CVE-2012-3361

2012-07-0300:00:00

ubuntu.com

5.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:P/A:P

0.004 Low

EPSS

Percentile

72.9%

JSON

virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2), Essex
(2012.1), and Diablo (2011.3) allows remote authenticated users to
overwrite arbitrary files via a symlink attack on a file in an image.

Bugs

<https://bugs.launchpad.net/nova/+bug/1015531>

Notes

Author	Note
tyhicks	Per OpenStack Vuln Mgmt Team, all Nova versions are affected The fix for this CVE was incomplete, see CVE-2012-3447

OSVersionArchitecturePackageVersionFilename
ubuntu11.10noarchnova< 2011.3-0ubuntu6.9UNKNOWN
ubuntu12.04noarchnova< 2012.1+stable~20120612-3ee026e-0ubuntu1.1UNKNOWN