OSSA-2016-004: Swift proxy-server DoS through Large Object

Date:

January 20, 2016

CVE:

CVE-2016-0737 (client to proxy), CVE-2016-0738 (proxy to server)

Affects

• Swift: >=2.2.1 <= 2.3.0, >= 2.4.0 <= 2.5.0

Description

Romain LE DISEZ from OVH and Örjan Persson from Kiliaro independently reported two vulnerabilities in Swift Large Object. By repeatedly requesting and interrupting connections to a Large Object (Dynamic or Static) URL, a remote attacker may exhausts Swift proxy-server resources, potentially resulting in a denial of service. Note that there are two distinct bugs that can exhaust proxy resources, one for client connection (client to proxy), one for servers connection (proxy to server). All Swift setup are affected.

Patches

• https://review.openstack.org/270234 (proxy to server) (Kilo)

• https://review.openstack.org/217750 (client to proxy) (Kilo)

• https://review.openstack.org/270235 (proxy to server) (Liberty)

• https://review.openstack.org/270233 (proxy to server) (Mitaka)

Credits

• Romain LE DISEZ from OVH (CVE-2016-0737)

• Örjan Persson from Kiliaro (CVE-2016-0738)

References

• https://bugs.launchpad.net/bugs/1466549 (client to proxy)

• https://bugs.launchpad.net/bugs/1493303 (proxy to server)

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0737 (client to proxy)

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0738 (proxy to server)

Notes

• The client to proxy issue (CVE-2016-0737) is already fixed in Liberty

• The remaining fix will be included in future 2.3.1 (Kilo) and 2.5.1 (Liberty) releases.