Two vulnerabilities have been reported in OpenStack Compute (Nova), which can be exploited by malicious users to cause a DoS (Denial of Service) and potentially compromise a vulnerable system.

1) The application improperly verifies paths in requests for file injections in disk images. This can be exploited to inject files in arbitrary locations on the host filesystem via directory traversal sequences.

This vulnerability only affects series Essex (2012.1) running OpenStack API over libvirt-based hypervisors.

2) An error when handling requests for instances based on images can be exploited to corrupt arbitrary files on the host filesystem via specially crafted images and cause a DoS.

Solution
Fixed in the GIT repository for series Essex (2012.1) and Folsom (2012.2). A fix for series Diablo (2011.3) is currently under review. A fixed version 2012.1.2 is planned to be released on 9th August 2012.

Provided and/or discovered by
1) The vendor credits Matthias Weckbecker, SUSE Security Team
2) Pádraig Brady, Red Hat within a Launchpad bug report.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Nova:
https://lists.launchpad.net/openstack/msg14089.html
https://bugs.launchpad.net/nova/+bug/1015531
https://lists.launchpad.net/openstack/msg15549.html
https://bugs.launchpad.net/nova/+bug/1031311
https://github.com/openstack/nova/commit/ce4b2e27be45a85b310237615c47eb53f37bb5f3
https://github.com/openstack/nova/commit/d9577ce9f266166a297488445b5b0c93c1ddb368
https://review.openstack.org/#/c/10953/

Deep Links
Links available to Secunia VIM customers