CVE:CVE-2012-2654
CNNVD:CNNVD-201206-115
OpenStack是由Rackspace和NASA共同开发的云计算平台，帮助服务商和企业内部实现类似于Amazon EC2和S3的云基础架构。
OpenStack Compute (Nova) Folsom (2012.2)，Essex (2012.1)和Diablo (2011.3)中的(1)EC2和(2)OS APIs中存在漏洞，该漏洞源于在不正确情况下定义的协议（如‘TCP’而非‘tcp'），会导致之后的字符串比较失效。远程攻击者可利用该漏洞不正确设置“Security Group”，导致“Security Group”规则失效及绕过安全限制。
solution:Upgrade openstack compute to a higher version than 2012.2,and avoid the version 2012.2; Upgrade openstack diablo to a higher version than 2011.3,and avoid the version 2011.3; Upgrade openstack essex to a higher version than 2012.1,and avoid the version 2012.1