oss-security - [OSSA 2016-004] Swift proxy-server DoS through Large Object (CVE-2016-0737, CVE-2016-0738)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <569FEAAD.1090800@redhat.com>
Date: Wed, 20 Jan 2016 20:14:37 +0000
From: Tristan Cacqueray <tdecacqu@...hat.com>
To: oss-security@...ts.openwall.com
Subject: [OSSA 2016-004] Swift proxy-server DoS through Large Object
 (CVE-2016-0737, CVE-2016-0738)

==========================================================
OSSA-2016-004: Swift proxy-server DoS through Large Object
==========================================================

:Date: January 20, 2016
:CVE: CVE-2016-0737 (client to proxy), CVE-2016-0738 (proxy to server)


Affects
~~~~~~~
- Swift: >=2.2.1 <= 2.3.0, >= 2.4.0 <= 2.5.0


Description
~~~~~~~~~~~
Romain LE DISEZ from OVH and Örjan Persson from Kiliaro independently
reported two vulnerabilities in Swift Large Object. By repeatedly
requesting and interrupting connections to a Large Object (Dynamic or
Static) URL, a remote attacker may exhausts Swift proxy-server
resources, potentially resulting in a denial of service. Note that
there are two distinct bugs that can exhaust proxy resources, one for
client connection (client to proxy), one for servers connection (proxy
to server). All Swift setup are affected.


Patches
~~~~~~~
- https://review.openstack.org/217750 (client to proxy) (Kilo)
- https://review.openstack.org/270234 (proxy to server) (Kilo)
- https://review.openstack.org/270235 (proxy to server) (Liberty)
- https://review.openstack.org/270233 (proxy to server) (Mitaka)


Credits
~~~~~~~
- Romain LE DISEZ from OVH (CVE-2016-0737)
- Örjan Persson from Kiliaro (CVE-2016-0738)


References
~~~~~~~~~~
- https://bugs.launchpad.net/bugs/1466549 (client to proxy)
- https://bugs.launchpad.net/bugs/1493303 (proxy to server)
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0737 (client
  to proxy)
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0738 (proxy to
  server)


Notes
~~~~~
- The client to proxy issue (CVE-2016-0737) is already fixed in Liberty
- The remaining fix will be included in future 2.3.1 (Kilo) and 2.5.1
  (Liberty) releases.

-- 
Tristan Cacqueray
OpenStack Vulnerability Management Team


Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.