1. Home
  2. CVE Database
  3. CVE-2012-3447
MEDIUM · 4.9

CVE-2012-3447

virt/disk/api.py in OpenStack Compute (Nova) 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an ima...

Vulnerability Description

virt/disk/api.py in OpenStack Compute (Nova) 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image that uses a symlink that is only readable by root. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3361.

CVSS Score

4.9

MEDIUM

AV:N/AC:M/Au:S/C:N/I:P/A:P
Confidentiality
NONE
Integrity
PARTIAL
Availability
PARTIAL

Affected Products

VendorProductVersions
OpenstackFolsomAll versions
OpenstackNova2012.1

Related Weaknesses (CWE)

CWE-264

References

FAQ

What is CVE-2012-3447?

CVE-2012-3447 is a vulnerability with a CVSS score of 4.9 (MEDIUM). virt/disk/api.py in OpenStack Compute (Nova) 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an ima...

How severe is CVE-2012-3447?

CVE-2012-3447 has been rated MEDIUM with a CVSS base score of 4.9/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2012-3447?

Check the references section above for vendor advisories and patch information. Affected products include: Openstack Folsom, Openstack Nova.