW bucket by bypassing ACL which should only allow authenticated users to list contents of bucket...

Reverb.com: Possible Blind Writing to S3 Bucket

Hi All, I noticed that you are using S3 and I believe I may have found one of your buckets and am able to write to it. However, I can not list the files in the bucket and such can not be 100% sure you own it. If you don't, I'd really appreciate being able to close this report myself or have you...

Legal Robot: Amazon Bucket Accessible (http://legalrobot.s3.amazonaws.com/)

Seeing your s3 Amazon bucket, the problem is, visiting your amazon bucket will shows the files on the bucket, while secure bucket would bring up an access denied page. I have attached Screenshots comparing your bucket with secure bucket to show you what a secure bucket looks like and where the...

Automated Malware Incident Response & Analysis: AMIRA

Automated Malware Incident Response & Analysis AMIRA is a service for automatically running the analysis on the OSXCollector output files. The automated analysis is performed via OSXCollector Output Filters, in particular The One Filter to Rule Them All : the Analyze Filter. AMIRA takes care of...

LocalTapiola: Amazon Bucket Accessible (http://inpref.s3.amazonaws.com/)

Searching through the source code of your homepage shows a few http://inpref.s3.amazonaws.com/ URLS. I assume that you own this s3 Amazon bucket. The problem here is, visiting that amazon bucket on a browser will shows the files on the bucket, whilst a secure bucket would bring up an access denie...

Bumble: AWS S3 Bucket hotornot-images permissions allow for listing and removing files

We do not use amazon AWS but @yaworsk wanted to disclose his report anyway. Why not, we can do. ---- Hi All, Though I'm not 100% sure you own the bucket - and if not, I would appreciate being able to close this myself - I believe you may own the S3 bucket hotornot-images. If so, using the AWS CLI...