Описание
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended MAC-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via (1) a crafted DHCP discovery message or (2) crafted non-IP traffic.
Neutron functionality includes internal firewall management between networks. Due to the relaxed nature of particular rules, it is possible for machines on the same layer 2 networks to forge non-IP traffic, such as ARP and DHCP requests.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse) | openstack-neutron | Will not fix | ||
| Red Hat Enterprise Linux OpenStack Platform 6 (Juno) | openstack-neutron | Will not fix | ||
| Red Hat OpenStack Platform 10 (Newton) | openstack-neutron | Not affected | ||
| Red Hat OpenStack Platform 9 (Mitaka) | openstack-neutron | Affected | ||
| Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 | openstack-neutron | Fixed | RHSA-2016:1474 | 20.07.2016 |
| Red Hat OpenStack Platform 8.0 (Liberty) | openstack-neutron | Fixed | RHSA-2016:1473 | 20.07.2016 |
Показывать по
Дополнительная информация
Статус:
EPSS
6.3 Medium
CVSS3
6.5 Medium
CVSS2
Связанные уязвимости
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended MAC-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via (1) a crafted DHCP discovery message or (2) crafted non-IP traffic.
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended MAC-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via (1) a crafted DHCP discovery message or (2) crafted non-IP traffic.
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 thro ...
OpenStack Neutron Intended MAC-spoofing protection mechanism bypass
EPSS
6.3 Medium
CVSS3
6.5 Medium
CVSS2