Authentication bypass using an alternate path or channel in Ceph - CVE-2020-25660

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU48684

Authentication bypass using an alternate path or channel in Ceph - CVE-2020-25660

Published: November 23, 2020 / Updated: November 27, 2020


Vulnerability identifier: #VU48684
CSH Severity: Medium
CVSS v4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-25660
CWE-ID: CWE-288
Exploitation vector: Adjecent network
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists with in the implementation of the Cephx authentication protocol. A remote attacker with access to the Ceph cluster network can intercept authentication packets and perform  replay attacks in Nautilus.

The vulnerability affects msgr2 protocol only and is basically a reintroduction of previously patched vulnerability #VU14542.


Affected software

Ceph
Gentoo Linux
Arch Linux
Ubuntu
Fedora
Red Hat Ceph Storage
OpenShift Data Foundation (formerly OpenShift Container Storage)
ceph (Alpine package)
ceph
ceph (Ubuntu package)
ceph-base (Ubuntu package)
ceph-common (Ubuntu package)

How to mitigate CVE-2020-25660

Install updates from vendor's website.

Ceph - addressed in versions 14.2.14, 15.2.6, 14.2.8-115.el7cp, 14.2.8-115.el8cp
Red Hat Ceph Storage - update to 4.1
ceph - addressed in versions 15.2.6-1.fc33, 15.2.7-1.fc33
ceph (Ubuntu package) - addressed in versions 15.2.7-0ubuntu0.20.04.2, 15.2.7-0ubuntu0.20.10.3
ceph-base (Ubuntu package) - addressed in versions 15.2.7-0ubuntu0.20.04.2, 15.2.7-0ubuntu0.20.10.3
ceph-common (Ubuntu package) - addressed in versions 15.2.7-0ubuntu0.20.04.2, 15.2.7-0ubuntu0.20.10.3

External References

Related Security Bulletins