Security Bulletin: Vulnerabilities in OpenSSL affect IBM SDN VE (CVE-2014- 3505, CVE-2014-3506, CVE-2014-3507, CVE-2014-3509, CVE-2014-3510, CVE-2014- 3511)

Summary Security vulnerabilities have been discovered in OpenSSL. Vulnerability Details CVEID: CVE-2014-3511 DESCRIPTION: OpenSSL could allow a remote attacker to bypass security restrictions, caused by the negotiation of TLS 1.0 instead of higher protocol versions by the OpenSSL SSL/TLS server...

Security Bulletin: Vulnerabilities in Bash affect IBM SDN VE (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278)

Summary Six Bash vulnerabilities were disclosed in September 2014. This bulletin addresses the vulnerabilities that have been referred to as “Bash Bug” or “Shellshock” and two memory corruption vulnerabilities. Bash is used by IBM SDN VE. Vulnerability Details CVE-ID: CVE-2014-6271 DESCRIPTION: G...

Security Bulletin: IBM SDN for Virtual Environments is affected by a vulnerability in OpenSSL (CVE-2014-0224)

Summary A security vulnerability has been discovered in OpenSSL. Vulnerability Details CVE-ID: CVE-2014-0224 DESCRIPTION: An attacker using a carefully crafted handshake can force the use of weak keying material in OpenSSL SSL/TLS clients and servers. This can be exploited by a Man-in-the-middle...

Security Bulletin: IBM SDN for Virtual Environments is affected by a vulnerability in OpenSSL (CVE-2014-0160)

Summary A security vulnerability has been discovered in OpenSSL. Vulnerability Details CVE-ID: CVE-2014-0160 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTLS heartbeat functionality. An attacker could exploit this vulnerability...

sdnpwn - An SDN Penetration Testing Toolkit

The Open Networking Foundation defines SDN as “The physical separation of the network control plane from the forwarding plane, and where a control plane controls several devices”. What this means is that the decision making which would traditionally be performed by a router or a switch i.e...

DELTA - SDN Security Evaluation Framework

DELTA is a penetration testing framework that regenerates known attack scenarios for diverse test cases. This framework also provides the capability of discovering unknown security problems in SDN by employing a fuzzing technique. Agent-Manager is the control tower. It takes full control over all...

Juniper NorthStar Controller Application Remote Elevation of Privilege Vulnerability

NorthStar is Juniper's SDN controller that dynamically builds SR TE-LSPs and observes labeling information for each link, LSP. Also based on traffic distribution, SR LSPs can be dynamically optimized. A remote elevation of privilege vulnerability exists in the Juniper NorthStar controller...

CVE-2015-1611

OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to "fake LLDP injection."...

Design/Logic Flaw

OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to "fake LLDP injection."...

Buffer overflow

OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to the reuse of LLDP packets, aka "LLDP Relay."...

CVE-2015-1612

OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to the reuse of LLDP packets, aka "LLDP Relay."...

CVE-2015-1611

The OpenFlow plugin for OpenDaylight (before Helium SR3) is affected by LLDP spoofing via fake LLDP injections, enabling remote attackers to spoof the SDN topology and disrupt data flow. Affected component: openflowplugin in OpenDaylight; root cause: reuse/fake LLDP packets. Impact: topology spoo...

CVE-2015-1612

The CVE-2015-1612 issue affects the OpenFlow plugin for OpenDaylight (before Helium SR3). It enables LLDP-related spoofing of the SDN topology that can affect data flow. Affected component: openflowplugin in OpenDaylight; root cause: reuse of LLDP packets leading to topology spoofing (LLDP Relay)...

CVE-2015-1611

OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to "fake LLDP injection."...

i-SDN Manager /data/config/userdb information leak vulnerability

No description provided by source...

CVE-2016-3708

Red Hat OpenShift Enterprise 3.2, when multi-tenant SDN is enabled and a build is run in a namespace that would normally be isolated from pods in other namespaces, allows remote authenticated users to access network resources on restricted pods via an s2i build with a builder image that 1 contain...

Design/Logic Flaw

Red Hat OpenShift Enterprise 3.2, when multi-tenant SDN is enabled and a build is run in a namespace that would normally be isolated from pods in other namespaces, allows remote authenticated users to access network resources on restricted pods via an s2i build with a builder image that 1 contain...

CVE-2016-3708

CVE-2016-3708 affects Red Hat OpenShift Enterprise 3.2 when multi-tenant SDN is enabled. A build running in a namespace that would normally be isolated from other pods can access network resources on restricted pods via an s2i build using a builder image that (1) contains ONBUILD commands or (2) ...

CVE-2016-3708

Red Hat OpenShift Enterprise 3.2, when multi-tenant SDN is enabled and a build is run in a namespace that would normally be isolated from pods in other namespaces, allows remote authenticated users to access network resources on restricted pods via an s2i build with a builder image that 1 contain...

PT-2016-5669 · Red Hat · Red Hat Openshift Enterprise

Name of the Vulnerable Software and Affected Versions: Red Hat OpenShift Enterprise version 3.2 Description: The issue allows remote authenticated users to access network resources on restricted pods via an s2i build with a builder image that contains ONBUILD commands or does not contain a tar...