CVE-2012-1572
📋 TL;DR
CVE-2012-1572 is a denial-of-service vulnerability in OpenStack Keystone where extremely long passwords can crash the service by exhausting stack space. This affects OpenStack deployments using Keystone for identity management. Attackers can cause service disruption by submitting authentication requests with excessively long password parameters.
💻 Affected Systems
- OpenStack Keystone
📦 What is this software?
Keystone by Openstack
⚠️ Risk & Real-World Impact
Worst Case
Complete Keystone service crash leading to authentication failure across entire OpenStack deployment, disrupting all cloud operations.
Likely Case
Temporary service disruption requiring manual restart of Keystone components, causing authentication timeouts for users.
If Mitigated
Minimal impact with proper input validation and monitoring in place to detect and block malicious requests.
🎯 Exploit Status
Exploitation requires sending authentication requests with extremely long password strings. No authentication needed beyond standard API access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: OpenStack Keystone 2012.1.2 and later
Vendor Advisory: https://security.openstack.org/ossa/OSSA-2012-001.html
Restart Required: Yes
Instructions:
1. Update Keystone to version 2012.1.2 or later. 2. Restart Keystone services. 3. Verify the fix by checking Keystone version and testing with long password inputs.
🔧 Temporary Workarounds
Input Length Limiting
allConfigure web server or application firewall to limit password field length in authentication requests
# Example for Apache mod_security: SecRule ARGS:password "@gt 1024" "deny,status:400"
Rate Limiting
linuxImplement rate limiting on authentication endpoints to prevent repeated exploitation attempts
# Example using Keystone's rate limiting: [filter:ratelimit] paste.filter_factory = keystone.middleware:RateLimitMiddleware.factory
🧯 If You Can't Patch
- Implement network-level controls to restrict access to Keystone endpoints to trusted sources only
- Deploy web application firewall with rules to detect and block excessively long password parameters
🔍 How to Verify
Check if Vulnerable:
Check Keystone version: keystone-manage --version. If version is earlier than 2012.1.2, system is vulnerable.Check Version:
keystone-manage --versionVerify Fix Applied:
After patching, test authentication with a long password (e.g., 10,000 characters) and verify service remains responsive.📡 Detection & Monitoring
Log Indicators:
- Keystone service crashes or restarts in logs
- Authentication failures with unusually long request sizes in access logs
Network Indicators:
- Multiple authentication requests with abnormally large payload sizes
- Increased HTTP 400/500 responses from Keystone endpoints
SIEM Query:
source="keystone.log" AND ("crash" OR "restart" OR "segmentation fault") OR http_request_size > 10000