Sign-up

ID

VAR-201606-0115


CVE

CVE-2016-3703


TITLE

Red Hat OpenShift Enterprise In Web Browser localStorage of API Credential access vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2016-003070

DESCRIPTION

Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod, which allows remote attackers to access API credentials in the web browser localStorage via an access_token in the query parameter. Supplementary information : CWE Vulnerability type by CWE-284: Improper Access Control ( Inappropriate access control ) Has been identified. http://cwe.mitre.org/data/definitions/284.htmlA third party access_token Through Web Browser localStorage of API Credentials may be accessed. Red Hat OpenShift is a platform-as-a-service (PaaS) cloud computing platform that builds, tests, deploys, and runs applications. OpenShift Enterprise is an open source private cloud version. Red Hat OpenShift Enterprise is prone to a security-bypass vulnerability. Successful exploits may allow an attackers to bypass certain intended security restrictions and perform unauthorized actions, which may aid in launching further attacks. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat OpenShift Enterprise 3.2 security update Advisory ID: RHSA-2016:1094-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2016:1094 Issue date: 2016-05-19 CVE Names: CVE-2016-3703 CVE-2016-3708 CVE-2016-3738 ===================================================================== 1. In addition, all images have been rebuilt on the new RHEL 7.2.4 base image. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Security Fix(es): * A vulnerability was found in the STI build process in OpenShift Enterprise. Access to STI builds was not properly restricted, allowing an attacker to use STI builds to access the Docker socket and escalate their privileges. (CVE-2016-3703) * A flaw was found in OpenShift Enterprise when multi-tenant SDN is enabled and a build is run within a namespace that would normally be isolated from pods in other namespaces. If an s2i build is run in such an environment the container being built can access network resources on pods that should not be available to it. This update includes the following images: openshift3/ose:v3.2.0.44-2 openshift3/ose-deployer:v3.2.0.44-2 openshift3/ose-docker-builder:v3.2.0.44-2 openshift3/ose-docker-registry:v3.2.0.44-2 openshift3/ose-f5-router:v3.2.0.44-2 openshift3/ose-haproxy-router:v3.2.0.44-2 openshift3/ose-keepalived-ipfailover:v3.2.0.44-2 openshift3/ose-pod:v3.2.0.44-2 openshift3/ose-recycler:v3.2.0.44-2 openshift3/ose-sti-builder:v3.2.0.44-2 openshift3/jenkins-1-rhel7:1.642-32 openshift3/logging-auth-proxy:3.2.0-4 openshift3/logging-deployment:3.2.0-9 openshift3/logging-elasticsearch:3.2.0-8 openshift3/logging-fluentd:3.2.0-8 openshift3/logging-kibana:3.2.0-4 openshift3/metrics-deployer:3.2.0-6 openshift3/metrics-heapster:3.2.0-6 openshift3/mongodb-24-rhel7:2.4-28 openshift3/mysql-55-rhel7:5.5-26 openshift3/nodejs-010-rhel7:0.10-35 openshift3/node:v3.2.0.44-2 openshift3/openvswitch:v3.2.0.44-2 openshift3/perl-516-rhel7:5.16-38 openshift3/php-55-rhel7:5.5-35 openshift3/postgresql-92-rhel7:9.2-25 openshift3/python-33-rhel7:3.3-35 openshift3/ruby-20-rhel7:2.0-35 aep3_beta/aep:v3.2.0.44-2 aep3_beta/aep-deployer:v3.2.0.44-2 aep3_beta/aep-docker-registry:v3.2.0.44-2 aep3_beta/aep-f5-router:v3.2.0.44-2 aep3_beta/aep-haproxy-router:v3.2.0.44-2 aep3_beta/aep-keepalived-ipfailover:v3.2.0.44-2 aep3_beta/aep-pod:v3.2.0.44-2 aep3_beta/aep-recycler:v3.2.0.44-2 aep3_beta/logging-auth-proxy:3.2.0-4 aep3_beta/logging-deployment:3.2.0-9 aep3_beta/logging-elasticsearch:3.2.0-8 aep3_beta/logging-fluentd:3.2.0-8 aep3_beta/logging-kibana:3.2.0-4 aep3_beta/metrics-deployer:3.2.0-6 aep3_beta/metrics-heapster:3.2.0-6 aep3_beta/node:v3.2.0.44-2 aep3_beta/openvswitch:v3.2.0.44-2 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1306011 - Deployer pods incorrectly using the host entry from openshiftLoopbackKubeconfig 1318974 - Creating pods on OSE with awsElasticBlockStore only assigns devices /dev/xvdb - /dev/xvdp to openshift node 1324996 - JSON message fields are getting overwritten 1329044 - console.dev-preview-int.openshift.com setting of memory limit confusing 1330233 - CVE-2016-3703 OpenShift Enterprise 3: Untrusted content loaded via the API proxy can access web console credentials on the same domain 1330364 - Should update the role name in the prompt on the web console 1331229 - CVE-2016-3708 OpenShiftEnterprise 3: s2i builds implicitly perform docker builds 1333168 - Node.js images crash with DEV_MODE=true 1333461 - CVE-2016-3738 origin: pod update allows docker socket access via build-pod 6. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-3703 https://access.redhat.com/security/cve/CVE-2016-3708 https://access.redhat.com/security/cve/CVE-2016-3738 https://access.redhat.com/security/updates/classification/#important 8. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFXPkiKXlSAg2UNWIIRAsa4AKDBVV9n5rX0BrQhspq/Kd1wNoTr8wCguVmp 9WTmxUn/XuRDJFzqxtZpCVI= =n+fK -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Trust: 2.61

