CVE-2011-0730 Eucalyptus before 2.0.3 and Eucalyptus EE before 2.0.2, as used in Ubuntu Enterprise Cloud (UEC) and other products, do not properly interpret signed elements in SOAP requests, which allows man-in-the...
MediumCVSS 6.5
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Eucalyptus before 2.0.3 and Eucalyptus EE before 2.0.2, as used in Ubuntu Enterprise Cloud (UEC) and other products, do not properly interpret signed elements in SOAP requests, which allows man-in-the-middle attackers to execute arbitrary commands by modifying a request, related to an "XML Signature Element Wrapping" or a "SOAP signature replay" issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| eucalyptus | < 2.0.2 | 2.0.2 |
| eucalyptus | < 2.0.3 | 2.0.3 |
| Canonical Ubuntu Linux | = 10.04 | No fix listed |
| Canonical Ubuntu Linux | = 10.10 | No fix listed |
| Canonical Ubuntu Linux | = 11.04 | No fix listed |
References
- launchpadlibrarian.net patch third-party-advisory
- open.eucalyptus.com vendor-advisory
- 44705 third-party-advisory
- 48000 third-party-advisory vdb-entry
- USN-1137-1 third-party-advisory vendor-advisory
- bugs.launchpad.net third-party-advisory
- eucalyptus-soap-command-execution(67670) third-party-advisory vdb-entry
- launchpad.net patch third-party-advisory