CVE-2013-1068

Publication date 17 June 2014

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

The OpenStack Nova (python-nova) package 1:2013.2.3-0 before 1:2013.2.3-0ubuntu1.2 and 1:2014.1-0 before 1:2014.1-0ubuntu1.2 and Openstack Cinder (python-cinder) package 1:2013.2.3-0 before 1:2013.2.3-0ubuntu1.1 and 1:2014.1-0 before 1:2014.1-0ubuntu1.1 for Ubuntu 13.10 and 14.04 LTS does not properly set the sudo configuration, which makes it easier for attackers to gain privileges by leveraging another vulnerability.

Read the notes from the security team

Status

Package Ubuntu Release Status
cinder 14.04 LTS trusty
Fixed 1:2014.1-0ubuntu1.1
13.10 saucy
Fixed 1:2013.2.3-0ubuntu1.1
12.04 LTS precise Not in release
10.04 LTS lucid Not in release
nova 14.04 LTS trusty
Fixed 1:2014.1-0ubuntu1.2
13.10 saucy
Fixed 1:2013.2.3-0ubuntu1.2
12.04 LTS precise
Not affected
10.04 LTS lucid Not in release

Notes

jdstrand

only affects Folsom (Ubuntu 12.10) and higher. Essex did not have rootwrap.conf see CVE-2013-6433 medium because while this is a privilege escalation, it requires another vulnerability to exploit

References

Related Ubuntu Security Notices (USN)

    • USN-2247-1
    • OpenStack Nova vulnerabilities
    • 17 June 2014
    • USN-2248-1
    • OpenStack Cinder vulnerability
    • 18 June 2014

Other references