CVE-2013-1068

What it actually does

Improper sudoers configuration in Nova and Cinder packages permits privilege escalation when an attacker chains the flaw with a separate vulnerability.

Why it matters to the business

Cloud infrastructure becomes easier to compromise, raising the chance of unauthorized control over virtual machines, storage, and tenant data.

How an attack unfolds

An attacker first exploits a separate vulnerability in the OpenStack environment, then leverages the permissive sudo configuration to execute commands with elevated privileges and gain full control of the affected host.

How to fix it

Upgrade Nova to 1:2013.2.3-0ubuntu1.2 or 1:2014.1-0ubuntu1.2 and Cinder to 1:2013.2.3-0ubuntu1.1 or 1:2014.1-0ubuntu1.1 (or later) on Ubuntu 13.10/14.04 LTS; verify and correct sudoers entries for nova and cinder services.

How to confirm the fix worked

Confirm package versions match or exceed the fixed releases, review /etc/sudoers.d for correct restrictions on nova and cinder users, and run configuration validation tools provided by OpenStack.

Typical attack path

1. Identify and exploit a secondary vulnerability in Nova or Cinder
2. Trigger execution of commands via the misconfigured sudo rights
3. Escalate to root privileges on the compute or storage node
4. Pivot to other hosts or exfiltrate tenant data

How to detect it

Review sudo and auth logs for unexpected command executions by nova or cinder users; look for processes spawned from those services that should not require elevated rights.

What your security team should do

• Apply the listed package updates immediately on all affected Ubuntu systems
• Audit sudoers files for any overly permissive entries related to OpenStack services
• Monitor for privilege-escalation attempts in system logs