sources: NVD: CVE-2016-3703 // JVNDB: JVNDB-2016-003070 // CNVD: CNVD-2016-03447 // BID: 90817 // PACKETSTORM: 137133 // PACKETSTORM: 137134

IOT TAXONOMY

category:['IoT']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2016-03447

AFFECTED PRODUCTS

vendor:redhatmodel:openshiftscope:eqversion:3.2

Trust: 1.6

vendor:redhatmodel:openshiftscope:eqversion:3.1

Trust: 1.6

vendor:red hatmodel:openshiftscope:eqversion:enterprise 3.1

Trust: 0.8

vendor:red hatmodel:openshiftscope:eqversion:enterprise 3.2

Trust: 0.8

vendor:redmodel:hat openshift enterprise x86 64scope:eqversion:3.2

Trust: 0.6

sources: CNVD: CNVD-2016-03447 // JVNDB: JVNDB-2016-003070 // CNNVD: CNNVD-201605-556 // NVD: CVE-2016-3703

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-3703
value: MEDIUM

Trust: 1.0

NVD: CVE-2016-3703
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2016-03447
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201605-556
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2016-3703
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2016-03447
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2016-3703
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 1.6
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2016-03447 // JVNDB: JVNDB-2016-003070 // CNNVD: CNNVD-201605-556 // NVD: CVE-2016-3703

PROBLEMTYPE DATA

problemtype:CWE-284

Trust: 1.0

problemtype:CWE-Other

Trust: 0.8

sources: JVNDB: JVNDB-2016-003070 // NVD: CVE-2016-3703

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201605-556

TYPE

access control error

Trust: 0.6

sources: CNNVD: CNNVD-201605-556

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-003070

PATCH
title:RHSA-2016:1094url:https://access.redhat.com/errata/RHSA-2016:1094
Trust: 0.8
title:RHSA-2016:1095url:https://access.redhat.com/errata/RHSA-2016:1095
Trust: 0.8
title:Patch for Red Hat OpenShift Enterprise certificate acquisition vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/76307
Trust: 0.6
title:Red Hat OpenShift Enterprise Security vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=61870
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2016-03447 // 
            
