SUSE-SU-2018:2762-1 Security update for crowbar, crowbar-core, crowbar-ha, crowbar-init, crowbar-openstack, crowbar-ui

This update for crowbar, crowbar-ha, crowbar-init, crowbar-openstack, crowbar-ui fixes the following issues: This security issues was fixed: - CVE-2018-3760: Upgrade rubygem-sprockets to prevent an information leak. Specially crafted requests could have been be used to access files that exists on...

Crowbar Information Disclosure Vulnerability

crowdbar is a set of OpenStack installation frameworks for use in SUSE. A security vulnerability exists in the install-chef-suse.sh script in crowdbar, which stems from the program assigning insecure permissions when creating files with sensitive data. A local attacker could exploit the...

CVE-2012-0433

The install-chef-suse.sh script shipped with crowbar before 2012-10-02 is creating files containing confidential data with insecure permissions, allowing local users to read confidential data...

CVE-2012-0433

CVE-2012-0433 affects the crowbar project’s script install-chef-suse.sh , shipped before 2012-10-02. The script creates files that contain confidential data with insecure permissions, enabling local users to read that data. This is confirmed by multiple sources (SUSE CVE entry, NVD/CVE records, C...

SUSE-SU-2018:1103-1 Security update for crowbar-openstack

This update for crowbar-openstack provides the following fixes: - memcached: Disable UDP by default to prevent spoofed traffic amplification DoS bsc1083903, CVE-2018-1000115 - nova: Add resource limits for api and compute bsc1057086...

SUSE-RU-2018:1071-1 Recommended update for several crowbar barclamps

This update for Crowbar provides several fixes and improvements for the following barclamps: crowbar-openstack: - nova: Use internal placement url bsc1055188 - nova: Subscribe to placement config bsc1055188 - barbican: Add missing roles used in policy.json bsc1081573 - barbican: Add creator role...

Crowbar - Brute Forcing Tool (SSH, OpenVPN, RDP, VNC)

Crowbar formally known as Levye is a brute forcing tool that can be used during penetration tests. It was developed to brute force some protocols in a different manner according to other popular brute forcing tools. As an example, while most brute forcing tools use username and password for SSH...

Default credentials

The trove service user in 1 Openstack deployment aka crowbar-openstack and 2 Trove Barclamp aka barclamp-trove and crowbar-barclamp-trove in the Crowbar Framework has a default password, which makes it easier for remote attackers to obtain access via unspecified vectors...

CVE-2016-6829

The CVE-2016-6829 vulnerability affects the Crowbar/OpenStack deployment components (crowbar-openstack and Crowbar’s Trove-related barclamps). The issue is a default password used by the trove service user, enabling remote access via unspecified vectors. Multiple connected sources confirm the roo...

SUSE-SU-2016:3056-1 Security update for crowbar-barclamp-trove

This update for crowbar-barclamp-trove fixes the following issues: - Fix initial migration and schema revision. - Set the trove service password to random. bsc991729, CVE-2016-6829...

Crowbar Openstack Insecure Default Password Vulnerability

An insecure default password vulnerability exists in Crowbar Openstack. A remote attacker could exploit this vulnerability to gain unauthorized access and perform unauthorized actions...

SUSE-SU-2015:1890-1 Security update for openstack-neutron and crowbar-barclamp-neutron

This update provides security fixes and improvements for openstack-neutron and crowbar-barclamp-neutron. crowbar-barclamp-neutron: - Add infoblox support. - Add configurations required to support DHCP relay. - Create 'floating' network as 'flat' provider network. bsc946882 - Fix search for Nova...

SUSE-RU-2015:1730-1 Recommended update for various Crowbar barclamps and OpenStack components

This update provides fixes and enhancements for various Crowbar barclamps and OpenStack components. crowbar-barclamp-ceilometer: - Do not assume ceilometer-agent-hyperv is listed in elements. bsc937117 crowbar-barclamp-cinder: - Fix hideShow toggle of passwordfield in backends. bsc919963...

Web Application Brute Force Attack: Crowbar

Web Application Brute Force Attack Crowbar was developed to brute force some protocols in a different manner then other ‘popular’ brute forcing tools. As an example, while most brute forcing tools use username and password for SSH brute forcing, Crowbar uses SSH keys. Currently Crowbar supports...

SUSE-RU-2015:0462-1 Recommended update for crowbar-barclamp-nova_dashboard

This update for crowbar-barclamp-novadashboard provides stability fixes from the upstream OpenStack project: Use a host specific memcache key for djangocompressor bnc894070 Add Requires on crowbar-barclamp-openstack for the new crowbar-openstack cookbook. Use helpers from new crowbar-openstack...

CVE-2014-0592

CVE-2014-0592 concerns Barclamp (aka barclamp-network) version 1.7 used in SUSE Cloud 3. It reports that the Crowbar Framework component does not enable netfilter on bridges when creating new instances, allowing remote attackers to bypass security group restrictions via unspecified vectors relate...

Code injection

The server in Crowbar, as used in SUSE Cloud 1.0, uses weak permissions for the production.log file, which has unspecified impact and attack vectors...

CVE-2012-0434

The CVE concerns the Crowbar server used in SUSE Cloud 1.0, where the production.log file has weak permissions. The available connected documents confirm the affected component and the root cause (inappropriate permissions on production.log). The impact is not specified in the provided materials,...

CVE-2012-3537

The Crowbar Ohai plugin chef/cookbooks/ohai/files/default/plugins/crowbar.rb in the Deployer Barclamp in Crowbar, possibly 1.4 and earlier, allows local users to execute arbitrary shell commands via vectors related to "insecure handling of tmp files" and predictable file names...

CVE-2012-3551

Cross-site scripting XSS vulnerability in crowbarframework/app/views/support/index.html.haml in the Crowbar barclamp in Crowbar, possibly 1.4 and earlier, allows remote attackers to inject arbitrary web script or HTML via the file parameter to /utils...