#VU43390 Code Injection in Swift - CVE-2012-4406 

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU43390

#VU43390 Code Injection in Swift - CVE-2012-4406

Published: October 23, 2012 / Updated: August 11, 2020


Vulnerability identifier: #VU43390
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2012-4406
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
Swift
Software vendor:
Apple Inc.

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a crafted pickle object.


Remediation

Install update from vendor's website.

External links