CVE-2014-3555 – openstack-neutron: Denial of Service in Neutron allowed address pair

https://notcve.org/view.php?id=CVE-2014-3555

OpenStack Neutron before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to cause a denial of service (crash or long firewall rule updates) by creating a large number of allowed address pairs. OpenStack Neutron anterior a 2013.2.4, 2014.x anterior a 2014.1.2 y Juno anterior a Juno-2 permite a usuarios remotos autenticados causar una denegación de servicio (caída o actualizaciones de normas largas de firewall) mediante la creación de un número grande de parejas de direcciones permitidas. A denial of service flaw was found in neutron's handling of allowed address pairs. As there was no enforced quota on the amount of allowed address pairs, a sufficiently authorized user could possibly create a large number of firewall rules, impacting performance or potentially rendering a compute node unusable. • http://lists.openstack.org/pipermail/openstack-announce/2014-July/000255.html http://rhn.redhat.com/errata/RHSA-2014-1119.html http://rhn.redhat.com/errata/RHSA-2014-1120.html http://seclists.org/oss-sec/2014/q3/200 http://secunia.com/advisories/60766 http://secunia.com/advisories/60804 http://www.securityfocus.com/bid/68765 https://bugs.launchpad.net/neutron/+bug/1336207 https://access.redhat.com/security/cve/CVE-2014-3555 https://bugzilla.redhat.com/show_bug.cgi • CWE-264: Permissions, Privileges, and Access Controls CWE-400: Uncontrolled Resource Consumption •