Security restrictions bypass in Ceph - CVE-2018-1129

Vulnerability identifier: #VU14543

CSH Severity: Low

CVSS v4: 2.3 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-1129

CWE-ID: CWE-264

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows an adjacent attacker to bypass security restrictions on the target system.

The vulnerability exists in ceph branches master, mimic, luminous and jewel due to improper handling of signature calculation by cephx authentication protocol. An adjacent attacker with access to ceph cluster network who is able to alter the message payload can bypass signature checks done by cephx protocol to conduct further attacks.

Ceph
Debian Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Scientific Computing
Opensuse
Fedora
Red Hat Ceph Storage
cephmetrics (Red Hat package)
nfs-ganesha (Red Hat package)
ceph-ansible (Red Hat package)
ceph

Install update from vendor's website.

Ceph - addressed in versions 10.2.10-28.el7cp, 12.2.4-30.el7cp
Red Hat Ceph Storage - addressed in versions 2.5, 3
cephmetrics (Red Hat package) - update to 1.0.1-1.el7cp
nfs-ganesha (Red Hat package) - update to 2.5.5-6.el7cp
ceph-ansible (Red Hat package) - update to 3.0.39-1.el7cp
ceph - addressed in versions 12.2.6-1.fc27, 12.2.6-1.fc28, 12.2.7-1.fc27

• https://access.redhat.com/security/cve/cve-2018-1129

• Multiple vulnerabilities in ceph
• Debian update for ceph
• OpenSUSE Linux update for ceph
• OpenSUSE Linux update for ceph
• Red Hat Ceph Storage 3 update for ceph
• Red Hat Ceph Storage 2 update for ceph
• Fedora 28 update for ceph
• Fedora 27 update for ceph
• Fedora 27 update for ceph
• Multiple vulnerabilities in Red Hat Ceph Storage 3
• Multiple vulnerabilities in Red Hat Ceph Storage 2