[Forgot Password]
Login  Register Subscribe

23631

 
 

126941

 
 

98250

 
 

909

 
 

79281

 
 

109

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML

CVE-2011-0730

Date: (C)2011-06-02   (M)2017-08-18 


Eucalyptus before 2.0.3 and Eucalyptus EE before 2.0.2, as used in Ubuntu Enterprise Cloud (UEC) and other products, do not properly interpret signed elements in SOAP requests, which allows man-in-the-middle attackers to execute arbitrary commands by modifying a request, related to an "XML Signature Element Wrapping" or a "SOAP signature replay" issue.

CVSS Score: 6.5Access Vector: NETWORK
Exploit Score: 8.0Access Complexity: LOW
Impact Score: 6.4Authentication: SINGLE_INSTANCE
 Confidentiality: PARTIAL
 Integrity: PARTIAL
 Availability: PARTIAL





Reference:
SECUNIA-44705
BID-48000
USN-1137-1
eucalyptus-soap-command-execution(67670)
http://launchpadlibrarian.net/72472626/eucalyptus_2.0.1%2Bbzr1256-0ubuntu5_2.0.1%2Bbzr1256-0ubuntu6.diff.gz
http://open.eucalyptus.com/wiki/esa-02
https://bugs.launchpad.net/bugs/746101
https://launchpad.net/ubuntu/+source/eucalyptus/+changelog

CPE    11
cpe:/a:eucalyptus:eucalyptus:2.0.1
cpe:/a:eucalyptus:eucalyptus:2.0.0
cpe:/a:eucalyptus:eucalyptus:2.0.2
cpe:/a:eucalyptus:eucalyptus:1.4
...
CWE    1
CWE-20

© 2013 SecPod Technologies