Eucalyptus before 2.0.3 and Eucalyptus EE before 2.0.2, as used in Ubuntu Enterprise Cloud (UEC) and other products, do not properly interpret signed elements in SOAP requests, which allows man-in-the-middle attackers to execute arbitrary commands by modifying a request, related to an "XML Signature Element Wrapping" or a "SOAP signature replay" issue.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
21 Nov 2024, 01:24
Type | Values Removed | Values Added |
---|---|---|
References | () http://launchpadlibrarian.net/72472626/eucalyptus_2.0.1%2Bbzr1256-0ubuntu5_2.0.1%2Bbzr1256-0ubuntu6.diff.gz - Patch, Third Party Advisory | |
References | () http://open.eucalyptus.com/wiki/esa-02 - Vendor Advisory | |
References | () http://secunia.com/advisories/44705 - Third Party Advisory | |
References | () http://www.securityfocus.com/bid/48000 - Third Party Advisory, VDB Entry | |
References | () http://www.ubuntu.com/usn/USN-1137-1 - Third Party Advisory | |
References | () https://bugs.launchpad.net/bugs/746101 - Third Party Advisory | |
References | () https://exchange.xforce.ibmcloud.com/vulnerabilities/67670 - Third Party Advisory, VDB Entry | |
References | () https://launchpad.net/ubuntu/+source/eucalyptus/+changelog - Patch, Third Party Advisory |
Information
Published : 2011-06-02 19:55
Updated : 2024-11-21 01:24
NVD link : CVE-2011-0730
Mitre link : CVE-2011-0730
CVE.ORG link : CVE-2011-0730
JSON object : View
Products Affected
canonical
- ubuntu_linux
eucalyptus
- eucalyptus
CWE
CWE-20
Improper Input Validation