            
            
            JVNDB: JVNDB-2016-003070 // 
            
            
            
            CNNVD: CNNVD-201605-556

EXTERNAL IDS
db:NVDid:CVE-2016-3703
Trust: 3.5
db:JVNDBid:JVNDB-2016-003070
Trust: 0.8
db:CNVDid:CNVD-2016-03447
Trust: 0.6
db:CNNVDid:CNNVD-201605-556
Trust: 0.6
db:BIDid:90817
Trust: 0.3
db:PACKETSTORMid:137133
Trust: 0.1
db:PACKETSTORMid:137134
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2016-03447 // 
            
            
            
            BID: 90817 // 
            
            
            
            JVNDB: JVNDB-2016-003070 // 
            
            
            
            PACKETSTORM: 137133 // 
            
            
            
            PACKETSTORM: 137134 // 
            
            
            
            CNNVD: CNNVD-201605-556 // 
            
            
            
            NVD: CVE-2016-3703

REFERENCES
url:https://access.redhat.com/errata/rhsa-2016:1095
Trust: 1.7
url:https://access.redhat.com/errata/rhsa-2016:1094
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-3703
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-3703
Trust: 0.8
url:https://access.redhat.com/security/cve/cve-2016-3703
Trust: 0.8
url:https://access.redhat.com/errata/rhsa-2016
Trust: 0.6
url:https://bugzilla.redhat.com/show_bug.cgi?id=1330233
Trust: 0.6
url:https://www.redhat.com/mailman/listinfo/rhsa-announce
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2016-3703
Trust: 0.2
url:https://bugzilla.redhat.com/):
Trust: 0.2
url:https://access.redhat.com/security/team/key/
Trust: 0.2
url:https://access.redhat.com/articles/11258
Trust: 0.2
url:https://access.redhat.com/security/team/contact/
Trust: 0.2
url:https://access.redhat.com/security/updates/classification/#moderate
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2016-3708
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-3708
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2016-3738
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-3738
Trust: 0.1
url:https://access.redhat.com/security/updates/classification/#important
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2016-03447 // 
            
            
            
            JVNDB: JVNDB-2016-003070 // 
            
            
            
            PACKETSTORM: 137133 // 
            
            
            
            PACKETSTORM: 137134 // 
            
            
            
            CNNVD: CNNVD-201605-556 // 
            
            
            
            NVD: CVE-2016-3703

CREDITS
Jordan Liggitt (Red Hat)
Trust: 0.3
sources:
            
            
            BID: 90817

SOURCES
db:CNVDid:CNVD-2016-03447
db:BIDid:90817
db:JVNDBid:JVNDB-2016-003070
db:PACKETSTORMid:137133
db:PACKETSTORMid:137134
db:CNNVDid:CNNVD-201605-556
db:NVDid:CVE-2016-3703

LAST UPDATE DATE
2024-08-14T13:57:13.729000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2016-03447date:2016-05-24T00:00:00
db:BIDid:90817date:2016-05-19T00:00:00
db:JVNDBid:JVNDB-2016-003070date:2016-06-10T00:00:00
db:CNNVDid:CNNVD-201605-556date:2023-04-04T00:00:00
db:NVDid:CVE-2016-3703date:2023-02-12T23:18:27.953

SOURCES RELEASE DATE
db:CNVDid:CNVD-2016-03447date:2016-05-24T00:00:00
db:BIDid:90817date:2016-05-19T00:00:00
db:JVNDBid:JVNDB-2016-003070date:2016-06-10T00:00:00
db:PACKETSTORMid:137133date:2016-05-20T22:49:22
db:PACKETSTORMid:137134date:2016-05-20T22:49:30
db:CNNVDid:CNNVD-201605-556date:2016-05-20T00:00:00
db:NVDid:CVE-2016-3703date:2016-06-08T17:59:04.703