what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

Files from Ahmad Emneina

Apache CloudStack 4.0.0-incubating Information Disclosure

Posted Jan 12, 2013

Authored by Ahmad Emneina

The CloudStack security team was notified of a information disclosure vulnerability that exists in Apache CloudStack-4.0.0-incubating. With this vulnerability, when a user calls the createSSHKeyPair API command to create an SSH key pair to be used when authenticating to a user VM, the freshly generated SSH private key is rendered in a log file at INFO level on the CloudStack "master" server as well as being returned to the caller.

tags | advisory, info disclosure

advisories | CVE-2012-5616

SHA-256 | 7e5072bee6a90d8b464801d5889631f4bf7ef3c7f7dd527b84682cb89915ef5d

Download | Favorite | View