CVE-2015-5240 | BDVDB-2026-72555 Detail

Description#

Race condition in OpenStack Neutron before 2014.2.4 and 2015.1 before 2015.1.2, when using the ML2 plugin or the security groups AMQP API, allows remote authenticated users to bypass IP anti-spoofing controls by changing the device owner of a port to start with network: before the security group rules are applied.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://rhn.redhat.com/errata/RHSA-2015-1909.html
https://bugzilla.redhat.com/show_bug.cgi?id=1258458
https://security.openstack.org/ossa/OSSA-2015-018.html
https://bugs.launchpad.net/neutron/+bug/1489111
http://www.openwall.com/lists/oss-security/2015/09/08/9

Exploit#

No public exploit known

History#

Version 12015-10-27Record published in the CVE List.
Version 22024-08-06Most recent update recorded in the CVE List.